Pc infecté

jeremy -  
Bonjour,voila avast ma detecté un virus un cheval de troie etc
Est ce que vous pouvez m'aidez ?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:28:14, on 25/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\All Users\Application Data\rizcfgxo\langvkdy.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OLITEC\Moniteur WiFi OLITEC\Moniteur WiFi OLITEC.exe
C:\WINDOWS\system32\fqryzcjo.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66006
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66006
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: GNX Bingo - {72C7F75B-B10B-4477-A687-EF10300DE5DD} - C:\WINDOWS\kdftlboerfg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [dxljxgby] C:\WINDOWS\system32\fqryzcjo.exe
O4 - HKLM\..\Policies\Explorer\Run: [UE8lLxJxFX] C:\Documents and Settings\All Users\Application Data\rizcfgxo\langvkdy.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Global Startup: Moniteur WiFi OLITEC.exe.lnk = ?
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{24C06904-FE20-418A-AD9A-A62E0B0416C8}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O21 - SSODL: vbgtorfd - {64B2ACBD-F327-45BF-A21C-B43D66922933} - C:\WINDOWS\vbgtorfd.dll
O21 - SSODL: dwnrpofk - {F048C09F-C66A-4914-8D76-12636A70EA24} - C:\WINDOWS\dwnrpofk.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 6692 bytes
Configuration: Windows XP
Firefox 2.0.0.12

31 réponses

Résumé de la discussion

La problématique centrale est la détection par Avast d'un cheval de Troie sur Windows XP et l'examen des solutions de nettoyage proposées par les outils spécialisés et les conseils partagés. Parmi les réponses proposées figurent l'utilisation d'outils et traitements comme HijackThis, Navilog, ComboFix et CFScript, ainsi que des conseils de désactivation temporaire des protections et d'exécution hors ligne. Des procédures complémentaires ont été évoquées, notamment la désactivation de la restauration système, l'importante collecte des rapports et la nécessité de lancer les outils dans un ordre précis pour éviter les blocages. En pratique, les échanges insistent sur la prudence et l'autorisation compétente avant toute manipulation, afin d'éviter les faux positifs et les dommages potentiels au système.

Bobot (l’IA à votre service)
  1. Utilisateur anonyme
    Poste le rapport Toolscleaner quand même =)
    0
    1. jeremy
      je n'est plus de souci merci beaucoup
      0
      1. Utilisateur anonyme
        Re ,

        > Supprime cleanup.

        ***********************

        Ta version d'Adobe n'est pas à jour , désinstalle ta version actuelle en passant par ' ajout et supréssion de programmes '

        Puis télécharge la dernière , via ce site --> https://get2.adobe.com/reader/otherversions/

        Bulletin de sécurité sur les versions Adobe 7.0.8 et antérieures :

        https://www.adobe.com/support/security/bulletins/apsb07-01.html

        https://get2.adobe.com/reader/otherversions/

        ******************

        → Ferme toutes les applications en cours, puis télécharge ToolsCleaner2 sur ton Bureau.

        → Double clique sur ToolsCleaner2.exe >
        → Clique sur .Recherche
        → puis sur Suppression quand la liste est trouvée.
        → Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

        (CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

        Note : ton bureau RISQUE de disparaître, c'est normal. S'il n'apparaît pas à la fin du scan, fais la manip suivante :

        CTRL+ALT+SUPP pour ouvrir le Gestionnaire des tâches.
        Puis rends toi à l'onglet "Processus". Clique en haut à gauche sur Fichiers et choisis "Exécuter"

        Tape explorer.exe et valide. Cela fera re-apparaître le Bureau

        Tuto : http://www.commentcamarche.net/faq/sujet 8341 toolscleaner suppression des fix de force brute ( merci espion3004 )

        ********************

        Maintenant que ton PC n'est plus infecté, désactive ta "Restauration du système" puis réactive la, ce qui créer un point de restauration sain...

        Désactivation :
        Clique droit sur le "Poste de travail" > Propriétés > onglet "Restauration du système" > coche la case "Désactiver la Restauration du système sur tous les lecteurs"
        > Applique patiente jusqu’à ce que cela soit marqué "désactivé" puis Ok.

        Activation :
        Suivre le même chemin ; décoche la case "Désactiver la Restauration du système sur tous les lecteurs"
        > Applique attends que cela soit à nouveau sur "surveillance" puis Ok. Redémarre l'ordinateur.

        *************

        Rapport Toolcleaner.

        Plus de soucis ?

        A+

        0
        1. jeremy
          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 17:17:11, on 28/03/2008
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v7.00 (7.00.6000.16608)
          Boot mode: Normal

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\ZoneLabs\vsmon.exe
          C:\WINDOWS\Explorer.EXE
          C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
          C:\Program Files\a-squared Free\a2service.exe
          C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
          C:\WINDOWS\System32\snmp.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
          C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\OLITEC\Moniteur WiFi OLITEC\Moniteur WiFi OLITEC.exe
          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66006
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66006
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
          O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
          O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
          O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
          O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
          O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
          O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
          O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
          O4 - Global Startup: Moniteur WiFi OLITEC.exe.lnk = ?
          O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
          O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
          O15 - Trusted Zone: http://www.secuser.com
          O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
          O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
          O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
          O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
          O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
          O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
          O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
          O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
          O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
          O17 - HKLM\System\CCS\Services\Tcpip\..\{24C06904-FE20-418A-AD9A-A62E0B0416C8}: NameServer = 208.67.220.220,208.67.222.222
          O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
          O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
          O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
          O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
          O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
          O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
          O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
          O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
          0
          2. Utilisateur anonyme
            Re , rapport Hijackthis stp =)

            ++
            0
            1. jeremy
              Script execute en mode sans echec
              Rapport clean par Malekal_morte - http://www.malekal.com
              Script execute en mode sans echec 28/03/2008 a 17:02:26,37

              Microsoft Windows XP [version 5.1.2600]

              *** Suppression des fichiers dans C:

              *** Suppression des fichiers dans C:\WINDOWS\
              tentative de suppression de C:\WINDOWS\ALCXMNTR.EXE
              tentative de suppression de C:\WINDOWS\iTunesMusic.exe

              *** Suppression des fichiers dans C:\WINDOWS\system32
              tentative de suppression de "C:\WINDOWS\Downloaded Program Files\CONFLICT.1"

              *** Suppression des fichiers dans C:\Program Files
              tentative de suppression de "C:\Program Files\Viewpoint\"

              *** Suppression des clefs du registre effectuee..
              *** Fin du rapport !
              0
              2. jeremy
                28/03/2008 a 16:27:01,90

                *** Recherche des fichiers dans C:

                *** Recherche des fichiers dans C:\WINDOWS\
                C:\WINDOWS\ALCXMNTR.EXE FOUND
                C:\WINDOWS\iTunesMusic.exe FOUND

                *** Recherche des fichiers dans C:\WINDOWS\system32
                "C:\WINDOWS\Downloaded Program Files\CONFLICT.1" FOUND

                *** Recherche des fichiers dans C:\Program Files
                "C:\Program Files\Viewpoint\" FOUND
                *** Fin du rapport !
                0
                1. Utilisateur anonyme
                  Re je l'ai déja dit , il faut lire un peu.

                  Fait le si tu peux.

                  Le rapport stp.

                  a+
                  0
                  1. jeremy
                    salut pour clean il demande d'envoyer à un site il faut l'envoyer?
                    0
                    1. Utilisateur anonyme
                      Pas faute d'expliquer !
                      0
                      1. jeremy
                        CleanUp! started on 03/28/08 07:45:16.
                        ...
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\GHIJ8HMN\inline[1].js - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\GHIJ8HMN\kennedy10.skyrock[1].htm - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\GHIJ8HMN\MSN_Green-bleu[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\GHIJ8HMN\ovr9[2].css - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\GHIJ8HMN\parke[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\GHIJ8HMN\pa_module[1].php - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\GHIJ8HMN\photo_27112318_small[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\GHIJ8HMN\proxy_bb_cm[1].htm - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\GHIJ8HMN\RL-728x90[1].swf - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\GHIJ8HMN\sarko65[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\GHIJ8HMN\sbox-bg[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\GHIJ8HMN\search[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\GHIJ8HMN\search[1].xml - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\GHIJ8HMN\search[2].xml - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\GHIJ8HMN\signalize[1].png - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\GHIJ8HMN\SkyblogRG-728x90[1].js - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\GHIJ8HMN\yfr[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\GHIJ8HMN\yui_1.0.1[2].js - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\1025591834_comment_1[1].htm - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\13[1].htm - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\14[1].htm - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\1552464670@Top,Bottom,Bottom2[1] - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\1647_bandeau_1[1].swf - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\1647_embed[1].js - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\1751628227@Top,Bottom,Bottom2[1] - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\1DB40C2DB6576754B7CE157FE5F[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\1x1[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\282007190882[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\2[1].htm - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\6D32427AE5E6B34DDCD2E720BBE0BA[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\73EA3A497EB807310219A1C4D1E9E[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\7CE57843948D6DF13E79A2DE4E15C[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\817067835_small[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\818733957_small[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\8E763C825DC0E388929AE1B375CE18[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\8x6_all_services[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\92x68editorial[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\AEC64F712423A523F7A5396EC025[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\B2FCCF26AFD28F9543EB6BC5AF11A[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\bb2a1[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\bb2c1[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\beta[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\bg_b[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\blog[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\CAH7Z3DX.HTM - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\chaus3[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\crossdomain[1].xml - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\FDCAAC85D66BE7CB4D71155977E9CC[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\gifstats[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\global[2].js - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\gradient02[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\grd-4px[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\headerbar[1].png - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\hptg[2].js - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\icons[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\ieminwidth[2].js - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\jt15[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\juppe[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\lastminutegordonyahoo430x80wednesday1[1].swf - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\message_envoye[1].png - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\mini[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\nopho[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\opart1[1].js - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\paris9[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\radar3[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\screeningroom1[1].js - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\search[1].htm - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\search[1].xml - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\search_1.1[1].png - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\stats_blog[1].js - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\s[1].htm - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\s[2].htm - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\s[3].htm - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\ThumbnailServer2[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\triplet-v1-blanc-728x90[1].swf - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\u600[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\ushp[1].css - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\videofeed[1].xml - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\KLIJGPUV\video[2].js - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\0000005552_000000000000000446496[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\104x15[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\1104551836@Top,Bottom,Bottom2[1] - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\1159351567@Top,Bottom,Bottom2[1] - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\11[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\1[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\26[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\282007190882[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\282007190882[2].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\3F3AAD38FABF635618817CD16B6BA[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\4E381C752EC4BDE97298CD86591073[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\6D5CC853B3707258D960A1079FA6C[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\70x5040[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\728x90-bonsplans[1].swf - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\728x90-iin[1].swf - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\7DA8B0F0D3D12E32E266EC654214C3[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\818770295_small[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\821305327[1] - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\821404955_small[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\910884868[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\920525028_small[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\A1142944DEE3D9DAAC9DC3B1B0F1B8[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\aa024[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\blog[2].js - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\bullet[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\buttons2[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\CAHSSJ1D.swf - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\CAOX8POV.gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\CheckCnx[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\comment-add[1].png - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\commentaires[1].png - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\dap[2].js - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\eurov1[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\googleplayer[1].swf - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\header_bg_ie[1].png - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\icons_1.1[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\jsbase_1.1.14[2].js - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\lastminutegordonyahoo430x80wednesday1[1].swf - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\lastminutegordonyahoo950x350wednesday[1].swf - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\logo_bandeau-skyblog[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\maill7[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\mail[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\menes[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\nav_logo[1].png - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\opart2[2].js - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\override[1].css - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\pa-preview-shadow[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\pacg2[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\paic2[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\solde5[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\stats[2].js - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\styles[2].css - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\s_code[2].js - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\ThumbnailServer2[1].jpg - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\tpl[2].css - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\troug7[1].gif - deleted
                        C:\Documents and Settings\CATHY\Local Settings\Temporary Internet Files\Content.IE5\S1U30T63\video[1].gif - deleted
                        C:\Documents and Settings\cassandra.NOM-47D5A5B94AD\locals~1\tempor~1\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat - deleted
                        C:\Documents and Settings\cassandra.NOM-47D5A5B94AD\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat - deleted
                        C:\Documents and Settings\Administrateur\Cookies\index.dat - deleted
                        C:\Documents and Settings\Administrateur\Cookies\index.dat - deleted
                        C:\WINDOWS\Prefetch\A2FREE.EXE-34CE1BFD.pf - deleted
                        C:\WINDOWS\Prefetch\ACRORD32.EXE-13285B88.pf - deleted
                        C:\WINDOWS\Prefetch\AD-AWARE2007.EXE-0CF9A7E5.pf - deleted
                        C:\WINDOWS\Prefetch\ALG.EXE-0F138680.pf - deleted
                        C:\WINDOWS\Prefetch\ANTIVIR_WORKSTATION_WIN7U_EN_-0AAD7F4A.pf - deleted
                        C:\WINDOWS\Prefetch\ASHDISP.EXE-0B874892.pf - deleted
                        C:\WINDOWS\Prefetch\ASHMAISV.EXE-12E27032.pf - deleted
                        C:\WINDOWS\Prefetch\ASHPOPWZ.EXE-11BDDCD9.pf - deleted
                        C:\WINDOWS\Prefetch\ASHWEBSV.EXE-0548EF0A.pf - deleted
                        C:\WINDOWS\Prefetch\ASWCLEAR.EXE-349F855C.pf - deleted
                        C:\WINDOWS\Prefetch\ATTRIB.EXE-39EAFB02.pf - deleted
                        C:\WINDOWS\Prefetch\AVAST.SETUP-032170A8.pf - deleted
                        C:\WINDOWS\Prefetch\AVCENTER.EXE-058B10AA.pf - deleted
                        C:\WINDOWS\Prefetch\AVGNT.EXE-11EBE658.pf - deleted
                        C:\WINDOWS\Prefetch\AVGUARD.EXE-188FB0FF.pf - deleted
                        C:\WINDOWS\Prefetch\AVNOTIFY.EXE-32FAE179.pf - deleted
                        C:\WINDOWS\Prefetch\CATCHME.CFEXE-0F2A0789.pf - deleted
                        C:\WINDOWS\Prefetch\CCLEANER.EXE-0BCE437C.pf - deleted
                        C:\WINDOWS\Prefetch\CF3754.EXE-009F20D2.pf - deleted
                        C:\WINDOWS\Prefetch\CF64.EXE-2E579241.pf - deleted
                        C:\WINDOWS\Prefetch\CHCP.COM-18156052.pf - deleted
                        C:\WINDOWS\Prefetch\CLEANUP.EXE-3438663A.pf - deleted
                        C:\WINDOWS\Prefetch\CLEANUP452.EXE-06CC3C16.pf - deleted
                        C:\WINDOWS\Prefetch\CMD.EXE-087B4001.pf - deleted
                        C:\WINDOWS\Prefetch\COMBOFIX.EXE-2C04FBF7.pf - deleted
                        C:\WINDOWS\Prefetch\CSCRIPT.EXE-1C26180C.pf - deleted
                        C:\WINDOWS\Prefetch\CTFMON.EXE-0E17969B.pf - deleted
                        C:\WINDOWS\Prefetch\DUMPHIVE.CFEXE-2ED3B134.pf - deleted
                        C:\WINDOWS\Prefetch\ERUNT.CFEXE-039977DB.pf - deleted
                        C:\WINDOWS\Prefetch\EXPLORER.EXE-082F38A9.pf - deleted
                        C:\WINDOWS\Prefetch\FDSV.CFEXE-2F207127.pf - deleted
                        C:\WINDOWS\Prefetch\FIND.EXE-0EC32F1E.pf - deleted
                        C:\WINDOWS\Prefetch\FINDSTR.CFEXE-38519B93.pf - deleted
                        C:\WINDOWS\Prefetch\FINDSTR.EXE-0CA6274B.pf - deleted
                        C:\WINDOWS\Prefetch\FIREFOX.EXE-28641590.pf - deleted
                        C:\WINDOWS\Prefetch\FXSSVC.EXE-3B8F7819.pf - deleted
                        C:\WINDOWS\Prefetch\GLB1D.TMP-01350C0B.pf - deleted
                        C:\WINDOWS\Prefetch\GLB2F.TMP-081565B1.pf - deleted
                        C:\WINDOWS\Prefetch\GREP.CFEXE-20443039.pf - deleted
                        C:\WINDOWS\Prefetch\GRPCONV.EXE-111CD845.pf - deleted
                        C:\WINDOWS\Prefetch\GSAR.CFEXE-156760D9.pf - deleted
                        C:\WINDOWS\Prefetch\GUARDGUI.EXE-2C20A958.pf - deleted
                        C:\WINDOWS\Prefetch\GZIP.EXE-2153CFC0.pf - deleted
                        C:\WINDOWS\Prefetch\HANDLE.CFEXE-13427ED2.pf - deleted
                        C:\WINDOWS\Prefetch\HELPCTR.EXE-3862B6F5.pf - deleted
                        C:\WINDOWS\Prefetch\HELPER.EXE-0415776D.pf - deleted
                        C:\WINDOWS\Prefetch\HELPSVC.EXE-2878DDA2.pf - deleted
                        C:\WINDOWS\Prefetch\HIJACKTHIS.EXE-34A0FC79.pf - deleted
                        C:\WINDOWS\Prefetch\IEXPLORE.EXE-27122324.pf - deleted
                        C:\WINDOWS\Prefetch\IMAPI.EXE-0BF740A4.pf - deleted
                        C:\WINDOWS\Prefetch\INSTMTDR.EXE-1815F396.pf - deleted
                        C:\WINDOWS\Prefetch\Layout.ini - deleted
                        C:\WINDOWS\Prefetch\LFILES.EXE-03101E1A.pf - deleted
                        C:\WINDOWS\Prefetch\LOGONUI.EXE-0AF22957.pf - deleted
                        C:\WINDOWS\Prefetch\MONITEUR WIFI OLITEC.EXE-05589276.pf - deleted
                        C:\WINDOWS\Prefetch\MOVEEX.CFEXE-01B74CA8.pf - deleted
                        C:\WINDOWS\Prefetch\MSCONFIG.EXE-35E4DAE9.pf - deleted
                        C:\WINDOWS\Prefetch\MSNMSGR.EXE-030AB647.pf - deleted
                        C:\WINDOWS\Prefetch\MTEE.CFEXE-1E067BC7.pf - deleted
                        C:\WINDOWS\Prefetch\NIRCMD.CFEXE-19FF4781.pf - deleted
                        C:\WINDOWS\Prefetch\NIRCMD.COM-223F42C3.pf - deleted
                        C:\WINDOWS\Prefetch\NIRCMD.COM-323C21EC.pf - deleted
                        C:\WINDOWS\Prefetch\NIRCMD.EXE-2C39EF53.pf - deleted
                        C:\WINDOWS\Prefetch\NOTEPAD.EXE-336351A9.pf - deleted
                        C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf - deleted
                        C:\WINDOWS\Prefetch\NTVDM.EXE-1A10A423.pf - deleted
                        C:\WINDOWS\Prefetch\PREUPD.EXE-0C5BC219.pf - deleted
                        C:\WINDOWS\Prefetch\PSEXEC.CFEXE-2CB6A9EC.pf - deleted
                        C:\WINDOWS\Prefetch\PSEXESVC.EXE-35EFACCF.pf - deleted
                        C:\WINDOWS\Prefetch\PV.CFEXE-057B3499.pf - deleted
                        C:\WINDOWS\Prefetch\PV.CFEXE-0E6F2701.pf - deleted
                        C:\WINDOWS\Prefetch\QTTASK.EXE-342507FB.pf - deleted
                        C:\WINDOWS\Prefetch\REGCAT.EXE-0981E33F.pf - deleted
                        C:\WINDOWS\Prefetch\REGEDIT.EXE-1B606482.pf - deleted
                        C:\WINDOWS\Prefetch\REGSVR32.EXE-25EEFE2F.pf - deleted
                        C:\WINDOWS\Prefetch\REGT.CFEXE-15DB5DAE.pf - deleted
                        C:\WINDOWS\Prefetch\ROUTE.EXE-371D32DE.pf - deleted
                        C:\WINDOWS\Prefetch\RUNDLL32.EXE-12E27DD0.pf - deleted
                        C:\WINDOWS\Prefetch\RUNDLL32.EXE-13DA0E71.pf - deleted
                        C:\WINDOWS\Prefetch\RUNDLL32.EXE-14711FAA.pf - deleted
                        C:\WINDOWS\Prefetch\RUNDLL32.EXE-15646B1C.pf - deleted
                        C:\WINDOWS\Prefetch\RUNDLL32.EXE-19DF0612.pf - deleted
                        C:\WINDOWS\Prefetch\RUNDLL32.EXE-21E72088.pf - deleted
                        C:\WINDOWS\Prefetch\RUNDLL32.EXE-229606BF.pf - deleted
                        C:\WINDOWS\Prefetch\RUNDLL32.EXE-2576181F.pf - deleted
                        C:\WINDOWS\Prefetch\RUNDLL32.EXE-25E054DB.pf - deleted
                        C:\WINDOWS\Prefetch\RUNDLL32.EXE-26C2C861.pf - deleted
                        C:\WINDOWS\Prefetch\RUNDLL32.EXE-27E5DCE3.pf - deleted
                        C:\WINDOWS\Prefetch\RUNDLL32.EXE-2905E326.pf - deleted
                        C:\WINDOWS\Prefetch\RUNDLL32.EXE-2CBA7525.pf - deleted
                        C:\WINDOWS\Prefetch\RUNDLL32.EXE-309DAE7A.pf - deleted
                        C:\WINDOWS\Prefetch\RUNDLL32.EXE-311943EE.pf - deleted
                        C:\WINDOWS\Prefetch\RUNDLL32.EXE-4686276A.pf - deleted
                        C:\WINDOWS\Prefetch\RUNDLL32.EXE-4C45840F.pf - deleted
                        C:\WINDOWS\Prefetch\RUNONCE.EXE-2803F297.pf - deleted
                        C:\WINDOWS\Prefetch\SCHED.EXE-0CAE1E50.pf - deleted
                        C:\WINDOWS\Prefetch\SED.CFEXE-268D7E58.pf - deleted
                        C:\WINDOWS\Prefetch\SETUP.EXE-256F0E0D.pf - deleted
                        C:\WINDOWS\Prefetch\SF.CFEXE-164B3B2D.pf - deleted
                        C:\WINDOWS\Prefetch\SORT.EXE-194AE83C.pf - deleted
                        C:\WINDOWS\Prefetch\SVCHOST.EXE-3530F672.pf - deleted
                        C:\WINDOWS\Prefetch\SWREG.CFEXE-287CC9EF.pf - deleted
                        C:\WINDOWS\Prefetch\SWREG.CFEXE-2BF4FFCD.pf - deleted
                        C:\WINDOWS\Prefetch\SWSC.CFEXE-3B4FE4FE.pf - deleted
                        C:\WINDOWS\Prefetch\SWXCACLS.CFEXE-24057B3B.pf - deleted
                        C:\WINDOWS\Prefetch\TASKMGR.EXE-20256C55.pf - deleted
                        C:\WINDOWS\Prefetch\UNINSTALL.EXE-072EB032.pf - deleted
                        C:\WINDOWS\Prefetch\UNINSTALL.EXE-33692F6D.pf - deleted
                        C:\WINDOWS\Prefetch\UPDATE.EXE-264167D5.pf - deleted
                        C:\WINDOWS\Prefetch\UPDATE.EXE-2C2467F8.pf - deleted
                        C:\WINDOWS\Prefetch\UPDATER.EXE-1D14111E.pf - deleted
                        C:\WINDOWS\Prefetch\UPDCLIENT.EXE-215FC96B.pf - deleted
                        C:\WINDOWS\Prefetch\USERINIT.EXE-30B18140.pf - deleted
                        C:\WINDOWS\Prefetch\USNSVC.EXE-2DF2835C.pf - deleted
                        C:\WINDOWS\Prefetch\VERCLSID.EXE-3667BD89.pf - deleted
                        C:\WINDOWS\Prefetch\VFIND.CFEXE-2033727F.pf - deleted
                        C:\WINDOWS\Prefetch\VFIND.EXE-0CB9A64E.pf - deleted
                        C:\WINDOWS\Prefetch\VSMON.EXE-1609C098.pf - deleted
                        C:\WINDOWS\Prefetch\WDFMGR.EXE-2CF4013B.pf - deleted
                        C:\WINDOWS\Prefetch\WGATRAY.EXE-0ED38BED.pf - deleted
                        C:\WINDOWS\Prefetch\WLLOGINPROXY.EXE-2D4B6027.pf - deleted
                        C:\WINDOWS\Prefetch\WMIADAP.EXE-2DF425B2.pf - deleted
                        C:\WINDOWS\Prefetch\WMIPRVSE.EXE-28F301A9.pf - deleted
                        C:\WINDOWS\Prefetch\WSCNTFY.EXE-1B24F5EB.pf - deleted
                        C:\WINDOWS\Prefetch\WUAUCLT.EXE-399A8E72.pf - deleted
                        C:\WINDOWS\Prefetch\ZASETUP_FR.EXE-25106B13.pf - deleted
                        C:\WINDOWS\Prefetch\ZLCLIENT.EXE-02918DDB.pf - deleted
                        C:\WINDOWS\Prefetch\ZLCLIENT.EXE-1C550EB2.pf - deleted
                        C:\WINDOWS\Prefetch\ZLSSETUP_70_462_000_FR[1].EXE-38AF6499.pf - deleted
                        'Run MRU' list - removed from the registry.
                        'Doc Find Spec MRU' list - removed from the registry.
                        'FindComputerMRU' list - removed from the registry.
                        'ComputerNameMRU' list - removed from the registry.
                        'ContainingTextMRU' list - removed from the registry.
                        'FilesNamedMRU' list - removed from the registry.
                        Search Assistant MRU list - removed from the registry.
                        Explorer Open/Save MRU list - removed from the registry.
                        Explorer Last Visited MRU list - removed from the registry.
                        Paint Recent File List - removed from the registry.
                        WordPad Recent File List - removed from the registry.
                        Telnet's MRU list - removed from the registry.
                        Windows Media Player Recent File List - removed from the registry.
                        WinZip Extract MRU list - removed from the registry.
                        WinZip File MRU list - removed from the registry.
                        CleanUp! 4.5.2 recovered 561.9 MB of disk space from 17877 files.
                        CleanUp! finished on 03/28/08 07:46:18.
                        0
                    2. Utilisateur anonyme
                      ...

                      Rapport Cleanup ?

                      Rapport clean ?
                      0
                      1. jeremy
                        je sais pas comment ca marche!!!!
                        0
                    3. jeremy
                      Logfile of Trend Micro HijackThis v2.0.2
                      Scan saved at 12:40:50, on 27/03/2008
                      Platform: Windows XP SP2 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v7.00 (7.00.6000.16608)
                      Boot mode: Normal

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                      C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\Program Files\a-squared Free\a2service.exe
                      C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                      C:\WINDOWS\System32\snmp.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
                      C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
                      C:\WINDOWS\system32\ctfmon.exe
                      C:\Program Files\OLITEC\Moniteur WiFi OLITEC\Moniteur WiFi OLITEC.exe
                      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66006
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66006
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                      O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                      O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
                      O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
                      O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                      O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
                      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                      O4 - Global Startup: Moniteur WiFi OLITEC.exe.lnk = ?
                      O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                      O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                      O15 - Trusted Zone: http://www.secuser.com
                      O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
                      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
                      O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
                      O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
                      O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
                      O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                      O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
                      O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
                      O17 - HKLM\System\CCS\Services\Tcpip\..\{24C06904-FE20-418A-AD9A-A62E0B0416C8}: NameServer = 208.67.220.220,208.67.222.222
                      O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
                      O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
                      O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
                      O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                      O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                      O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                      O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                      0
                      1. Utilisateur anonyme
                        Re , oki comme tu veux ;)

                        ( ça n'est pas si long qu'il n'y parait ^^ )

                        A+
                        0
                        1. Utilisateur anonyme
                          Re , !

                          → Relance hijackthis , Choisis ' Do a system scan ' Et fixe ces lignes : ( coche la case à leurs gauches > ' fixchecked ')

                          O21 - SSODL: dwnrpofk - {F048C09F-C66A-4914-8D76-12636A70EA24} - C:\WINDOWS\dwnrpofk.dll (file missing)

                          ********************

                          Délaisse Avast au profit d'Antivir , contrairement à ce que tout le monde pense , Avast n'est pas aussi bien que l'on pourrais le croire regarde le classement des AV
                          et constate par toi même → Avast vs Antivir

                          Vire Avast → Désinstalle Avast 'proprement' ( merci espion3004)

                          Et télécharge Antivir ( PersonnalEdition Classic) → ici

                          Tuto Installation + configuration Antivir → https://www.malekal.com/avira-free-security-antivirus-gratuit/

                          Tuto Installation : → https://www.astucesinternet.com/modules/news/article.php?storyid=253

                          Pour le rendre encore plus discret....

                          ****************

                          Télécharge le pare-feu ZoneAlarm Lit bien tout l'article pour éviter les surprises.

                          Des soucis avec ?

                          *************

                          Ta version d'Adobe n'est pas à jour , désinstalle ta version actuelle en passant par ' ajout et supréssion de programmes '

                          Puis télécharge la dernière , via ce site --> https://get2.adobe.com/reader/otherversions/

                          Bulletin de sécurité sur les versions Adobe 7.0.8 et antérieures :

                          https://www.adobe.com/support/security/bulletins/apsb07-01.html

                          https://get2.adobe.com/reader/otherversions/

                          ***********

                          → Télécharge CleanUp452 ( Primary download site ... )

                          → Lance-le et choisi l'option ' cleanup! '

                          → Poste le rapport.

                          Tutorial: http://pageperso.aol.fr/balltrap34/democleanup.htm ( merci à balltrap34 )

                          ********

                          → Télécharge clean : http://www.malekal.com/download/clean.zip

                          → Dézippe-le ( clique droit , extraire tout)

                          → Lance clean.cmd ( ou clean ), Choisi l'option 1 et poste moi le rapport.

                          (- Où est le rapport clean ? : « Poste de travail » / double clic sur disque « C / » double-clic sur « rapport_clean.txt » et « copier/coller le contenu » sur le forum. )

                          Note : Tu auras peut-être un message qui t'invitera a uploader un fichier , fait-le dès que tu pourras.

                          ******

                          Rapport cleanup + clean + hijackthis.

                          A+
                          0
                          1. jeremy
                            ok sa risque de prendre du temps je te passerai tous demain
                            0
                        2. jeremy
                          Logfile of Trend Micro HijackThis v2.0.2
                          Scan saved at 13:45:00, on 26/03/2008
                          Platform: Windows XP SP2 (WinNT 5.01.2600)
                          MSIE: Internet Explorer v7.00 (7.00.6000.16608)
                          Boot mode: Normal

                          Running processes:
                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                          C:\Program Files\Alwil Software\Avast4\ashServ.exe
                          C:\WINDOWS\Explorer.EXE
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\Program Files\a-squared Free\a2service.exe
                          C:\WINDOWS\System32\snmp.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                          C:\Program Files\QuickTime\qttask.exe
                          C:\WINDOWS\system32\ctfmon.exe
                          C:\Program Files\OLITEC\Moniteur WiFi OLITEC\Moniteur WiFi OLITEC.exe
                          C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                          C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66006
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66006
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                          R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                          O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                          O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                          O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
                          O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
                          O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                          O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                          O4 - Global Startup: Moniteur WiFi OLITEC.exe.lnk = ?
                          O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                          O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                          O15 - Trusted Zone: http://www.secuser.com
                          O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
                          O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
                          O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
                          O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
                          O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                          O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
                          O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                          O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
                          O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
                          O17 - HKLM\System\CCS\Services\Tcpip\..\{24C06904-FE20-418A-AD9A-A62E0B0416C8}: NameServer = 208.67.220.220,208.67.222.222
                          O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
                          O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
                          O21 - SSODL: dwnrpofk - {F048C09F-C66A-4914-8D76-12636A70EA24} - C:\WINDOWS\dwnrpofk.dll (file missing)
                          O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
                          O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                          O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                          O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                          O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                          O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                          O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                          0
                          1. Utilisateur anonyme
                            Re

                            reposte un rapport Hijackthis.
                            a+
                            0
                            1. jeremy
                              ComboFix 08-03-25.1 - jérémy 2008-03-26 13:00:04.5 - NTFSx86
                              Endroit: C:\Documents and Settings\TEMP\Bureau\ComboFix.exe
                              Command switches used :: C:\Documents and Settings\TEMP\Bureau\CFScript.txt

                              [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

                              FILE ::
                              C:\Documents and Settings\TEMP\BureauEditorFKWP1.5.exe
                              C:\Documents and Settings\TEMP\BureauEditorFKWP2.0.exe
                              C:\Documents and Settings\TEMP\Bureaufilemanagerclient.exe
                              C:\Documents and Settings\TEMP\Bureaufkwp1.5.exe
                              C:\Documents and Settings\TEMP\Bureaufkwp2.0.exe
                              C:\Documents and Settings\TEMP\Bureaufwebd.exe
                              C:\Documents and Settings\TEMP\BureauFWebdEditor.exe
                              .

                              (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                              .

                              C:\Documents and Settings\TEMP\BureauEditorFKWP1.5.exe
                              C:\Documents and Settings\TEMP\BureauEditorFKWP2.0.exe
                              C:\Documents and Settings\TEMP\Bureaufilemanagerclient.exe
                              C:\Documents and Settings\TEMP\Bureaufkwp1.5.exe
                              C:\Documents and Settings\TEMP\Bureaufkwp2.0.exe
                              C:\Documents and Settings\TEMP\Bureaufwebd.exe
                              C:\Documents and Settings\TEMP\BureauFWebdEditor.exe
                              C:\Documents and Settings\TEMP\Bureauvirii
                              C:\Documents and Settings\TEMP\Bureauvirii\Trojan-Downloader.Win32.Agent.bl.exe
                              C:\Documents and Settings\TEMP\Bureauvirii\Trojan-Downloader.Win32.Agent.p.exe
                              C:\Documents and Settings\TEMP\Bureauvirii\Trojan-Downloader.Win32.Agent.r.exe
                              C:\Documents and Settings\TEMP\Bureauvirii\Trojan-Downloader.Win32.Agent.t.exe
                              C:\Documents and Settings\TEMP\Bureauvirii\Trojan-Downloader.Win32.Agent.v.exe

                              .
                              ((((((((((((((((((((((((((((( Fichiers créés 2008-02-26 to 2008-03-26 ))))))))))))))))))))))))))))))))))))
                              .

                              2008-03-25 18:42 . 2008-03-25 18:42 <REP> d-------- C:\Program Files\PC-Cleaner
                              2008-03-25 13:24 . 2008-03-25 13:24 <REP> d-------- C:\Program Files\Inet Delivery
                              2008-03-01 13:52 . 2008-03-01 13:52 <REP> d-------- C:\Program Files\Lavasoft
                              2008-03-01 13:52 . 2008-03-01 13:54 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
                              2008-03-01 13:47 . 2008-03-01 13:48 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard

                              .
                              (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                              .
                              2008-03-25 16:28 4,096 ----a-w C:\WINDOWS\zipped.tmp
                              2008-03-25 16:28 4,096 ----a-w C:\WINDOWS\zip3.tmp
                              2008-03-25 16:28 4,096 ----a-w C:\WINDOWS\zip2.tmp
                              2008-03-25 16:28 4,096 ----a-w C:\WINDOWS\zip1.tmp
                              2008-03-25 16:28 4,096 ----a-w C:\WINDOWS\userconfig9x.dll
                              2008-03-25 16:28 4,096 ----a-w C:\WINDOWS\mssecu.exe
                              2008-03-25 16:28 4,096 ----a-w C:\WINDOWS\iTunesMusic.exe
                              2008-03-25 16:28 4,096 ----a-w C:\WINDOWS\FVProtect.exe
                              2008-03-25 16:28 4,096 ----a-w C:\WINDOWS\bdn.com
                              2008-03-25 16:28 4,096 ----a-w C:\WINDOWS\base64.tmp
                              2008-02-27 18:05 --------- d-----w C:\Program Files\Windows Live
                              2008-02-22 12:40 --------- d-----w C:\Program Files\a-squared Free
                              2008-02-16 17:18 --------- d-----w C:\Program Files\Zone Labs
                              2008-02-16 08:21 --------- d-----w C:\Program Files\Apple Software Update
                              2008-02-16 08:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
                              2008-02-15 10:16 --------- d-----w C:\Program Files\Trend Micro
                              2008-02-14 10:26 --------- d-----w C:\Program Files\Spybot - Search & Destroy
                              2008-02-14 10:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
                              2008-02-14 10:21 --------- d--h--w C:\Program Files\InstallShield Installation Information
                              2008-02-14 10:21 --------- d-----w C:\Program Files\Ubisoft
                              2008-02-09 11:37 --------- d-----w C:\Program Files\Hercules
                              2008-02-09 11:37 --------- d-----w C:\Documents and Settings\TEMP\Application Data\InstallShield
                              2008-02-04 11:32 --------- d-----w C:\Program Files\Fichiers communs\Real
                              2008-02-01 10:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
                              2004-07-22 12:30 2,236,883 -c--a-w C:\Documents and Settings\LME\PROTECT.DLL
                              2004-07-22 12:29 2,294,272 -c--a-w C:\Documents and Settings\LME\LME32.EXE
                              2001-06-27 09:09 25,632 -c--a-w C:\Documents and Settings\LME\LMEPRO32.EXE
                              1998-08-11 21:01 25,055 -c--a-w C:\Documents and Settings\LME\UNINST16.DLL
                              2006-05-29 17:18 10,022 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
                              .

                              ((((((((((((((((((((((((((((( snapshot_2008-03-25_23.20.25,03 )))))))))))))))))))))))))))))))))))))))))
                              .
                              - 2008-03-25 21:55:52 64,872 ----a-w C:\WINDOWS\system32\perfc009.dat
                              + 2008-03-26 08:45:12 64,872 ----a-w C:\WINDOWS\system32\perfc009.dat
                              - 2008-03-25 21:55:52 78,778 ----a-w C:\WINDOWS\system32\perfc00C.dat
                              + 2008-03-26 08:45:12 78,778 ----a-w C:\WINDOWS\system32\perfc00C.dat
                              - 2008-03-25 21:55:52 409,012 ----a-w C:\WINDOWS\system32\perfh009.dat
                              + 2008-03-26 08:45:12 409,012 ----a-w C:\WINDOWS\system32\perfh009.dat
                              - 2008-03-25 21:55:52 477,416 ----a-w C:\WINDOWS\system32\perfh00C.dat
                              + 2008-03-26 08:45:13 477,416 ----a-w C:\WINDOWS\system32\perfh00C.dat
                              + 2008-03-26 08:40:36 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_278.dat
                              + 2008-03-26 08:38:42 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_58c.dat
                              .
                              ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                              .
                              .
                              REGEDIT4
                              *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

                              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                              "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 11:00 15360]

                              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                              "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
                              "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 17:58 282624]

                              C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                              Moniteur WiFi OLITEC.exe.lnk - C:\Program Files\OLITEC\Moniteur WiFi OLITEC\Moniteur WiFi OLITEC.exe [2007-06-17 16:38:18 913408]

                              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
                              "dwnrpofk"= {F048C09F-C66A-4914-8D76-12636A70EA24} - C:\WINDOWS\dwnrpofk.dll [ ]

                              [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
                              "DisableMonitoring"=dword:00000001

                              [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
                              "DisableMonitoring"=dword:00000001

                              [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
                              "DisableMonitoring"=dword:00000001

                              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                              "%windir%\\system32\\sessmgr.exe"=
                              "C:\\Program Files\\xerox\\nwwia\\XrxFTPLt.exe"=
                              "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                              "C:\\WINDOWS\\system32\\dpvsetup.exe"=
                              "C:\\WINDOWS\\system32\\rundll32.exe"=
                              "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                              "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                              "C:\\Program Files\\Hercules\\Classic Silver\\Station2.exe"=

                              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                              "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

                              R3 camfilt2;camfilt2;C:\WINDOWS\system32\DRIVERS\camfilt2.sys [2007-06-13 15:43]
                              R3 MRVW225;802.11g/b Wireless LAN Dirver for Windows XP;C:\WINDOWS\system32\DRIVERS\MRVW225.sys [2006-09-29 08:59]
                              S2 Ca533av;Icatch(IV) Video Camera Device;C:\WINDOWS\system32\Drivers\Ca533av.sys []
                              S2 UMAXPCLS;Pilote de scanneur pour port imprimante;C:\WINDOWS\system32\DRIVERS\umaxpcls.sys [2001-08-17 21:58]
                              S3 USBCamera;Icatch(IV) Still Camera Device;C:\WINDOWS\system32\Drivers\Bulk533.sys []
                              S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
                              S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

                              .
                              Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
                              "2008-03-03 06:33:17 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
                              - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
                              .
                              **************************************************************************

                              catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                              Rootkit scan 2008-03-26 13:04:50
                              Windows 5.1.2600 Service Pack 2 NTFS

                              Balayage processus cachés ...

                              Balayage caché autostart entries ...

                              Balayage des fichiers cachés ...

                              Scan terminé avec succès
                              Les fichiers cachés: 0

                              **************************************************************************
                              .
                              Temps d'accomplissement: 2008-03-26 13:08:13
                              ComboFix-quarantined-files.txt 2008-03-26 12:07:57
                              ComboFix2.txt 2008-03-26 11:51:51
                              ComboFix3.txt 2008-03-26 08:49:50
                              ComboFix4.txt 2008-03-25 22:21:16
                              ComboFix5.txt 2008-03-04 22:37:18
                              .
                              2008-03-12 08:02:41 --- E O F ---
                              0
                              1. Utilisateur anonyme
                                Ok j'attends l'autre rapport.
                                a+
                                0
                                1. Utilisateur anonyme
                                  Re okii

                                  Fait le CFScript > Poste le rapport.

                                  Et tu me feras un dernier CFScript avec ceci :

                                  File::
                                  C:\Documents and Settings\TEMP\BureauFWebdEditor.exe
                                  C:\Documents and Settings\TEMP\Bureaufwebd.exe
                                  C:\Documents and Settings\TEMP\Bureaufkwp2.0.exe
                                  C:\Documents and Settings\TEMP\Bureaufkwp1.5.exe
                                  C:\Documents and Settings\TEMP\Bureaufilemanagerclient.exe
                                  C:\Documents and Settings\TEMP\BureauEditorFKWP2.0.exe
                                  C:\Documents and Settings\TEMP\BureauEditorFKWP1.5.exe

                                  Folder::
                                  C:\Documents and Settings\TEMP\Bureauvirii

                                  ******************************************

                                  + un rapport hijackthis.
                                  a+

                                  N'oublie pas les rapports.
                                  0
                                  1. jeremy
                                    ComboFix 08-03-25.1 - jérémy 2008-03-26 12:41:16.4 - NTFSx86
                                    Endroit: C:\Documents and Settings\TEMP\Bureau\ComboFix.exe
                                    Command switches used :: C:\Documents and Settings\TEMP\Bureau\CFScript.txt

                                    [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
                                    .
                                    -- Script messages for sUBs --
                                    VFind -td "C:\WINDOWS\system32\baiso*"
                                    VFind.exe -ltf -s-1300000 -d+2007-12-26 C:\WINDOWS\*
                                    VFind.exe -ltf -s-1000000 -d+2007-12-26 "C:\Program Files\*"

                                    ((((((((((((((((((((((((((((( Fichiers créés 2008-02-26 to 2008-03-26 ))))))))))))))))))))))))))))))))))))
                                    .

                                    2008-03-25 18:42 . 2008-03-25 18:42 <REP> d-------- C:\Program Files\PC-Cleaner
                                    2008-03-25 17:28 . 2008-03-25 17:28 <REP> d-------- C:\Documents and Settings\TEMP\Bureauvirii
                                    2008-03-25 17:28 . 2008-03-25 17:28 4,096 --a------ C:\Documents and Settings\TEMP\BureauFWebdEditor.exe
                                    2008-03-25 17:28 . 2008-03-25 17:28 4,096 --a------ C:\Documents and Settings\TEMP\Bureaufwebd.exe
                                    2008-03-25 17:28 . 2008-03-25 17:28 4,096 --a------ C:\Documents and Settings\TEMP\Bureaufkwp2.0.exe
                                    2008-03-25 17:28 . 2008-03-25 17:28 4,096 --a------ C:\Documents and Settings\TEMP\Bureaufkwp1.5.exe
                                    2008-03-25 17:28 . 2008-03-25 17:28 4,096 --a------ C:\Documents and Settings\TEMP\Bureaufilemanagerclient.exe
                                    2008-03-25 17:28 . 2008-03-25 17:28 4,096 --a------ C:\Documents and Settings\TEMP\BureauEditorFKWP2.0.exe
                                    2008-03-25 17:28 . 2008-03-25 17:28 4,096 --a------ C:\Documents and Settings\TEMP\BureauEditorFKWP1.5.exe
                                    2008-03-25 13:24 . 2008-03-25 13:24 <REP> d-------- C:\Program Files\Inet Delivery
                                    2008-03-01 13:52 . 2008-03-01 13:52 <REP> d-------- C:\Program Files\Lavasoft
                                    2008-03-01 13:52 . 2008-03-01 13:54 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
                                    2008-03-01 13:47 . 2008-03-01 13:48 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard

                                    .
                                    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                                    .
                                    2008-03-25 16:28 4,096 ----a-w C:\WINDOWS\zipped.tmp
                                    2008-03-25 16:28 4,096 ----a-w C:\WINDOWS\zip3.tmp
                                    2008-03-25 16:28 4,096 ----a-w C:\WINDOWS\zip2.tmp
                                    2008-03-25 16:28 4,096 ----a-w C:\WINDOWS\zip1.tmp
                                    2008-03-25 16:28 4,096 ----a-w C:\WINDOWS\userconfig9x.dll
                                    2008-03-25 16:28 4,096 ----a-w C:\WINDOWS\mssecu.exe
                                    2008-03-25 16:28 4,096 ----a-w C:\WINDOWS\iTunesMusic.exe
                                    2008-03-25 16:28 4,096 ----a-w C:\WINDOWS\FVProtect.exe
                                    2008-03-25 16:28 4,096 ----a-w C:\WINDOWS\bdn.com
                                    2008-03-25 16:28 4,096 ----a-w C:\WINDOWS\base64.tmp
                                    2008-02-27 18:05 --------- d-----w C:\Program Files\Windows Live
                                    2008-02-22 12:40 --------- d-----w C:\Program Files\a-squared Free
                                    2008-02-16 17:18 --------- d-----w C:\Program Files\Zone Labs
                                    2008-02-16 08:21 --------- d-----w C:\Program Files\Apple Software Update
                                    2008-02-16 08:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
                                    2008-02-15 10:16 --------- d-----w C:\Program Files\Trend Micro
                                    2008-02-14 10:26 --------- d-----w C:\Program Files\Spybot - Search & Destroy
                                    2008-02-14 10:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
                                    2008-02-14 10:21 --------- d--h--w C:\Program Files\InstallShield Installation Information
                                    2008-02-14 10:21 --------- d-----w C:\Program Files\Ubisoft
                                    2008-02-09 11:37 --------- d-----w C:\Program Files\Hercules
                                    2008-02-09 11:37 --------- d-----w C:\Documents and Settings\TEMP\Application Data\InstallShield
                                    2008-02-04 11:32 --------- d-----w C:\Program Files\Fichiers communs\Real
                                    2008-02-01 10:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
                                    2004-07-22 12:30 2,236,883 -c--a-w C:\Documents and Settings\LME\PROTECT.DLL
                                    2004-07-22 12:29 2,294,272 -c--a-w C:\Documents and Settings\LME\LME32.EXE
                                    2001-06-27 09:09 25,632 -c--a-w C:\Documents and Settings\LME\LMEPRO32.EXE
                                    1998-08-11 21:01 25,055 -c--a-w C:\Documents and Settings\LME\UNINST16.DLL
                                    2006-05-29 17:18 10,022 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
                                    .

                                    ((((((((((((((((((((((((((((( snapshot_2008-03-25_23.20.25,03 )))))))))))))))))))))))))))))))))))))))))
                                    .
                                    - 2008-03-25 21:55:52 64,872 ----a-w C:\WINDOWS\system32\perfc009.dat
                                    + 2008-03-26 08:45:12 64,872 ----a-w C:\WINDOWS\system32\perfc009.dat
                                    - 2008-03-25 21:55:52 78,778 ----a-w C:\WINDOWS\system32\perfc00C.dat
                                    + 2008-03-26 08:45:12 78,778 ----a-w C:\WINDOWS\system32\perfc00C.dat
                                    - 2008-03-25 21:55:52 409,012 ----a-w C:\WINDOWS\system32\perfh009.dat
                                    + 2008-03-26 08:45:12 409,012 ----a-w C:\WINDOWS\system32\perfh009.dat
                                    - 2008-03-25 21:55:52 477,416 ----a-w C:\WINDOWS\system32\perfh00C.dat
                                    + 2008-03-26 08:45:13 477,416 ----a-w C:\WINDOWS\system32\perfh00C.dat
                                    + 2008-03-26 08:40:36 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_278.dat
                                    + 2008-03-26 08:38:42 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_58c.dat
                                    .
                                    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                                    .
                                    .
                                    REGEDIT4
                                    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

                                    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 11:00 15360]

                                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
                                    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 17:58 282624]

                                    C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                                    Moniteur WiFi OLITEC.exe.lnk - C:\Program Files\OLITEC\Moniteur WiFi OLITEC\Moniteur WiFi OLITEC.exe [2007-06-17 16:38:18 913408]

                                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
                                    "dwnrpofk"= {F048C09F-C66A-4914-8D76-12636A70EA24} - C:\WINDOWS\dwnrpofk.dll [ ]

                                    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
                                    "DisableMonitoring"=dword:00000001

                                    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
                                    "DisableMonitoring"=dword:00000001

                                    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
                                    "DisableMonitoring"=dword:00000001

                                    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                                    "%windir%\\system32\\sessmgr.exe"=
                                    "C:\\Program Files\\xerox\\nwwia\\XrxFTPLt.exe"=
                                    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                                    "C:\\WINDOWS\\system32\\dpvsetup.exe"=
                                    "C:\\WINDOWS\\system32\\rundll32.exe"=
                                    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                                    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                                    "C:\\Program Files\\Hercules\\Classic Silver\\Station2.exe"=

                                    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                                    "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

                                    .
                                    Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
                                    "2008-03-03 06:33:17 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
                                    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
                                    .
                                    **************************************************************************

                                    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                                    Rootkit scan 2008-03-26 12:47:21
                                    Windows 5.1.2600 Service Pack 2 NTFS

                                    Balayage processus cachés ...

                                    Balayage caché autostart entries ...

                                    Balayage des fichiers cachés ...

                                    Scan terminé avec succès
                                    Les fichiers cachés: 0

                                    **************************************************************************
                                    .
                                    Temps d'accomplissement: 2008-03-26 12:51:50
                                    ComboFix-quarantined-files.txt 2008-03-26 11:51:41
                                    ComboFix2.txt 2008-03-26 08:49:50
                                    ComboFix3.txt 2008-03-25 22:21:16
                                    ComboFix4.txt 2008-03-04 22:37:18
                                    .
                                    2008-03-12 08:02:41 --- E O F ---

                                    je te passe l'autre scan apres
                                    0
                                • 1
                                • 2