Help intrusion!!!

keymi_ -  
Bonjour,

Un peu d'aide pour me débarrasser de cette misère....merci!!!!

Logfile of HijackThis v1.99.1
Scan saved at 15:41:34, on 15/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe
C:\Program Files\NCH Swift Sound\Components\mp3el\mp3enc.exe
C:\Program Files\NCH Swift Sound\Components\mp3el\mp3enc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\SPYWAREfighter\spftray.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SPYWAREfighter\spfprc.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Philips\Philips SPC210NC Webcam\TrayMin210.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Last.fm\LastFMHelper.exe
C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe
C:\Program Files\PrevxCSI\prevxcsi.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\céline\Mes documents\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.acer.com/worldwide/selection.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
F3 - REG:win.ini: run="C:\WINDOWS\system32\winupdate.exe"
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {23D44BCF-AA7A-41D6-8905-E808F16322EF} - C:\WINDOWS\system32\awtqnol.dll (file missing)
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\PROGRA~1\eoRezo\EoAdv\EOREZO~1.DLL (file missing)
O2 - BHO: (no name) - {6F1187C2-5AE3-4B19-BED6-7F75AE994463} - C:\WINDOWS\system32\ssqpn.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O2 - BHO: Starware - {F7C7AA47-BCA6-451D-8DBC-C10A8F75C8C7} - C:\Program Files\Starware\bin\Starware.dll (file missing)
O3 - Toolbar: Starware - {9839B3B7-3F99-4498-884D-6CFCCD251AB1} - C:\Program Files\Starware\bin\Starware.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC210NC Webcam
O4 - HKLM\..\Run: [BroadWaveRun] "C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe" -logon
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\SPYWAREfighter\spftray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Registry Helper] "C:\Program Files\Registry Helper\RegistryHelper.Exe" /boot
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [dngoeoxhxh] c:\documents and settings\céline\local settings\application data\dngoeoxhxh.exe dngoeoxhxh
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
O4 - Startup: PrevxCSI.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O4 - Global Startup: Docteur Club Internet.lnk = C:\Program Files\Club-Internet\Dr Club Internet\bin\matcli.exe
O4 - Global Startup: TrayMin210.exe.lnk = ?
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?44205e924f8d47d5ae7d1c5f57050daf
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?44205e924f8d47d5ae7d1c5f57050daf
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://keymithug21nada.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {7A96FF35-4937-11D1-8F2C-00609779BDA3} (ScolPlugin Class) - http://www.i-maginer.fr/NewATLScol062006.dll
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_activex/fr/TSEasyInstallX.CAB
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (Contrôleur de DownloadManager) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.6.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F568B427-549F-4B70-AE76-2CA56F0E6C1D}: NameServer = 194.117.200.10,194.117.200.15
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: awtqnol - C:\WINDOWS\
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winhld32 - winhld32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BroadWave Service (BroadWaveService) - Unknown owner - C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe" -service (file missing)
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Program Files\SPYWAREfighter\spfprc.exe
Configuration: Windows XP
Internet Explorer 7.0

42 réponses

Résumé de la discussion

Un fil porte sur la suppression de malwares sous Windows XP à partir d'un rapport HijackThis détaillé et d'une demande d'aide pour nettoyer le système. Le rapport liste de nombreuses entrées potentiellement indésirables: barres d'outils, BHO, composants au démarrage et services, avec des fichiers manquants et des références à Yahoo Toolbar, Google Desktop, Winamp Toolbar. Certains éléments du log correspondent à des composants légitimes, d'autres à des programmes potentiellement indésirables, ce qui rend nécessaire une vérification minutieuse des startups, des extensions et des services pour éviter les faux positifs.

Bobot (l’IA à votre service)
  1. jfkpresident Contributeur sécurité
    salut ,

    Télécharger Vundofix.exe (par Atribune) sur votre Bureau : http://www.atribune.org/ccount/click.php?id=4

    * Double-cliquer sur VundoFix.exe afin de le lancer.
    * Cliquer sur le bouton Scan for Vundo.
    * Lorsque le scan est complété, cliquer sur le bouton Remove Vundo.
    * Une invite de commande demandera si l’on souhaite supprimer les fichiers, cliquer sur YES
    * Après avoir cliqué "YES", le Bureau disparaîtra un moment lors de la suppression des fichiers.
    * Une nouvelle invite de commande annoncera que le PC devra s'éteindre ("shutdown"). Cliquer sur OK , puis laisser le redémarrer.
    * Le contenu du rapport est situé dans C:\vundofix.txt, poste le stp

    * Télécharge VirtumundoBeGone sur ton bureau .
    http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
    * double-clic sur VirtumundoBeGone.exe
    * Suis les instructions à l'écran
    * Quand le scan est terminé, enregistre le rapport.
    * Copie/Colle le ici
    1. keymi_
      Salut, ben je dois dire qu'il est à nouveau un peu ralenti..
      Ce matin un scan avec Prevx a décelé un virus, mais je n'ai malheureusement plus la trace de son nom..

      Voilà un nouvel Hijack

      Logfile of HijackThis v1.99.1
      Scan saved at 21:17:07, on 03/03/2008
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16608)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      C:\Program Files\Bonjour\mDNSResponder.exe
      C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe
      C:\Program Files\NCH Swift Sound\Components\mp3el\mp3enc.exe
      C:\Program Files\NCH Swift Sound\Components\mp3el\mp3enc.exe
      C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
      C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
      C:\WINDOWS\SOUNDMAN.EXE
      C:\Acer\Empowering Technology\eRecovery\Monitor.exe
      C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
      C:\Program Files\BroadJump\Client Foundation\CFD.exe
      C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
      C:\WINDOWS\VM_STI.EXE
      C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe
      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
      C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
      C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      C:\WINDOWS\system32\sistray.exe
      C:\Program Files\Philips\Philips SPC210NC Webcam\TrayMin210.exe
      C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
      C:\Program Files\Last.fm\LastFMHelper.exe
      C:\Program Files\PrevxCSI\prevxcsi.exe
      C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe
      C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Windows Live\installer\WLSetupSvc.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      C:\Program Files\internet explorer\iexplore.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
      C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      C:\Documents and Settings\céline\Mes documents\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
      O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
      O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
      O4 - HKLM\..\Run: [LaunchApp] Alaunch
      O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
      O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
      O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
      O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
      O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
      O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
      O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
      O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
      O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
      O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
      O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
      O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC210NC Webcam
      O4 - HKLM\..\Run: [BroadWaveRun] "C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe" -logon
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
      O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
      O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [Registry Helper] "C:\Program Files\Registry Helper\RegistryHelper.Exe" /boot
      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
      O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
      O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
      O4 - Startup: PrevxCSI.lnk = ?
      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
      O4 - Global Startup: Docteur Club Internet.lnk = C:\Program Files\Club-Internet\Dr Club Internet\bin\matcli.exe
      O4 - Global Startup: TrayMin210.exe.lnk = ?
      O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
      O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
      O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?44205e924f8d47d5ae7d1c5f57050daf
      O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?44205e924f8d47d5ae7d1c5f57050daf
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
      O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
      O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
      O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
      O11 - Options group: [INTERNATIONAL] International*
      O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
      O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://keymithug21nada.spaces.live.com//PhotoUpload/MsnPUpld.cab
      O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
      O16 - DPF: {6531D99C-0D0E-4293-B3CB-A3E1D0D41847} (AhnASP Control) - http://aspglobal.ahnlab.com/asp/cab/AhnASP.cab
      O16 - DPF: {664088B0-6AF3-4514-AF9D-A0DC3A3DF24A} (F-Secure Online Scanner 3.3) - https://www.f-secure.com/en/home/support
      O16 - DPF: {7A96FF35-4937-11D1-8F2C-00609779BDA3} (ScolPlugin Class) - http://www.i-maginer.fr/NewATLScol062006.dll
      O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
      O16 - DPF: {9BDBC41E-C335-4263-83C0-ECE78EE28A33} (SysMonOCX Control) - http://aspglobal.ahnlab.com/asp/myfirewall20/cab/myfirewall20.cab
      O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_activex/fr/TSEasyInstallX.CAB
      O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5241/mcfscan.cab
      O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (Contrôleur de DownloadManager) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.6.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{F568B427-549F-4B70-AE76-2CA56F0E6C1D}: NameServer = 194.117.200.10,194.117.200.15
      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
      O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
      O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
      O20 - Winlogon Notify: awtqnol - C:\WINDOWS\
      O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
      O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
      O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
      O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
      O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
      O23 - Service: BroadWave Service (BroadWaveService) - Unknown owner - C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe" -service (file missing)
      O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
      O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
      O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
      O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
      O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
      2. keymi_
        voilà pour le Hijack

        Logfile of HijackThis v1.99.1
        Scan saved at 10:32:40, on 03/03/2008
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16608)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        C:\Program Files\Bonjour\mDNSResponder.exe
        C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe
        C:\Program Files\NCH Swift Sound\Components\mp3el\mp3enc.exe
        C:\Program Files\NCH Swift Sound\Components\mp3el\mp3enc.exe
        C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
        C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
        C:\WINDOWS\SOUNDMAN.EXE
        C:\Acer\Empowering Technology\eRecovery\Monitor.exe
        C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
        C:\Program Files\BroadJump\Client Foundation\CFD.exe
        C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
        C:\WINDOWS\VM_STI.EXE
        C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe
        C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
        C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
        C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
        C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        C:\WINDOWS\system32\sistray.exe
        C:\Program Files\Philips\Philips SPC210NC Webcam\TrayMin210.exe
        C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
        C:\Program Files\Last.fm\LastFMHelper.exe
        C:\Program Files\PrevxCSI\prevxcsi.exe
        C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe
        C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\wuauclt.exe
        C:\Program Files\MSN Messenger\msnmsgr.exe
        C:\Program Files\Internet Explorer\IEXPLORE.EXE
        C:\Documents and Settings\céline\Mes documents\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
        O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
        O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
        O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
        O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O4 - HKLM\..\Run: [LaunchApp] Alaunch
        O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
        O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
        O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
        O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
        O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
        O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
        O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
        O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
        O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
        O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
        O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
        O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC210NC Webcam
        O4 - HKLM\..\Run: [BroadWaveRun] "C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe" -logon
        O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
        O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
        O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
        O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [Registry Helper] "C:\Program Files\Registry Helper\RegistryHelper.Exe" /boot
        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
        O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
        O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
        O4 - Startup: PrevxCSI.lnk = ?
        O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
        O4 - Global Startup: Docteur Club Internet.lnk = C:\Program Files\Club-Internet\Dr Club Internet\bin\matcli.exe
        O4 - Global Startup: TrayMin210.exe.lnk = ?
        O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
        O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
        O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?44205e924f8d47d5ae7d1c5f57050daf
        O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?44205e924f8d47d5ae7d1c5f57050daf
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
        O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
        O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
        O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
        O11 - Options group: [INTERNATIONAL] International*
        O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
        O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://keymithug21nada.spaces.live.com//PhotoUpload/MsnPUpld.cab
        O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
        O16 - DPF: {6531D99C-0D0E-4293-B3CB-A3E1D0D41847} (AhnASP Control) - http://aspglobal.ahnlab.com/asp/cab/AhnASP.cab
        O16 - DPF: {664088B0-6AF3-4514-AF9D-A0DC3A3DF24A} (F-Secure Online Scanner 3.3) - https://www.f-secure.com/en/home/support
        O16 - DPF: {7A96FF35-4937-11D1-8F2C-00609779BDA3} (ScolPlugin Class) - http://www.i-maginer.fr/NewATLScol062006.dll
        O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
        O16 - DPF: {9BDBC41E-C335-4263-83C0-ECE78EE28A33} (SysMonOCX Control) - http://aspglobal.ahnlab.com/asp/myfirewall20/cab/myfirewall20.cab
        O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_activex/fr/TSEasyInstallX.CAB
        O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5241/mcfscan.cab
        O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (Contrôleur de DownloadManager) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.6.cab
        O17 - HKLM\System\CCS\Services\Tcpip\..\{F568B427-549F-4B70-AE76-2CA56F0E6C1D}: NameServer = 194.117.200.10,194.117.200.15
        O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
        O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
        O20 - Winlogon Notify: awtqnol - C:\WINDOWS\
        O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
        O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
        O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
        O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
        O23 - Service: BroadWave Service (BroadWaveService) - Unknown owner - C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe" -service (file missing)
        O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
        O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
        O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
        O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
        O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
        3. keymi_
          Bonjour,

          Voilà pour BTfix
          BTFix 1.080 (par bibi26) - 02/03/2008 14:43:51 - Analyse
          Lancé depuis C:\Documents and Settings\céline\Bureau\virus\BTFix\BTFix.exe

          ---> Fichiers/Dossiers trouvés

          ---> Analyse terminée

          Puis pour le combo:

          ComboFix 08-03-01.3 - céline 2008-03-02 15:12:13.4 - [color=red][b]FAT32[/b][/color]x86
          Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.980 [GMT 1:00]
          Endroit: C:\Documents and Settings\céline\Bureau\virus\ComboFix.exe
          Command switches used :: C:\Documents and Settings\céline\Bureau\CFScript.txt
          * Création d'un nouveau point de restauration

          [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

          FILE ::
          C:\WINDOWS\system32\awtqnol.dll
          C:\WINDOWS\system32\ssqpn.dll
          C:\WINDOWS\system32\winhld32.dll
          .

          ((((((((((((((((((((((((((((( Fichiers créés 2008-02-02 to 2008-03-02 ))))))))))))))))))))))))))))))))))))
          .

          2008-03-01 21:21 . 2008-03-01 21:21 <REP> d-------- C:\Program Files\iPod
          2008-03-01 21:21 . 2008-03-02 12:19 54,156 --ah----- C:\WINDOWS\QTFont.qfn
          2008-03-01 21:21 . 2008-03-01 21:22 1,409 --a------ C:\WINDOWS\QTFont.for
          2008-03-01 21:19 . 2008-03-01 21:19 <REP> d-------- C:\Program Files\Fichiers communs\Apple
          2008-03-01 17:56 . 2008-03-01 17:56 <REP> d-------- C:\Program Files\QuickTime
          2008-02-29 14:30 . 2008-02-29 14:30 <REP> d-------- C:\Program Files\AhnLab
          2008-02-29 11:04 . 2008-02-29 11:04 <REP> d-------- C:\Program Files\getnow
          2008-02-29 09:51 . 2008-02-29 09:51 <REP> d-------- C:\WINDOWS\McAfee.com
          2008-02-29 09:41 . 2008-02-29 09:41 <REP> d-------- C:\fsaua.data
          2008-02-28 18:53 . 2008-02-28 18:53 <REP> d-------- C:\WINDOWS\BDOSCAN8
          2008-02-26 17:29 . 2008-02-26 17:29 11,669,245 --a------ C:\upload_moi_KEYMI.tar.gz
          2008-02-26 16:56 . 2008-02-26 16:56 <REP> d-------- C:\Documents and Settings\céline\Application Data\Sony
          2008-02-26 16:53 . 2001-10-19 15:40 1,683,792 --a------ C:\WINDOWS\system32\wmvcore2.dll
          2008-02-26 16:53 . 2001-10-19 15:40 665,424 --a------ C:\WINDOWS\system32\wmv8dmoe.dll
          2008-02-26 16:53 . 2002-10-09 13:21 566,272 --a------ C:\WINDOWS\system32\wmvdmoe.dll
          2008-02-26 16:53 . 2001-10-19 15:40 438,608 --a------ C:\WINDOWS\system32\wmv8dmod.dll
          2008-02-26 16:53 . 2001-10-19 03:05 285,184 --a------ C:\WINDOWS\system32\wmidx2.ocx
          2008-02-26 16:53 . 2008-02-26 16:53 156,910 --a------ C:\WINDOWS\WMSysPr8.prx
          2008-02-26 16:52 . 2008-02-26 16:52 <REP> d-------- C:\Program Files\Sony Setup
          2008-02-23 13:33 . 2008-02-23 13:33 <REP> d-------- C:\Documents and Settings\céline\Application Data\Grisoft
          2008-02-23 13:33 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
          2008-02-21 17:16 . 2008-02-21 17:16 <REP> d-------- C:\Program Files\ESET
          2008-02-21 17:16 . 2008-02-21 17:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\ESET
          2008-02-21 16:58 . 2008-02-21 16:58 <REP> d-------- C:\Program Files\Lavasoft
          2008-02-21 16:58 . 2008-02-21 16:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
          2008-02-21 16:57 . 2008-02-21 16:58 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
          2008-02-18 19:31 . 2008-02-18 19:31 <REP> d-------- C:\Program Files\Navilog1
          2008-02-18 14:34 . 2008-02-18 14:34 <REP> d-------- C:\WINDOWS\ERUNT
          2008-02-18 14:25 . 2008-02-18 14:25 <REP> d--hs---- C:\FOUND.013
          2008-02-15 23:41 . 2008-02-15 23:41 <REP> d-------- C:\Documents and Settings\céline\.housecall6.6
          2008-02-15 23:41 . 2008-02-15 23:41 <REP> d-------- C:\Documents and Settings\céline\.housecall6.6
          2008-02-15 15:51 . 2008-02-15 15:51 <REP> d-------- C:\Program Files\Zone Labs
          2008-02-14 17:57 . 2008-02-14 17:57 <REP> d-------- C:\VundoFix Backups
          2008-02-14 09:59 . 2008-02-14 09:59 <REP> d-------- C:\Program Files\SPYWAREfighter
          2008-02-14 09:17 . 2008-02-14 09:17 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
          2008-02-13 11:23 . 2008-02-13 11:23 3,262 --a------ C:\WINDOWS\system32\sex2.ico
          2008-02-13 11:23 . 2008-02-13 11:23 3,262 --a------ C:\WINDOWS\system32\sex1.ico
          2008-02-13 11:20 . 2008-02-13 11:20 <REP> d-------- C:\Program Files\Kaspersky Lab
          2008-02-13 11:00 . 2008-02-13 11:00 <REP> d-------- C:\kav
          2008-02-13 09:39 . 2008-02-13 09:39 <REP> d--hs---- C:\FOUND.012
          2008-02-13 08:54 . 2008-02-13 08:54 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
          2008-02-13 08:54 . 2008-02-13 08:54 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
          2008-02-12 08:09 . 2008-02-12 08:09 <REP> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
          2008-02-12 07:42 . 2008-02-12 07:42 <REP> d-------- C:\Program Files\Bonjour
          2008-02-12 07:26 . 2008-02-12 07:26 <REP> d-------- C:\Program Files\Fichiers communs\Macrovision Shared
          2008-02-03 20:58 . 2008-02-03 20:58 <REP> d-------- C:\Documents and Settings\céline\Application Data\Yahoo!

          .
          (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
          .
          2008-03-02 13:00 10,752 ----a-w C:\WINDOWS\system32\drivers\pxark.sys
          2008-01-25 10:17 --------- d-----w C:\Documents and Settings\céline\Application Data\Download Manager
          2008-01-22 14:40 --------- d-----w C:\Program Files\PrevxCSI
          2008-01-21 11:39 --------- d-----w C:\Documents and Settings\céline\Application Data\Stellarium
          2008-01-21 11:25 --------- d-----w C:\Program Files\Celestia
          2008-01-21 11:24 --------- d-----w C:\Program Files\WinStars2
          2008-01-21 11:19 --------- d-----w C:\Program Files\Microsoft Silverlight
          2008-01-11 05:36 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
          2008-01-09 11:18 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
          2008-01-09 11:18 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
          2008-01-09 11:18 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
          2008-01-09 11:18 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
          2008-01-09 11:16 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
          2008-01-09 11:16 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
          2008-01-09 11:16 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
          2008-01-09 11:16 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
          2008-01-09 11:16 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
          2008-01-09 11:16 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
          2008-01-06 12:58 --------- d-----w C:\Program Files\Apple Software Update
          2008-01-06 12:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
          2008-01-06 12:49 --------- d-----w C:\Program Files\Winamp Remote
          2008-01-06 10:24 15,397 ----a-w C:\Program Files\settings.dat
          2008-01-06 10:23 --------- d-----w C:\Program Files\PDFCreator
          2007-12-19 22:53 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
          2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\dllcache\mrxdav.sys
          2007-12-11 19:44 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
          2007-12-11 19:44 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
          2007-12-11 19:44 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
          2007-12-11 19:44 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
          2007-12-11 19:44 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
          2007-12-11 19:44 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
          2007-12-11 19:44 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
          2007-12-11 19:43 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
          2007-12-08 05:08 3,592,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
          2007-12-06 11:03 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe
          2007-12-06 11:02 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
          2007-12-06 11:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
          2007-12-06 04:59 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
          2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\dllcache\oleaut32.dll
          2007-12-04 18:41 550,912 ------w C:\WINDOWS\system32\oleaut32.dll
          2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
          2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
          2007-09-28 09:30 491 ----a-w C:\Program Files\INSTALL.LOG
          2007-03-19 19:13 6,422,611 ----a-w C:\Program Files\frostwire-4.13.1.6.windows.exe
          2007-01-18 10:47 774,144 ----a-w C:\Program Files\RngInterstitial.dll
          .

          ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
          .
          .
          REGEDIT4
          *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 05:00 15360]
          "Registry Helper"="C:\Program Files\Registry Helper\RegistryHelper.exe" [ ]
          "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-21 11:04 68856]
          "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "LaunchApp"="Alaunch" []
          "ntiMUI"="C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 18:15 45056]
          "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768]
          "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 05:00 208952]
          "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 05:00 59392]
          "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 05:00 455168]
          "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 05:00 455168]
          "SiSPower"="SiSPower.dll" [2005-07-13 02:55 49152 C:\WINDOWS\system32\SiSPower.dll]
          "SoundMan"="SOUNDMAN.EXE" [2005-08-17 11:39 90112 C:\WINDOWS\soundman.exe]
          "eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\Monitor.exe" [2005-11-16 17:00 397312]
          "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
          "BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2003-01-27 17:16 376912]
          "StandardInstall"="" []
          "EoEngine"="" []
          "EoWeather"="" []
          "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-12 07:07 1838592]
          "BigDogPath"="C:\WINDOWS\VM_STI.exe" [2004-06-09 15:37 40960]
          "BroadWaveRun"="C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe" [2007-03-25 07:53 401412]
          "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-11-04 05:06 185632]
          "AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 15:53 88024]
          "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-12-21 08:21 1443072]
          "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
          "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-31 23:13 385024]
          "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]

          [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
          "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 05:00 15360]

          C:\Documents and Settings\c‚line\Menu D‚marrer\Programmes\D‚marrage\
          Outil de d‚tection de support Picture Motion Browser.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2007-12-27 20:54:44 344064]
          Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-10-21 06:58:14 106496]
          PrevxCSI.lnk - C:\Program Files\PrevxCSI\prevxcsi.exe [2008-02-27 10:04:15 99840]

          C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
          Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06 29696]
          Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2006-07-21 21:53:34 262144]
          Docteur Club Internet.lnk - C:\Program Files\Club-Internet\Dr Club Internet\bin\matcli.exe [2006-07-21 22:38:14 217088]
          TrayMin210.exe.lnk - C:\Program Files\Philips\Philips SPC210NC Webcam\TrayMin210.exe [2007-01-25 19:14:55 278528]
          Cisco Systems VPN Client.lnk - C:\Program Files\Cisco Systems\VPN Client\vpngui.exe [2007-10-03 05:46:15 1524776]

          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
          "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
          "%windir%\\system32\\sessmgr.exe"=
          "C:\\Program Files\\Messenger\\msmsgs.exe"=
          "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
          "C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
          "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
          "C:\\Program Files\\MSN Messenger\\livecall.exe"=
          "C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
          "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
          "C:\\Program Files\\Last.fm\\LastFM.exe"=
          "C:\\Program Files\\i-voyager\\scol.exe"=
          "C:\\Program Files\\SecondLifeReleaseCandidate\\SLVoice.exe"=
          "C:\\Program Files\\Winamp Remote\\BIN\\OrbStreamerClient.exe"=
          "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
          "C:\\kav\\kis7.0\\french\\setup.exe"=
          "C:\\kav\\kav7.0\\french\\setup.exe"=
          "C:\\Program Files\\iTunes\\iTunes.exe"=

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
          "500:UDP"= 500:UDP:VPN
          "11007:TCP"= 11007:TCP:emule
          "16658:UDP"= 16658:UDP:emule
          "4662:TCP"= 4662:TCP:em
          "4672:UDP"= 4672:UDP:em
          "1700:TCP"= 1700:TCP:MioNet Remote Drive Access
          "1641:TCP"= 1641:TCP:MioNet Remote Drive Verification
          "4672:TCP"= 4672:TCP:emule entrant
          "4662:UDP"= 4662:UDP:sortant emule

          R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2007-12-21 08:21]
          R2 BroadWaveService;BroadWave Service;"C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe" -service []
          R2 int15.sys;int15.sys;C:\Acer\Empowering Technology\eRecovery\int15.sys [2005-01-13 14:46]
          R3 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-03-02 14:00]
          R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-05 05:00]

          *Newly Created Service* - INT15.SYS
          .
          Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
          "2008-03-02 14:11:02 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
          - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
          "2008-03-01 20:17:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
          - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
          .
          **************************************************************************

          catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
          Rootkit scan 2008-03-02 15:13:49
          Windows 5.1.2600 Service Pack 2 FAT NTAPI

          Balayage processus cachés ...

          Balayage caché autostart entries ...

          Balayage des fichiers cachés ...

          Scan terminé avec succès
          Les fichiers cachés: 0

          **************************************************************************
          .
          Temps d'accomplissement: 2008-03-02 15:14:40
          ComboFix-quarantined-files.txt 2008-03-02 14:14:38
          ComboFix3.txt 2008-02-29 18:22:46
          ComboFix2.txt 2008-03-02 14:01:16
          .
          2008-02-14 02:22:23 --- E O F ---
          1. jfkpresident Contributeur sécurité
            ensuite tu feras ceci avec combofix :

            Crée un nouveau document texte et nomme le CFScript.txt ( attention très important ! ) : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes en gras :

            file::

            C:\WINDOWS\system32\ssqpn.dll
            C:\WINDOWS\system32\awtqnol.dll
            C:\WINDOWS\system32\winhld32.dll

            folder::

            C:\Program Files\Starware

            registry::

            [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtqnol]

            [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winhld32]
            winhld32.dll

            [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6F1187C2-5AE3-4B19-BED6-7F75AE994463}]
            C:\WINDOWS\system32\ssqpn.dll

            [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F7C7AA47-BCA6-451D-8DBC-C10A8F75C8C7}]
            C:\Program Files\Starware\bin\Starware.dll

            ensuite fais glisser le fichier texte sur combo.exe comme sur l'animation :
            http://img.bleepingcomputer.com/combofix/usage/rc.gif

            Dans la fenêtre qui suit, choisie l'option 1 puis valide
            Patiente un peu, si le bureau disparait parfois durant le scan : c'est normal !
            A la fin du scan, un rapport va s'afficher : poste le stp ( sinon il se situe dans ici : C:\ComboFix.txt )
            2. keymi_
              ben je pense qu'il s'active un peu mieux ce PC, aurais-je retrouvé ma station de contrôle d'origine?????un grand merci à Jfk pour son assistance, grâce à qui mes travaux de recherche pour mon mémoire vont pouvoir être à nouveau comme avant...
              héhé hier j'ai pensé à Jfk en mattant un film "Bubba Ho tep"...ya un sacré perso Jfk dedans...

              Pour le PC, il est parfois ralenti mais c'est peut être due à ma nouvelle protection érigée contre le mal!!!! Bon week....le soleil refait son apparition...mais boooo pas de neige en perspective....

              voici le dernier scan AVG
              VG Anti-Spyware - Rapport d'analyse
              ---------------------------------------------------------

              + Créé à: 17:20:56 01/03/2008

              + Résultat de l'analyse:

              C:\Documents and Settings\céline\Cookies\céline@aolfr.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
              C:\Documents and Settings\céline\Cookies\céline@atdmt[1].txt -> TrackingCookie.Atdmt : Nettoyé.
              C:\Documents and Settings\céline\Cookies\céline@fastclick[1].txt -> TrackingCookie.Fastclick : Nettoyé.
              C:\Documents and Settings\céline\Cookies\céline@fastclick[2].txt -> TrackingCookie.Fastclick : Nettoyé.

              Fin du rapport
              1. jfkpresident Contributeur sécurité
                bon week end a toi aussi malgré qu'il ai commencé avec la pluie ......

                dis moi comment se comporte ton pc ??
                1. keymi_
                  voilà voilà bon week à vous cher Jfk!!

                  Logfile of HijackThis v1.99.1
                  Scan saved at 14:14:00, on 01/03/2008
                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                  MSIE: Internet Explorer v7.00 (7.00.6000.16608)

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\WINDOWS\Explorer.EXE
                  C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                  C:\Program Files\Bonjour\mDNSResponder.exe
                  C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe
                  C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
                  C:\Program Files\NCH Swift Sound\Components\mp3el\mp3enc.exe
                  C:\Program Files\NCH Swift Sound\Components\mp3el\mp3enc.exe
                  C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
                  C:\WINDOWS\SOUNDMAN.EXE
                  C:\Acer\Empowering Technology\eRecovery\Monitor.exe
                  C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
                  C:\Program Files\BroadJump\Client Foundation\CFD.exe
                  C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                  C:\Program Files\iTunes\iTunesHelper.exe
                  C:\WINDOWS\VM_STI.EXE
                  C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe
                  C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                  C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
                  C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
                  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                  C:\WINDOWS\system32\ctfmon.exe
                  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                  C:\WINDOWS\system32\sistray.exe
                  C:\Program Files\Philips\Philips SPC210NC Webcam\TrayMin210.exe
                  C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
                  C:\Program Files\Last.fm\LastFMHelper.exe
                  C:\Program Files\PrevxCSI\prevxcsi.exe
                  C:\Program Files\iPod\bin\iPodService.exe
                  C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe
                  C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\WINDOWS\system32\wuauclt.exe
                  C:\Program Files\MSN Messenger\msnmsgr.exe
                  C:\Program Files\Internet Explorer\IEXPLORE.EXE
                  C:\Documents and Settings\céline\Mes documents\HijackThis.exe

                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.acer.com/worldwide/selection.html
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
                  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
                  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
                  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
                  O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                  O4 - HKLM\..\Run: [LaunchApp] Alaunch
                  O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
                  O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
                  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
                  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                  O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
                  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                  O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
                  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
                  O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
                  O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
                  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                  O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC210NC Webcam
                  O4 - HKLM\..\Run: [BroadWaveRun] "C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe" -logon
                  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                  O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
                  O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
                  O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                  O4 - HKCU\..\Run: [Registry Helper] "C:\Program Files\Registry Helper\RegistryHelper.Exe" /boot
                  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                  O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
                  O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
                  O4 - Startup: PrevxCSI.lnk = ?
                  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                  O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
                  O4 - Global Startup: Docteur Club Internet.lnk = C:\Program Files\Club-Internet\Dr Club Internet\bin\matcli.exe
                  O4 - Global Startup: TrayMin210.exe.lnk = ?
                  O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
                  O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                  O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?44205e924f8d47d5ae7d1c5f57050daf
                  O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?44205e924f8d47d5ae7d1c5f57050daf
                  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                  O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                  O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
                  O11 - Options group: [INTERNATIONAL] International*
                  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
                  O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
                  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://keymithug21nada.spaces.live.com//PhotoUpload/MsnPUpld.cab
                  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                  O16 - DPF: {6531D99C-0D0E-4293-B3CB-A3E1D0D41847} (AhnASP Control) - http://aspglobal.ahnlab.com/asp/cab/AhnASP.cab
                  O16 - DPF: {664088B0-6AF3-4514-AF9D-A0DC3A3DF24A} (F-Secure Online Scanner 3.3) - https://www.f-secure.com/en/home/support
                  O16 - DPF: {7A96FF35-4937-11D1-8F2C-00609779BDA3} (ScolPlugin Class) - http://www.i-maginer.fr/NewATLScol062006.dll
                  O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
                  O16 - DPF: {9BDBC41E-C335-4263-83C0-ECE78EE28A33} (SysMonOCX Control) - http://aspglobal.ahnlab.com/asp/myfirewall20/cab/myfirewall20.cab
                  O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_activex/fr/TSEasyInstallX.CAB
                  O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5241/mcfscan.cab
                  O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (Contrôleur de DownloadManager) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.6.cab
                  O17 - HKLM\System\CCS\Services\Tcpip\..\{F568B427-549F-4B70-AE76-2CA56F0E6C1D}: NameServer = 194.117.200.10,194.117.200.15
                  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                  O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
                  O20 - Winlogon Notify: awtqnol - C:\WINDOWS\
                  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                  O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
                  O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                  O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                  O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                  O23 - Service: BroadWave Service (BroadWaveService) - Unknown owner - C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe" -service (file missing)
                  O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
                  O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
                  O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
                  O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
                  O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                  O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
                  O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
                  1. jfkpresident Contributeur sécurité
                    re,

                    -> Relance HijackThis cliques sur « scanner seulement » ou (« do a scan only »),
                    coche les cases devant ces lignes :

                    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
                    O2 - BHO: (no name) - {23D44BCF-AA7A-41D6-8905-E808F16322EF} - (no file)
                    O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\PROGRA~1\eoRezo\EoAdv\EOREZO~1.DLL (file missing)
                    O2 - BHO: (no name) - {6F1187C2-5AE3-4B19-BED6-7F75AE994463} - C:\WINDOWS\system32\ssqpn.dll (file missing)
                    O2 - BHO: Starware - {F7C7AA47-BCA6-451D-8DBC-C10A8F75C8C7} - C:\Program Files\Starware\bin\Starware.dll (file missing)
                    O3 - Toolbar: Starware - {9839B3B7-3F99-4498-884D-6CFCCD251AB1} - C:\Program Files\Starware\bin\Starware.dll (file missing)
                    O20 - Winlogon Notify: winhld32 - winhld32.dll (file missing)

                    et ensuite ferme toutes les fenêtres actives autres que HijackThis!, navigateur inclus,
                    puis clique "Fix checked"( ou « fixer objet »). Ferme HijackThis!

                    ensuite reposte moi un nouveau rapport .
                    1. keymi_
                      voilà:

                      Logfile of HijackThis v1.99.1
                      Scan saved at 20:19:34, on 29/02/2008
                      Platform: Windows XP SP2 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v7.00 (7.00.6000.16608)

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                      C:\Program Files\Bonjour\mDNSResponder.exe
                      C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe
                      C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
                      C:\Program Files\NCH Swift Sound\Components\mp3el\mp3enc.exe
                      C:\Program Files\NCH Swift Sound\Components\mp3el\mp3enc.exe
                      C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
                      C:\WINDOWS\SOUNDMAN.EXE
                      C:\Acer\Empowering Technology\eRecovery\Monitor.exe
                      C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
                      C:\Program Files\BroadJump\Client Foundation\CFD.exe
                      C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                      C:\Program Files\iTunes\iTunesHelper.exe
                      C:\WINDOWS\VM_STI.EXE
                      C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe
                      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                      C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
                      C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                      C:\WINDOWS\system32\ctfmon.exe
                      C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                      C:\WINDOWS\system32\sistray.exe
                      C:\Program Files\iPod\bin\iPodService.exe
                      C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                      C:\Program Files\Philips\Philips SPC210NC Webcam\TrayMin210.exe
                      C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
                      C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe
                      C:\Program Files\Last.fm\LastFMHelper.exe
                      C:\Program Files\PrevxCSI\prevxcsi.exe
                      C:\WINDOWS\explorer.exe
                      C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\MSN Messenger\msnmsgr.exe
                      C:\Program Files\Internet Explorer\IEXPLORE.EXE
                      C:\Documents and Settings\céline\Mes documents\HijackThis.exe

                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.acer.com/worldwide/selection.html
                      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
                      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
                      O2 - BHO: (no name) - {23D44BCF-AA7A-41D6-8905-E808F16322EF} - (no file)
                      O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                      O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\PROGRA~1\eoRezo\EoAdv\EOREZO~1.DLL (file missing)
                      O2 - BHO: (no name) - {6F1187C2-5AE3-4B19-BED6-7F75AE994463} - C:\WINDOWS\system32\ssqpn.dll (file missing)
                      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                      O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
                      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
                      O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                      O2 - BHO: Starware - {F7C7AA47-BCA6-451D-8DBC-C10A8F75C8C7} - C:\Program Files\Starware\bin\Starware.dll (file missing)
                      O3 - Toolbar: Starware - {9839B3B7-3F99-4498-884D-6CFCCD251AB1} - C:\Program Files\Starware\bin\Starware.dll (file missing)
                      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
                      O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                      O4 - HKLM\..\Run: [LaunchApp] Alaunch
                      O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
                      O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
                      O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                      O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
                      O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                      O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                      O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
                      O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                      O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
                      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
                      O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
                      O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
                      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                      O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC210NC Webcam
                      O4 - HKLM\..\Run: [BroadWaveRun] "C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe" -logon
                      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                      O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
                      O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
                      O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                      O4 - HKCU\..\Run: [Registry Helper] "C:\Program Files\Registry Helper\RegistryHelper.Exe" /boot
                      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                      O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                      O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
                      O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
                      O4 - Startup: PrevxCSI.lnk = ?
                      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                      O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
                      O4 - Global Startup: Docteur Club Internet.lnk = C:\Program Files\Club-Internet\Dr Club Internet\bin\matcli.exe
                      O4 - Global Startup: TrayMin210.exe.lnk = ?
                      O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
                      O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                      O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?44205e924f8d47d5ae7d1c5f57050daf
                      O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?44205e924f8d47d5ae7d1c5f57050daf
                      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                      O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                      O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                      O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                      O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
                      O11 - Options group: [INTERNATIONAL] International*
                      O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
                      O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
                      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://keymithug21nada.spaces.live.com//PhotoUpload/MsnPUpld.cab
                      O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                      O16 - DPF: {6531D99C-0D0E-4293-B3CB-A3E1D0D41847} (AhnASP Control) - http://aspglobal.ahnlab.com/asp/cab/AhnASP.cab
                      O16 - DPF: {664088B0-6AF3-4514-AF9D-A0DC3A3DF24A} (F-Secure Online Scanner 3.3) - https://www.f-secure.com/en/home/support
                      O16 - DPF: {7A96FF35-4937-11D1-8F2C-00609779BDA3} (ScolPlugin Class) - http://www.i-maginer.fr/NewATLScol062006.dll
                      O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
                      O16 - DPF: {9BDBC41E-C335-4263-83C0-ECE78EE28A33} (SysMonOCX Control) - http://aspglobal.ahnlab.com/asp/myfirewall20/cab/myfirewall20.cab
                      O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_activex/fr/TSEasyInstallX.CAB
                      O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5241/mcfscan.cab
                      O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (Contrôleur de DownloadManager) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.6.cab
                      O17 - HKLM\System\CCS\Services\Tcpip\..\{F568B427-549F-4B70-AE76-2CA56F0E6C1D}: NameServer = 194.117.200.10,194.117.200.15
                      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                      O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
                      O20 - Winlogon Notify: awtqnol - C:\WINDOWS\
                      O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                      O20 - Winlogon Notify: winhld32 - winhld32.dll (file missing)
                      O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
                      O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                      O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                      O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                      O23 - Service: BroadWave Service (BroadWaveService) - Unknown owner - C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe" -service (file missing)
                      O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
                      O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
                      O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
                      O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
                      O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                      O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
                      O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
                      1. jfkpresident Contributeur sécurité
                        reposte moi un nouvel hijack .....je regadrais demain .

                        a demain .
                        1. keymi_
                          héhé, ben Kapersky a été remplacé par Eset Nod 32....
                          VOivi le rapport:

                          ComboFix 08-02-25.3 - céline 2008-02-29 19:20:40.2 - [color=red][b]FAT32[/b][/color]x86
                          Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1053 [GMT 1:00]
                          Endroit: C:\Documents and Settings\céline\Bureau\ComboFix.exe

                          [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
                          .

                          (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                          .
                          .
                          ---- Previous Run -------
                          .
                          C:\WINDOWS\system32\npqss.ini
                          C:\WINDOWS\system32\npqss.ini2
                          D:\Autorun.inf

                          .
                          ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

                          .
                          -------\LEGACY_NTLOAD

                          ((((((((((((((((((((((((((((( Fichiers créés 2008-01-28 to 2008-02-29 ))))))))))))))))))))))))))))))))))))
                          .

                          2008-02-29 14:30 . 2008-02-29 14:30 <REP> d-------- C:\Program Files\AhnLab
                          2008-02-29 11:04 . 2008-02-29 11:04 <REP> d-------- C:\Program Files\getnow
                          2008-02-29 09:51 . 2008-02-29 09:51 <REP> d-------- C:\WINDOWS\McAfee.com
                          2008-02-29 09:41 . 2008-02-29 09:41 <REP> d-------- C:\fsaua.data
                          2008-02-28 18:53 . 2008-02-28 18:53 <REP> d-------- C:\WINDOWS\BDOSCAN8
                          2008-02-26 20:01 . 2008-02-26 20:01 54,156 --ah----- C:\WINDOWS\QTFont.qfn
                          2008-02-26 20:01 . 2008-02-26 20:01 1,409 --a------ C:\WINDOWS\QTFont.for
                          2008-02-26 17:29 . 2008-02-26 17:29 11,669,245 --a------ C:\upload_moi_KEYMI.tar.gz
                          2008-02-26 16:56 . 2008-02-26 16:56 <REP> d-------- C:\Documents and Settings\céline\Application Data\Sony
                          2008-02-26 16:53 . 2001-10-19 15:40 1,683,792 --a------ C:\WINDOWS\system32\wmvcore2.dll
                          2008-02-26 16:53 . 2001-10-19 15:40 665,424 --a------ C:\WINDOWS\system32\wmv8dmoe.dll
                          2008-02-26 16:53 . 2002-10-09 13:21 566,272 --a------ C:\WINDOWS\system32\wmvdmoe.dll
                          2008-02-26 16:53 . 2001-10-19 15:40 438,608 --a------ C:\WINDOWS\system32\wmv8dmod.dll
                          2008-02-26 16:53 . 2001-10-19 03:05 285,184 --a------ C:\WINDOWS\system32\wmidx2.ocx
                          2008-02-26 16:53 . 2008-02-26 16:53 156,910 --a------ C:\WINDOWS\WMSysPr8.prx
                          2008-02-26 16:52 . 2008-02-26 16:52 <REP> d-------- C:\Program Files\Sony Setup
                          2008-02-23 13:33 . 2008-02-23 13:33 <REP> d-------- C:\Documents and Settings\céline\Application Data\Grisoft
                          2008-02-23 13:33 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
                          2008-02-21 17:16 . 2008-02-21 17:16 <REP> d-------- C:\Program Files\ESET
                          2008-02-21 17:16 . 2008-02-21 17:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\ESET
                          2008-02-21 16:58 . 2008-02-21 16:58 <REP> d-------- C:\Program Files\Lavasoft
                          2008-02-21 16:58 . 2008-02-21 16:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
                          2008-02-21 16:57 . 2008-02-21 16:58 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
                          2008-02-18 19:31 . 2008-02-18 19:31 <REP> d-------- C:\Program Files\Navilog1
                          2008-02-18 14:34 . 2008-02-18 14:34 <REP> d-------- C:\WINDOWS\ERUNT
                          2008-02-18 14:25 . 2008-02-18 14:25 <REP> d--hs---- C:\FOUND.013
                          2008-02-15 23:41 . 2008-02-15 23:41 <REP> d-------- C:\Documents and Settings\céline\.housecall6.6
                          2008-02-15 23:41 . 2008-02-15 23:41 <REP> d-------- C:\Documents and Settings\céline\.housecall6.6
                          2008-02-15 15:51 . 2008-02-15 15:51 <REP> d-------- C:\Program Files\Zone Labs
                          2008-02-14 17:57 . 2008-02-14 17:57 <REP> d-------- C:\VundoFix Backups
                          2008-02-14 09:59 . 2008-02-14 09:59 <REP> d-------- C:\Program Files\SPYWAREfighter
                          2008-02-14 09:17 . 2008-02-14 09:17 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
                          2008-02-13 11:23 . 2008-02-13 11:23 3,262 --a------ C:\WINDOWS\system32\sex2.ico
                          2008-02-13 11:23 . 2008-02-13 11:23 3,262 --a------ C:\WINDOWS\system32\sex1.ico
                          2008-02-13 11:20 . 2008-02-13 11:20 <REP> d-------- C:\Program Files\Kaspersky Lab
                          2008-02-13 11:00 . 2008-02-13 11:00 <REP> d-------- C:\kav
                          2008-02-13 09:39 . 2008-02-13 09:39 <REP> d--hs---- C:\FOUND.012
                          2008-02-13 08:54 . 2008-02-13 08:54 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
                          2008-02-13 08:54 . 2008-02-13 08:54 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
                          2008-02-12 08:09 . 2008-02-12 08:09 <REP> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
                          2008-02-12 07:42 . 2008-02-12 07:42 <REP> d-------- C:\Program Files\Bonjour
                          2008-02-12 07:26 . 2008-02-12 07:26 <REP> d-------- C:\Program Files\Fichiers communs\Macrovision Shared
                          2008-02-03 20:58 . 2008-02-03 20:58 <REP> d-------- C:\Documents and Settings\céline\Application Data\Yahoo!

                          .
                          (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                          .
                          2008-02-29 14:01 10,752 ----a-w C:\WINDOWS\system32\drivers\pxark.sys
                          2008-01-25 10:17 --------- d-----w C:\Documents and Settings\céline\Application Data\Download Manager
                          2008-01-22 14:40 --------- d-----w C:\Program Files\PrevxCSI
                          2008-01-21 11:39 --------- d-----w C:\Documents and Settings\céline\Application Data\Stellarium
                          2008-01-21 11:25 --------- d-----w C:\Program Files\Celestia
                          2008-01-21 11:24 --------- d-----w C:\Program Files\WinStars2
                          2008-01-21 11:19 --------- d-----w C:\Program Files\Microsoft Silverlight
                          2008-01-11 05:36 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
                          2008-01-09 11:18 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
                          2008-01-09 11:18 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
                          2008-01-09 11:18 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
                          2008-01-09 11:18 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
                          2008-01-09 11:16 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
                          2008-01-09 11:16 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
                          2008-01-09 11:16 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
                          2008-01-09 11:16 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
                          2008-01-09 11:16 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
                          2008-01-09 11:16 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
                          2008-01-06 12:59 --------- d-----w C:\Program Files\QuickTime
                          2008-01-06 12:58 --------- d-----w C:\Program Files\Apple Software Update
                          2008-01-06 12:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
                          2008-01-06 12:49 --------- d-----w C:\Program Files\Winamp Remote
                          2008-01-06 10:24 15,397 ----a-w C:\Program Files\settings.dat
                          2008-01-06 10:23 --------- d-----w C:\Program Files\PDFCreator
                          2007-12-30 15:58 --------- d-----w C:\Documents and Settings\céline\Application Data\Sony Corporation
                          2007-12-28 14:17 --------- d-----w C:\Program Files\i-voyager
                          2007-12-19 22:53 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
                          2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\dllcache\mrxdav.sys
                          2007-12-11 19:44 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
                          2007-12-11 19:44 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
                          2007-12-11 19:44 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
                          2007-12-11 19:44 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
                          2007-12-11 19:44 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
                          2007-12-11 19:44 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
                          2007-12-11 19:44 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
                          2007-12-11 19:43 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
                          2007-12-08 05:08 3,592,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
                          2007-12-06 11:03 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe
                          2007-12-06 11:02 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
                          2007-12-06 11:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
                          2007-12-06 04:59 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
                          2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\dllcache\oleaut32.dll
                          2007-12-04 18:41 550,912 ------w C:\WINDOWS\system32\oleaut32.dll
                          2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
                          2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
                          2007-09-28 09:30 491 ----a-w C:\Program Files\INSTALL.LOG
                          2007-03-19 19:13 6,422,611 ----a-w C:\Program Files\frostwire-4.13.1.6.windows.exe
                          2007-01-18 10:47 774,144 ----a-w C:\Program Files\RngInterstitial.dll
                          .

                          ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                          .
                          .
                          REGEDIT4
                          *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

                          [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6F1187C2-5AE3-4B19-BED6-7F75AE994463}]
                          C:\WINDOWS\system32\ssqpn.dll

                          [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F7C7AA47-BCA6-451D-8DBC-C10A8F75C8C7}]
                          C:\Program Files\Starware\bin\Starware.dll

                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
                          {9839B3B7-3F99-4498-884D-6CFCCD251AB1}
                          {2318C2B1-4965-11D4-9B18-009027A5CD4F}
                          {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}

                          [HKEY_CLASSES_ROOT\clsid\{9839b3b7-3f99-4498-884d-6cfccd251ab1}]

                          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                          "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 05:00 15360]
                          "Registry Helper"="C:\Program Files\Registry Helper\RegistryHelper.exe" [ ]
                          "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-21 11:04 68856]
                          "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]

                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                          "LaunchApp"="Alaunch" []
                          "ntiMUI"="C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 18:15 45056]
                          "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768]
                          "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 05:00 208952]
                          "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 05:00 59392]
                          "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 05:00 455168]
                          "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 05:00 455168]
                          "SiSPower"="SiSPower.dll" [2005-07-13 02:55 49152 C:\WINDOWS\system32\SiSPower.dll]
                          "SoundMan"="SOUNDMAN.EXE" [2005-08-17 11:39 90112 C:\WINDOWS\soundman.exe]
                          "eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\Monitor.exe" [2005-11-16 17:00 397312]
                          "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
                          "BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2003-01-27 17:16 376912]
                          "StandardInstall"="" []
                          "EoEngine"="" []
                          "EoWeather"="" []
                          "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-12 07:07 1838592]
                          "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 09:36 256576]
                          "BigDogPath"="C:\WINDOWS\VM_STI.exe" [2004-06-09 15:37 40960]
                          "BroadWaveRun"="C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe" [2007-03-25 07:53 401412]
                          "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-11-04 05:06 185632]
                          "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-12-11 10:56 286720]
                          "AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 15:53 88024]
                          "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-12-21 08:21 1443072]
                          "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]

                          [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                          "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 05:00 15360]

                          C:\Documents and Settings\c‚line\Menu D‚marrer\Programmes\D‚marrage\
                          Outil de d‚tection de support Picture Motion Browser.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2007-12-27 20:54:44 344064]
                          Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-10-21 06:58:14 106496]
                          PrevxCSI.lnk - C:\Program Files\PrevxCSI\prevxcsi.exe [2008-02-27 10:04:15 99328]

                          C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                          Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06 29696]
                          Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2006-07-21 21:53:34 262144]
                          Docteur Club Internet.lnk - C:\Program Files\Club-Internet\Dr Club Internet\bin\matcli.exe [2006-07-21 22:38:14 217088]
                          TrayMin210.exe.lnk - C:\Program Files\Philips\Philips SPC210NC Webcam\TrayMin210.exe [2007-01-25 19:14:55 278528]
                          Cisco Systems VPN Client.lnk - C:\Program Files\Cisco Systems\VPN Client\vpngui.exe [2007-10-03 05:46:15 1524776]

                          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtqnol]

                          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winhld32]
                          winhld32.dll

                          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
                          "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

                          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                          "%windir%\\system32\\sessmgr.exe"=
                          "C:\\Program Files\\Messenger\\msmsgs.exe"=
                          "C:\\Program Files\\iTunes\\iTunes.exe"=
                          "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                          "C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
                          "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
                          "C:\\Program Files\\MSN Messenger\\livecall.exe"=
                          "C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
                          "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
                          "C:\\Program Files\\Last.fm\\LastFM.exe"=
                          "C:\\Program Files\\i-voyager\\scol.exe"=
                          "C:\\Program Files\\SecondLifeReleaseCandidate\\SLVoice.exe"=
                          "C:\\Program Files\\Winamp Remote\\BIN\\OrbStreamerClient.exe"=
                          "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
                          "C:\\kav\\kis7.0\\french\\setup.exe"=
                          "C:\\kav\\kav7.0\\french\\setup.exe"=

                          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                          "500:UDP"= 500:UDP:VPN
                          "11007:TCP"= 11007:TCP:emule
                          "16658:UDP"= 16658:UDP:emule
                          "4662:TCP"= 4662:TCP:em
                          "4672:UDP"= 4672:UDP:em
                          "1700:TCP"= 1700:TCP:MioNet Remote Drive Access
                          "1641:TCP"= 1641:TCP:MioNet Remote Drive Verification
                          "4672:TCP"= 4672:TCP:emule entrant
                          "4662:UDP"= 4662:UDP:sortant emule

                          R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2007-12-21 08:21]
                          R2 BroadWaveService;BroadWave Service;"C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe" [2007-03-25 07:53]
                          R2 int15.sys;int15.sys;C:\Acer\Empowering Technology\eRecovery\int15.sys [2005-01-13 14:46]
                          R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-05 05:00]
                          S3 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-02-29 15:01]

                          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
                          \Shell\AutoRun\command - D:\setupSNK.exe

                          .
                          Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
                          "2008-02-29 18:11:02 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
                          - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
                          "2008-02-16 20:17:14 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
                          - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
                          .
                          **************************************************************************

                          catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                          Rootkit scan 2008-02-29 19:22:04
                          Windows 5.1.2600 Service Pack 2 FAT NTAPI

                          Balayage processus cachés ...

                          Balayage caché autostart entries ...

                          Balayage des fichiers cachés ...

                          Scan terminé avec succès
                          Les fichiers cachés: 0

                          **************************************************************************
                          .
                          Temps d'accomplissement: 2008-02-29 19:22:43
                          ComboFix-quarantined-files.txt 2008-02-29 18:22:42
                          .
                          2008-02-14 02:22:23 --- E O F ---
                          1. jfkpresident Contributeur sécurité
                            salut keymi : Ou est passé ton antivirus kapersky ??

                            tu vas passer combofix :

                            Télécharges ComboFix à partir d'un de ces liens :

                            http://download.bleepingcomputer.com/sUBs/ComboFix.exe
                            https://forospyware.com
                            http://www.geekstogo.com/forum/files/file/197-combofix-by-subs/

                            Et important, enregistre le sur le bureau.

                            Avant d'utiliser ComboFix :

                            ? Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

                            ? Désactive provisoirement et seulement le temps de l'utilisation de ComboFix,
                            la protection en temps réel de ton Antivirus et de tes Antispywares,
                            qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.

                            Une fois fait, sur ton bureau double-clic sur Combofix.exe.

                            - Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

                            /!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

                            - En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

                            - Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt,.
                            est automatiquement sauvegardé et rangé à C:\Combofix.txt)

                            ? Réactive la protection en temps réel de ton Antivirus et de tes Antispywares,
                            avant de te reconnecter à internet.

                            ? Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
                            1. keymi_
                              un nouveau scan en ligne à trouvé cela:

                              Computer name: KEYMI
                              Scanning type: Scan system for viruses, rootkits, spyware
                              Target: C:\ D:\ L:\
                              Result: 2 malware found
                              Tracking Cookie (spyware)

                              * System

                              W32/Bancos.RPC (virus)

                              * C:\DOCUMENTS AND SETTINGS\C�LINE\BUREAU\VIRUS\VUNDOFIX_VUNDOFIX_6.5.4_ANGLAIS_25107.EXE (Submitted)

                              Statistics
                              Scanned:

                              * Files: 78239
                              * System: 4922
                              * Not scanned: 13

                              Actions:

                              * Disinfected: 0
                              * Renamed: 0
                              * Deleted: 0
                              * None: 2
                              * Submitted: 1

                              Files not scanned:

                              * C:\PAGEFILE.SYS
                              * C:\HIBERFIL.SYS
                              * C:\DOCUMENTS AND SETTINGS\C�LINE\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\GOOGLE DESKTOP SEARCH\DBEAM
                              * C:\DOCUMENTS AND SETTINGS\C�LINE\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\GOOGLE DESKTOP SEARCH\DBEAO
                              * C:\DOCUMENTS AND SETTINGS\C�LINE\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\GOOGLE DESKTOP SEARCH\DBDAM
                              * C:\DOCUMENTS AND SETTINGS\C�LINE\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\GOOGLE DESKTOP SEARCH\DBDAO
                              * C:\DOCUMENTS AND SETTINGS\C�LINE\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\GOOGLE DESKTOP SEARCH\DBM
                              * C:\DOCUMENTS AND SETTINGS\C�LINE\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\GOOGLE DESKTOP SEARCH\HP
                              * C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
                              * C:\WINDOWS\SYSTEM32\CONFIG\SAM
                              * C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM
                              * C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
                              * C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
                              1. keymi_
                                arf il est tenace!!!

                                voilà pour Hijack

                                Logfile of HijackThis v1.99.1
                                Scan saved at 18:51:04, on 28/02/2008
                                Platform: Windows XP SP2 (WinNT 5.01.2600)
                                MSIE: Internet Explorer v7.00 (7.00.6000.16608)

                                Running processes:
                                C:\WINDOWS\System32\smss.exe
                                C:\WINDOWS\SYSTEM32\winlogon.exe
                                C:\WINDOWS\system32\services.exe
                                C:\WINDOWS\system32\lsass.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                                C:\WINDOWS\system32\spoolsv.exe
                                C:\WINDOWS\Explorer.EXE
                                C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                                C:\Program Files\Bonjour\mDNSResponder.exe
                                C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe
                                C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
                                C:\Program Files\NCH Swift Sound\Components\mp3el\mp3enc.exe
                                C:\Program Files\NCH Swift Sound\Components\mp3el\mp3enc.exe
                                C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
                                C:\WINDOWS\SOUNDMAN.EXE
                                C:\Acer\Empowering Technology\eRecovery\Monitor.exe
                                C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
                                C:\Program Files\BroadJump\Client Foundation\CFD.exe
                                C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                                C:\Program Files\iTunes\iTunesHelper.exe
                                C:\WINDOWS\VM_STI.EXE
                                C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe
                                C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                                C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
                                C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
                                C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                                C:\WINDOWS\system32\ctfmon.exe
                                C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                                C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                                C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                                C:\WINDOWS\system32\sistray.exe
                                C:\Program Files\Philips\Philips SPC210NC Webcam\TrayMin210.exe
                                C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
                                C:\Program Files\Last.fm\LastFMHelper.exe
                                C:\Program Files\PrevxCSI\prevxcsi.exe
                                C:\Program Files\iPod\bin\iPodService.exe
                                C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe
                                C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\WINDOWS\system32\wuauclt.exe
                                C:\Program Files\MSN Messenger\msnmsgr.exe
                                C:\Documents and Settings\céline\Mes documents\HijackThis.exe

                                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
                                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.acer.com/worldwide/selection.html
                                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
                                R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
                                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
                                O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
                                O2 - BHO: (no name) - {23D44BCF-AA7A-41D6-8905-E808F16322EF} - C:\WINDOWS\system32\awtqnol.dll (file missing)
                                O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                                O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\PROGRA~1\eoRezo\EoAdv\EOREZO~1.DLL (file missing)
                                O2 - BHO: (no name) - {6F1187C2-5AE3-4B19-BED6-7F75AE994463} - C:\WINDOWS\system32\ssqpn.dll (file missing)
                                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                                O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
                                O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
                                O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                                O2 - BHO: Starware - {F7C7AA47-BCA6-451D-8DBC-C10A8F75C8C7} - C:\Program Files\Starware\bin\Starware.dll (file missing)
                                O3 - Toolbar: Starware - {9839B3B7-3F99-4498-884D-6CFCCD251AB1} - C:\Program Files\Starware\bin\Starware.dll (file missing)
                                O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
                                O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                                O4 - HKLM\..\Run: [LaunchApp] Alaunch
                                O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
                                O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
                                O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                                O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
                                O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                                O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                                O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
                                O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                                O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
                                O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
                                O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
                                O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
                                O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                                O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC210NC Webcam
                                O4 - HKLM\..\Run: [BroadWaveRun] "C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe" -logon
                                O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                                O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                                O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
                                O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
                                O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                                O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                                O4 - HKCU\..\Run: [Registry Helper] "C:\Program Files\Registry Helper\RegistryHelper.Exe" /boot
                                O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                                O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                                O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
                                O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
                                O4 - Startup: PrevxCSI.lnk = ?
                                O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                                O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
                                O4 - Global Startup: Docteur Club Internet.lnk = C:\Program Files\Club-Internet\Dr Club Internet\bin\matcli.exe
                                O4 - Global Startup: TrayMin210.exe.lnk = ?
                                O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
                                O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                                O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?44205e924f8d47d5ae7d1c5f57050daf
                                O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?44205e924f8d47d5ae7d1c5f57050daf
                                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                                O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                                O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                                O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                                O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                                O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                                O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
                                O11 - Options group: [INTERNATIONAL] International*
                                O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
                                O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://keymithug21nada.spaces.live.com//PhotoUpload/MsnPUpld.cab
                                O16 - DPF: {7A96FF35-4937-11D1-8F2C-00609779BDA3} (ScolPlugin Class) - http://www.i-maginer.fr/NewATLScol062006.dll
                                O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_activex/fr/TSEasyInstallX.CAB
                                O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (Contrôleur de DownloadManager) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.6.cab
                                O17 - HKLM\System\CCS\Services\Tcpip\..\{F568B427-549F-4B70-AE76-2CA56F0E6C1D}: NameServer = 194.117.200.10,194.117.200.15
                                O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                                O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                                O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
                                O20 - Winlogon Notify: awtqnol - C:\WINDOWS\
                                O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                                O20 - Winlogon Notify: winhld32 - winhld32.dll (file missing)
                                O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
                                O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                                O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                                O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                                O23 - Service: BroadWave Service (BroadWaveService) - Unknown owner - C:\Program Files\NCH Swift Sound\BroadWave\broadwave.exe" -service (file missing)
                                O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
                                O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
                                O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
                                O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
                                O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                                O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
                                O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe

                                et pour le scan en ligne
                                BitDefender Online Scanner - Rapport virus en temps réel
                                Généré à: Thu, Feb 28, 2008 - 19:30:31
                                ________________________________________
                                Info d'analyse
                                Fichiers scannés 125420
                                Infectés Fichiers 0

                                Virus Détectés
                                Aucun virus trouvé.

                                ________________________________________
                                Ce sommaire du processus d'analyse sera utilisé par les laboratoires Antivirus BitDefender pour créer des statistiques agréguées sur l'activité des virus dans le monde.

                                Merci pour le lien, je tente d'autre scan, mais il est parfois tellement lent....
                                Bonne journée.
                                1. jfkpresident Contributeur sécurité
                                  salut keymi ,je pense qu'il y a encore du boulot !!

                                  reposte moi un rapport hijack et ensuite fais ceci :

                                  E - Scan online avec BitDefender

                                  Fais ce scan anti-virus en ligne avec Internet Explorer, accepte l'active X;

                                  la barre anti-popup du SP2 (en haut) va se mettre à clignoter,
                                  clic dessus et choisis "accepter l'active X" pour faire fonctionner le scan anti-virus.
                                  Une fois qu'il a terminé colle le rapport ici stp
                                  https://www.bitdefender.com/toolbox/
                                  Copie/Colle le rapport
                                  http://www.malekal.com/tutorial_BitDefender_AntiSpyware.php
                                  https://kerio.probb.fr/
                                  http://pageperso.aol.fr/rginformatique/mapage/defender.htm

                                  je veux etre sur de ce que spyware doctor a trouvé ??
                                  1. keymi_
                                    mission effectuée, je pense l'avoir anéanti...mais il y a toujours une lenteur du PC à noter.
                                    voici le dernier scan de AVG: qu'en pensez vous Jfk?

                                    ---------------------------------------------------------
                                    AVG Anti-Spyware - Rapport d'analyse
                                    ---------------------------------------------------------

                                    + Créé à: 11:35:29 28/02/2008

                                    + Résultat de l'analyse:

                                    C:\Documents and Settings\céline\Cookies\céline@aolfr.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
                                    C:\Documents and Settings\céline\Cookies\céline@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
                                    C:\Documents and Settings\céline\Cookies\céline@msnportal.112.2o7[2].txt -> TrackingCookie.2o7 : Nettoyé.
                                    C:\Documents and Settings\céline\Cookies\céline@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
                                    C:\Documents and Settings\céline\Cookies\céline@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
                                    C:\Documents and Settings\céline\Cookies\céline@doubleclick[2].txt -> TrackingCookie.Doubleclick : Nettoyé.
                                    C:\Documents and Settings\céline\Cookies\céline@estat[1].txt -> TrackingCookie.Estat : Nettoyé.
                                    C:\Documents and Settings\céline\Cookies\céline@ehg-telecomitalia.hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
                                    C:\Documents and Settings\céline\Cookies\céline@hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
                                    C:\Documents and Settings\céline\Cookies\céline@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
                                    C:\Documents and Settings\céline\Cookies\céline@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé.
                                    C:\Documents and Settings\céline\Cookies\céline@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
                                    C:\Documents and Settings\céline\Cookies\céline@serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé.
                                    C:\Documents and Settings\céline\Cookies\céline@serving-sys[3].txt -> TrackingCookie.Serving-sys : Nettoyé.
                                    C:\Documents and Settings\céline\Cookies\céline@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.

                                    Fin du rapport
                                    • 1
                                    • 2
                                    • 3

                                    Discussions similaires

                                    intrusion
                                    monte-christo

                                    3 réponses
                                    intrusion
                                    rogeroge

                                    55 réponses
                                    détection d'intrusion
                                    ariel755

                                    2 réponses
                                    s'agit-il d'une intrusion?
                                    lila17

                                    2 réponses
                                    Message alerte "chassis intrusion" de la part du bios svp ?
                                    AntoineFrigel

                                    16 réponses