Rapport hijackthis

Merci pour tout.

Comment dois-je faire pour indiquer cette question résolue.

Et bonne continuation en Finlande !

Bonjour,

Voici le rapport

-->- Recherche:

C:\SDFIX: trouvé !
C:\Combofix: trouvé !
C:\Qoobox: trouvé !
C:\_OtMoveIt: trouvé !
C:\Documents and Settings\Administrateur\Bureau\OtMoveIt2.exe: trouvé !
C:\Documents and Settings\HP_Propriétaire\Bureau\SdFix.exe: trouvé !
C:\Documents and Settings\HP_Propriétaire\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\HP_Propriétaire\Bureau\Msnfix.zip: trouvé !
C:\Documents and Settings\HP_Propriétaire\Bureau\OtMoveIt2.exe: trouvé !
C:\Documents and Settings\HP_Propriétaire\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\HP_Propriétaire\Bureau\MsnFix: trouvé !
C:\Program Files\HijackThis.exe: trouvé !
C:\WINDOWS\system32\config\systemprofile\Recent\MSNFix.lnk: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\Administrateur\Bureau\OtMoveIt2.exe: supprimé !
C:\Documents and Settings\HP_Propriétaire\Bureau\SdFix.exe: supprimé !
C:\Documents and Settings\HP_Propriétaire\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\HP_Propriétaire\Bureau\Msnfix.zip: supprimé !
C:\Documents and Settings\HP_Propriétaire\Bureau\OtMoveIt2.exe: supprimé !
C:\Documents and Settings\HP_Propriétaire\Bureau\ComboFix.exe: supprimé !
C:\Program Files\HijackThis.exe: supprimé !
C:\WINDOWS\system32\config\systemprofile\Recent\MSNFix.lnk: supprimé !
C:\SDFIX: supprimé !
C:\Combofix: supprimé !
C:\Qoobox: supprimé !
C:\_OtMoveIt: supprimé !
C:\Documents and Settings\HP_Propriétaire\Bureau\MsnFix: supprimé !

Corbeille vidée!
Fichiers temporaires nettoyés !

Re,

Finalement mon problème bien de mon écran ... apparemment il est HS.

Re,

Finalement mon problème bien de mon écran ... apparemment il est HS.

Bonjour g!rly,

Merci pour ton aide ... je crois que côté infection tout est résolu ... je vais donc maintenant regarder côté écran et carte graphique !

Non pas déçu par la finlande ... je plaisantais sur la température ... cela me semble être un pays remarquable .... j'ai été très bien reçu ... et très surpris pas beaucoup de points, notamment en matière de fonctionnement des universités puisque c'était l'objet de ma mission.

Je te souhaite un bon week-end.

@+

Bonjour,

J'ai un écran TFT 17'' F1723 acheté en novembre 2004.

Je n'arrive pas a installé ce driver :
Intel Chipset Device Software (drivers 8.5.0.1008 WHQL)
Constructeur: Intel | Fichier INF: ich6id2.inf | Classe: hdc | Version: 8.2.0.1011 | Date: 15/11/2006 | Date de publication: 02/11/2007

Bonne journée

Re

J'ai mis à jour les drivers ... il n'y a que celui-ci que je n'arrive pas à mettre à jour ... il ne le prend pas en compte ... pourtant il n'y a aps de message d'erreur ... mais au redémarrage il n'est pas pris en compte !

Par ailleurs j'ai toujours le même problème avec mon écran .... Je me demande si ce n'est pas un pb matériem, car le problème existe dès l'allumage du pc, avant le chargement de windows.

Qu'en penses-tu ?

@domisalut domi,

lequel de driver n´arrives tu pas a mettre a jour ?

il est vieux ton ecran ?

@+

Salut G!rly,

Le hasard m'étonnera toujours ... A la mi-mars j'étais en Finlande pour une semaine ... A Jyvaskyla précisément .... Sinon j'habite Cherbourg lorsque je ne suis pas en déplacement.

Voici le rapport MSNFIX

MSNFix 1.694

C:\Documents and Settings\HP_Propri‚taire\Bureau\MSNFix
Fix exécuté le 31/03/2008 - 19:03:32,03 By HP_Propri‚taire
mode normal

************************ Recherche les fichiers présents

Aucun Fichier trouvé

************************ Recherche les dossiers présents

Aucun dossier trouvé

************************ Fichiers suspects

Aucun Fichier trouvé

************************ HKLM\...\Winlogon\Userinit

Userinit = C:\WINDOWS\system32\userinit.exe,

------------------------------------------------------------------------
Auteur : !aur3n7 Contact: https://www.ionos.fr/
------------------------------------------------------------------------

--------------------------------------------- END ---------------------------------------------

Et le rapport SDFIX

[b]SDFix: Version 1.165 [/b]

Run by Administrateur on 31/03/2008 at 19:22

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting

[b]Checking Files [/b]:

No Trojan Files Found

Removing Temp Files

[b]ADS Check [/b]:

[b]Final Check [/b]:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-31 19:33:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{30FDFCEA-DA09-C703-E87B-7D1C0DC5ED5C}]
"bbfebaainaikfcppgdmmndmmpekfndpmhpok"=hex:6a,61,69,66,70,69,67,63,62,63,66,68,63,6b,64,62,70,61,6e,61,00,..
"abldpgnfbacpoibjknajhomecdfachjekj"=hex:6a,61,69,66,6c,69,6b,66,6d,6e,6b,6e,64,62,66,64,6d,6e,6f,63,00,..
"iafebaainaikfcppgd"=hex:61,61,00,00
"haldpgnfbacpoibj"=hex:61,61,00,00
"iajdfggfdkglnfihed"=hex:61,61,00,00

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 3

[b]Remaining Services [/b]:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\age2_x1.icd"="C:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\age2_x1.icd:*:Enabled:Age of Empires II Expansion"
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Disabled:Internet Explorer"
"C:\\WINDOWS\\system32\\rtcshare.exe"="C:\\WINDOWS\\system32\\rtcshare.exe:*:Enabled:Partage de l'application RTC"
"C:\\Program Files\\NetMeeting\\conf.exe"="C:\\Program Files\\NetMeeting\\conf.exe:*:Enabled:Windows© NetMeeting©"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Securitoo\\av_fw\\backweb\\6588780\\Program\\fspex.exe"="C:\\Program Files\\Securitoo\\av_fw\\backweb\\6588780\\Program\\fspex.exe:*:Enabled:Antivirus Firewall"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealPlayer"
"C:\\WINDOWS\\system32\\mmc.exe"="C:\\WINDOWS\\system32\\mmc.exe:*:Enabled:Microsoft Management Console"
"C:\\WINDOWS\\system32\\mcoinstall.exe"="C:\\WINDOWS\\system32\\mcoinstall.exe:*:Disabled:mcoinstall"
"C:\\Program Files\\Ankama Games\\Dofus\\Dofus.exe"="C:\\Program Files\\Ankama Games\\Dofus\\Dofus.exe:*:Enabled:Dofus Client"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Securitoo\\av_fw\\backweb\\6588780\\Program\\fspex.exe"="C:\\Program Files\\Securitoo\\av_fw\\backweb\\6588780\\Program\\fspex.exe:*:Enabled:Antivirus Firewall"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:

File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Thu 25 Nov 2004 196 A.SHR --- "C:\BOOT.BAK"
Wed 13 Oct 2004 1,694,208 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe"
Wed 28 Mar 2007 5,355,320 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Sat 18 Dec 2004 0 A.SH. --- "C:\WINDOWS\SMINST\HPCD.sys"
Sat 10 Sep 2005 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Mon 26 Mar 2007 26,112 ...H. --- "C:\Documents and Settings\Fran‡oise\Mes documents\~WRL1131.tmp"
Sat 22 Oct 2005 4,699,136 ...H. --- "C:\Documents and Settings\Morgane\Mes documents\~WRL0005.tmp"
Sun 15 Jan 2006 21,504 ...H. --- "C:\Documents and Settings\Morgane\Mes documents\~WRL0282.tmp"
Sun 15 Jan 2006 22,016 ...H. --- "C:\Documents and Settings\Morgane\Mes documents\~WRL0304.tmp"
Sun 15 Jan 2006 21,504 ...H. --- "C:\Documents and Settings\Morgane\Mes documents\~WRL0509.tmp"
Sun 15 Jan 2006 24,064 ...H. --- "C:\Documents and Settings\Morgane\Mes documents\~WRL1521.tmp"
Sun 15 Jan 2006 21,504 ...H. --- "C:\Documents and Settings\Morgane\Mes documents\~WRL2049.tmp"
Sun 15 Jan 2006 21,504 ...H. --- "C:\Documents and Settings\Morgane\Mes documents\~WRL2095.tmp"
Sun 15 Jan 2006 21,504 ...H. --- "C:\Documents and Settings\Morgane\Mes documents\~WRL2800.tmp"
Sat 14 Jan 2006 20,480 ...H. --- "C:\Documents and Settings\Morgane\Mes documents\~WRL3215.tmp"
Sat 23 Dec 2006 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Thu 2 Aug 2007 60,416 ...H. --- "C:\Documents and Settings\Corentin\Application Data\Microsoft\ModŠles\~WRL0374.tmp"
Tue 25 Oct 2005 35,840 ...H. --- "C:\Documents and Settings\Corentin\Application Data\Microsoft\ModŠles\~WRL2146.tmp"
Wed 21 Mar 2007 59,904 ...H. --- "C:\Documents and Settings\Corentin\Application Data\Microsoft\Word\~WRL0004.tmp"
Sun 21 Oct 2007 65,024 ...H. --- "C:\Documents and Settings\Corentin\Application Data\Microsoft\Word\~WRL1280.tmp"
Sat 16 Jun 2007 87,552 ...H. --- "C:\Documents and Settings\Morgane\Application Data\Microsoft\ModŠles\~WRL1430.tmp"

[b]Finished![/b]

Bonjour

J'espère que tu as passé un bon week-end ... Chez moi le temps n'était pas terrible mai on est habitué ... néanmoins vivement le printemps.

Voici le rapport que tu m'as demandé. Par ailleurs je n'arrive pas à remettre kla main sur les rapports MSNFIX et SD FIX.

# Rapport Lopxp fait le 31/03/2008 à 12:33:20
# Exécuté dans : C:\Program Files\Lopxp
# Version 3.09 - Maj du 28/02/2008

========== Listing des dossiers Application Data

+- C:\Documents and Settings\Administrateur\Application Data

2008-03-29 à 10:11:39 - Adobe
2004-01-01 à 16:45:05 - Apple Computer
2004-01-01 à 13:06:07 - Identities
2004-01-01 à 16:36:31 - Intervideo
2008-03-29 à 10:05:34 - Microsoft
2004-01-01 à 17:12:24 - SampleView
2004-01-01 à 14:07:33 - Sun

+- C:\Documents and Settings\Administrateur\Local Settings\Application Data

2008-03-29 à 10:11:40 - Adobe
2004-01-01 à 16:45:05 - Apple Computer
2004-01-01 à 16:57:00 - ApplicationHistory
2004-01-01 à 13:09:16 - Microsoft
2004-01-01 à 14:07:19 - {7148F0A6-6813-11D6-A77B-00B0D0142030}

+- C:\Documents and Settings\All Users\Application Data

2008-02-10 à 20:55:42 - Adobe
2007-03-31 à 10:04:17 - Apple Computer
2006-11-12 à 09:37:28 - F-Secure
2007-06-28 à 10:31:13 - Google
2004-01-01 à 14:51:28 - Hewlett-Packard
2004-01-01 à 16:36:12 - InterVideo
2006-10-26 à 16:32:32 - iWin
2008-02-24 à 16:39:55 - Kiwee Toolbar2
2006-11-12 à 12:02:44 - Messenger Plus!
2007-09-02 à 09:07:55 - Microsoft
2004-01-01 à 16:57:01 - Motive
2007-06-15 à 16:35:12 - pixelStorm
2004-11-27 à 12:54:43 - QuickTime
2006-10-17 à 17:18:57 - Sandlot Games
2004-01-01 à 13:11:16 - SBSI
2005-12-26 à 09:17:27 - Sony Corporation
2008-02-13 à 19:29:55 - Spybot - Search & Destroy
2005-03-04 à 21:18:05 - Symantec
2008-03-15 à 19:37:48 - TEMP
2006-06-21 à 13:16:53 - Windows Genuine Advantage
2007-09-25 à 19:57:28 - WindowsLiveInstaller
2008-02-25 à 19:58:40 - WLInstaller
2007-11-11 à 20:54:24 - Zylom

+- C:\Documents and Settings\Corentin\Application Data

2007-11-10 à 10:44:45 - Adobe
2007-01-25 à 16:47:30 - AdobeUM
2007-06-08 à 19:06:58 - Apple Computer
2007-03-08 à 17:40:00 - F-Secure
2005-01-05 à 15:09:37 - Help
2005-04-02 à 17:53:05 - Identities
2004-01-01 à 16:36:31 - Intervideo
2006-11-12 à 13:08:07 - ispnews
2006-10-26 à 16:32:32 - iWin
2006-11-26 à 18:31:50 - Macromedia
2007-04-23 à 17:46:42 - Microsoft
2005-02-10 à 17:10:22 - Motive
2006-11-25 à 15:38:27 - Mozilla
2007-03-08 à 18:52:26 - MSNInstaller
2007-07-11 à 07:42:49 - MySpace
2008-03-15 à 14:32:54 - OpenOffice.org2
2006-09-02 à 08:05:53 - Player Orange
2007-05-29 à 17:00:04 - Real
2004-12-09 à 18:25:51 - Roxio
2004-01-01 à 17:12:24 - SampleView
2007-04-29 à 09:34:59 - Sierra
2004-11-30 à 18:03:41 - Sonic
2006-04-19 à 10:06:35 - Sony Corporation
2004-01-01 à 14:07:33 - Sun
2004-01-01 à 20:04:40 - Symantec
2008-01-12 à 13:09:23 - U3
2006-10-12 à 20:17:50 - Wannadoo
2007-08-02 à 12:05:34 - WinRAR

+- C:\Documents and Settings\Corentin\Local Settings\Application Data

2007-11-10 à 10:44:51 - Adobe
2007-05-30 à 17:12:32 - Apple Computer
2006-09-02 à 08:04:28 - ApplicationHistory
2007-06-28 à 15:27:26 - Google
2005-01-05 à 15:09:37 - Help
2005-09-21 à 17:32:30 - HP
2005-04-02 à 18:00:05 - Identities
2005-09-21 à 17:32:30 - IsolatedStorage
2008-02-04 à 16:33:33 - Kiwee Toolbar2
2006-09-14 à 14:45:17 - Logitech-LS
2007-12-04 à 14:19:22 - Microsoft
2006-11-25 à 15:38:27 - Mozilla
2004-12-09 à 18:25:49 - Roxio
2004-01-01 à 14:07:19 - {7148F0A6-6813-11D6-A77B-00B0D0142030}

+- C:\Documents and Settings\Fran‡oise\Application Data

2008-02-13 à 16:49:43 - Adobe
2004-01-01 à 16:45:05 - Apple Computer
2006-11-29 à 17:28:29 - F-Secure
2005-02-01 à 08:26:30 - Help
2006-03-13 à 14:33:19 - Identities
2004-01-01 à 16:36:31 - Intervideo
2006-11-15 à 15:25:46 - ispnews
2005-01-05 à 19:52:08 - Macromedia
2007-02-08 à 08:36:19 - Microsoft
2005-05-31 à 10:06:55 - Motive
2006-11-25 à 15:59:28 - Mozilla
2008-03-05 à 14:39:04 - OpenOffice.org2
2006-09-11 à 17:13:37 - Player Orange
2007-03-06 à 20:17:31 - Real
2004-12-15 à 18:05:31 - Roxio
2004-01-01 à 17:12:24 - SampleView
2004-01-01 à 14:07:33 - Sun
2004-01-01 à 20:04:40 - Symantec

+- C:\Documents and Settings\Fran‡oise\Local Settings\Application Data

2007-10-04 à 07:52:18 - Adobe
2004-01-01 à 16:45:05 - Apple Computer
2006-09-11 à 17:13:06 - ApplicationHistory
2007-07-03 à 09:26:50 - Google
2005-02-01 à 08:26:30 - Help
2006-03-13 à 14:33:19 - Identities
2008-02-05 à 14:12:18 - Kiwee Toolbar2
2006-11-25 à 15:56:57 - Logitech-LS
2008-01-23 à 17:42:45 - Microsoft
2006-11-25 à 15:59:28 - Mozilla
2004-12-15 à 18:05:29 - Roxio
2004-01-01 à 14:07:19 - {7148F0A6-6813-11D6-A77B-00B0D0142030}

+- C:\Documents and Settings\HP_Propri‚taire\Application Data

2008-03-16 à 13:11:40 - Adobe
2007-01-28 à 10:54:45 - AdobeUM
2004-01-01 à 16:45:05 - Apple Computer
2005-01-06 à 19:43:33 - ArcSoft
2006-11-12 à 11:03:11 - F-Secure
2004-12-05 à 17:51:58 - Help
2004-01-01 à 13:06:07 - Identities
2005-03-16 à 18:59:06 - Intervideo
2006-11-12 à 09:41:20 - ispnews
2007-03-18 à 18:24:38 - Lavasoft
2004-12-06 à 19:52:36 - Leadertech
2007-05-19 à 08:38:25 - Macromedia
2007-07-01 à 11:09:51 - Microsoft
2004-11-26 à 19:48:49 - Motive
2006-09-16 à 08:33:57 - Mozilla
2006-11-25 à 14:39:05 - MSNInstaller
2004-12-28 à 17:38:23 - Nikon
2007-11-25 à 16:58:51 - OpenOffice.org2
2006-09-01 à 19:24:41 - Player Orange
2007-02-25 à 16:42:42 - Real
2008-03-01 à 08:40:24 - Roxio
2004-01-01 à 17:12:24 - SampleView
2004-12-06 à 20:01:44 - Sonic
2005-12-30 à 13:27:30 - Sony Corporation
2004-01-01 à 14:07:33 - Sun
2004-01-01 à 20:04:40 - Symantec
2008-01-12 à 13:54:02 - U3
2007-09-01 à 15:12:18 - Uniblue
2005-08-30 à 17:21:06 - Wannadoo
2007-09-15 à 07:16:32 - WinRAR

+- C:\Documents and Settings\HP_Propri‚taire\Local Settings\Application Data

2007-07-30 à 07:11:06 - Adobe
2007-04-26 à 20:53:41 - Apple Computer
2007-09-05 à 20:28:47 - ApplicationHistory
2007-02-25 à 16:40:01 - Google
2004-12-05 à 17:51:58 - Help
2004-11-26 à 19:44:19 - HP
2004-12-05 à 19:33:33 - Identities
2004-12-06 à 20:34:31 - IsolatedStorage
2008-02-09 à 08:34:20 - Kiwee Toolbar2
2006-11-12 à 09:41:15 - Logitech-LS
2008-03-28 à 18:32:46 - Microsoft
2004-12-06 à 20:05:23 - MicroVision Applications
2006-09-16 à 08:33:57 - Mozilla
2005-04-29 à 15:02:33 - Roxio
2006-07-15 à 09:37:54 - WMTools Downloaded Files
2004-01-01 à 14:07:19 - {7148F0A6-6813-11D6-A77B-00B0D0142030}

+- C:\Documents and Settings\Morgane\Application Data

2008-02-09 à 11:22:27 - Adobe
2007-01-28 à 10:38:37 - AdobeUM
2004-01-01 à 16:45:05 - Apple Computer
2006-10-21 à 13:25:09 - EQ BYTE BIB
2008-03-11 à 18:55:57 - F-Secure
2004-12-07 à 20:32:12 - Help
2006-10-17 à 17:18:55 - Identities
2004-01-01 à 16:36:31 - Intervideo
2006-11-12 à 12:59:30 - ispnews
2007-03-12 à 20:33:18 - Leadertech
2007-01-31 à 20:46:31 - Macromedia
2007-07-31 à 15:18:56 - Microsoft
2005-06-06 à 16:54:18 - Motive
2006-11-25 à 15:49:54 - Mozilla
2006-11-12 à 13:01:57 - MSNInstaller
2007-07-10 à 18:28:04 - MySpace
2005-06-06 à 16:41:47 - Nikon
2008-03-15 à 18:14:41 - OpenOffice.org2
2006-09-01 à 19:30:00 - Player Orange
2007-01-31 à 20:46:31 - PlayFirst
2007-07-07 à 17:36:29 - Real
2007-07-31 à 13:23:24 - Roxio
2004-01-01 à 17:12:24 - SampleView
2007-04-22 à 17:19:46 - Screenshot Sender
2005-12-26 à 09:23:12 - Sony Corporation
2004-01-01 à 14:07:33 - Sun
2004-01-01 à 20:04:40 - Symantec
2006-11-10 à 19:44:36 - Wannadoo
2007-07-04 à 08:52:04 - WinRAR
2006-10-17 à 17:18:55 - Zylom

+- C:\Documents and Settings\Morgane\Local Settings\Application Data

2007-09-04 à 18:57:31 - Adobe
2007-04-03 à 19:29:07 - Apple Computer
2008-03-15 à 18:15:05 - ApplicationHistory
2008-03-02 à 20:47:39 - FamilyRestaurant
2007-06-28 à 10:31:13 - Google
2004-12-07 à 20:32:12 - Help
2005-03-19 à 10:50:12 - HP
2005-04-01 à 14:54:00 - Identities
2005-03-19 à 10:50:13 - IsolatedStorage
2008-02-05 à 19:32:13 - Kiwee Toolbar2
2006-09-13 à 18:42:10 - Logitech-LS
2008-02-25 à 20:08:16 - Microsoft
2006-11-25 à 15:49:54 - Mozilla
2005-04-29 à 15:02:33 - Roxio
2006-01-20 à 17:52:24 - WMTools Downloaded Files
2004-01-01 à 14:07:19 - {7148F0A6-6813-11D6-A77B-00B0D0142030}

========== Listing du dossier Program Files

+- C:\Program Files

2007-03-14 à 21:11:06 - a-squared Free
2008-02-10 à 20:55:19 - Adobe
2007-03-13 à 17:26:36 - Alwil Software
2008-02-26 à 12:36:52 - Ankama Games
2004-12-28 à 17:34:49 - ArcSoft
2006-06-27 à 15:50:53 - ASRWORDS
2004-11-25 à 20:32:16 - ATI Technologies
2007-12-13 à 18:45:37 - CCleaner
2007-09-01 à 17:56:45 - CleanUp!
2005-03-31 à 19:24:14 - COMBASIC
2006-01-07 à 12:02:15 - Common Files
2004-01-01 à 13:03:50 - ComPlus Applications
2006-12-13 à 16:35:16 - directx
2007-09-09 à 18:21:59 - DivX
2007-08-30 à 17:12:36 - DK
2008-03-05 à 12:33:39 - Dofus
2007-01-19 à 20:33:10 - Dofus-Arena
2007-06-12 à 13:42:04 - DofusArena2
2004-12-05 à 16:56:44 - Dupuis
2008-01-27 à 14:06:40 - EA GAMES
2006-05-01 à 11:40:54 - Easy CD Creator
2006-07-29 à 08:32:32 - Easy Internet signup
2005-07-17 à 09:38:22 - eJay
2008-02-05 à 20:10:31 - emme
2005-03-31 à 19:18:04 - English+
2006-10-05 à 19:55:15 - Family Safety
2008-03-02 à 20:46:51 - Fichiers communs
2007-03-28 à 11:17:34 - Google
2005-03-08 à 19:07:00 - Hasbro Interactive
2005-10-31 à 17:01:13 - Heart Of Darkness Mini-Jeu
2004-01-01 à 16:57:01 - Help and Support Additions
2004-01-01 à 14:51:06 - Hewlett-Packard
2007-03-18 à 18:26:39 - Hitman Pro
2006-09-13 à 17:26:24 - HP
2006-07-29 à 08:31:29 - Infogrames
2008-03-16 à 16:33:55 - InstallShield Installation Information
2008-02-13 à 19:06:19 - Internet Explorer
2004-11-25 à 20:34:19 - InterVideo
2007-08-02 à 08:03:39 - Java
2007-03-18 à 18:24:39 - Lavasoft
2006-09-13 à 17:38:05 - Logitech
2008-03-31 à 10:33:37 - Lopxp
2005-03-31 à 17:48:48 - Messenger
2007-12-26 à 11:20:05 - Messenger Plus! Live
2005-03-31 à 19:21:44 - MIC1500
2004-11-26 à 20:56:12 - Microsoft AutoRoute
2007-05-09 à 18:15:37 - Microsoft CAPICOM 2.1.0.2
2004-11-26 à 21:11:52 - Microsoft Encarta
2004-01-01 à 13:06:10 - microsoft frontpage
2006-08-27 à 09:51:56 - Microsoft Games
2004-11-26 à 20:55:06 - Microsoft Money
2004-11-26 à 20:50:47 - Microsoft Office
2005-03-29 à 19:10:11 - Microsoft Picture It! 9
2008-02-25 à 20:05:59 - Microsoft SQL Server Compact Edition
2005-03-29 à 19:10:12 - Microsoft Works
2004-11-26 à 20:44:30 - Microsoft Works Suite 2004
2005-05-03 à 18:41:37 - MODULE10
2004-01-01 à 13:04:06 - Movie Maker
2008-03-31 à 10:31:11 - Mozilla Firefox
2004-12-13 à 17:48:23 - MSN
2004-01-01 à 13:03:07 - MSN Gaming Zone
2006-11-15 à 17:55:09 - MSXML 4.0
2007-07-11 à 18:34:01 - MySpace
2006-09-16 à 12:16:52 - NetMeeting
2004-12-28 à 17:35:53 - Nikon
2006-07-26 à 08:28:59 - OfficeUpdate11
2007-11-18 à 12:36:34 - OpenOffice.org 2.1
2007-11-18 à 12:37:48 - OpenOffice.org 2.3
2006-09-01 à 19:24:30 - Orange
2007-06-13 à 18:04:45 - Outlook Express
2005-03-29 à 19:10:12 - PC-Doctor for Windows
2007-03-28 à 20:38:46 - Picasa2
2005-07-17 à 18:19:04 - PIXELA
2007-03-31 à 10:05:46 - QuickTime
2007-02-25 à 16:39:45 - Real
2007-09-01 à 18:20:02 - RegCleaner
2004-12-10 à 19:33:35 - Roxio
2006-07-07 à 17:49:13 - Securitoo
2007-05-20 à 10:01:59 - SimPE
2004-01-02 à 05:00:19 - SiS VGA Utilities V3.59e
2005-07-17 à 09:35:47 - Sonic Foundry ACID Music
2006-10-16 à 22:49:40 - Sony
2005-12-26 à 09:19:09 - Sony Corporation
2005-03-31 à 19:21:41 - SPEECH
2008-03-16 à 10:32:04 - Spybot - Search & Destroy
2004-01-01 à 13:09:08 - Uninstall Information
2007-09-01 à 17:57:59 - vanBasco's Karaoke Player
2006-07-09 à 13:55:41 - Wanadoo
2008-02-27 à 19:01:22 - Windows Live
2007-02-09 à 19:53:39 - Windows Media Connect 2
2007-04-26 à 19:45:25 - Windows Media Player
2004-11-09 à 15:20:28 - Windows NT
2004-01-01 à 13:04:29 - WindowsUpdate
2007-08-02 à 17:06:51 - WinRAR
2004-01-01 à 13:06:10 - xerox
2007-03-08 à 18:44:40 - Zylom Games

========== Tâches planifiées

Scheduled scanning task.job: C:\PROGRA~1\SECURI~1\av_fw\ANTI-V~1\fsav.exe /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\SECURI~1\av_fw\ANTI-V~1\report.txt
Uniblue SpeedUpMyPC Nag.job: C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s
Uniblue SpeedUpMyPC.job: C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s

========== Clés registre

========== Bloqueur popups Internet Explorer

========== Suggestion ( /!\ Nécessite une interprétation.) ==========

C:\Documents and Settings\Morgane\Application Data\EQ BYTE BIB

+- Registre : Aucune suggestion.

- Fin du rapport -

ok
je dois m'absenter également

Merci pour l'aide. A plus tard

voici le rapport moveIt

[Custom Input]
< C:\Program Files\Kiwee Toolbar2 >
C:\Program Files\Kiwee Toolbar2\1.2.116 moved successfully.
C:\Program Files\Kiwee Toolbar2 moved successfully.
< C:\Program Files\GamesBar >
C:\Program Files\GamesBar moved successfully.
< C:\Program Files\Gamenext >
C:\Program Files\Gamenext\Virtual Villagers moved successfully.
C:\Program Files\Gamenext\Paparazzi\Resource moved successfully.
C:\Program Files\Gamenext\Paparazzi moved successfully.
C:\Program Files\Gamenext\Flower Shop - Big City Break\user moved successfully.
C:\Program Files\Gamenext\Flower Shop - Big City Break moved successfully.
C:\Program Files\Gamenext\Fish Tycoon moved successfully.
C:\Program Files\Gamenext\Family Restaurant\sounds moved successfully.
C:\Program Files\Gamenext\Family Restaurant\recipes moved successfully.
C:\Program Files\Gamenext\Family Restaurant\properties moved successfully.
C:\Program Files\Gamenext\Family Restaurant\omdata\images moved successfully.
C:\Program Files\Gamenext\Family Restaurant\omdata moved successfully.
C:\Program Files\Gamenext\Family Restaurant\music moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\ui\levelHighScore moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\ui\Init moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\ui\gui moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\ui\GameHint moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\ui\daytarget moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\ui\cursor moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\ui\button moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\ui\bg moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\ui moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\trial moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\restaurant moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\ingredient\salad moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\ingredient\pizza moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\ingredient\icecream moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\ingredient\Grill table moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\ingredient\fryingPan moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\ingredient\deepfryer moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\ingredient moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\effect moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\cutin moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\characters\face moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images\characters moved successfully.
C:\Program Files\Gamenext\Family Restaurant\images moved successfully.
C:\Program Files\Gamenext\Family Restaurant\fonts moved successfully.
C:\Program Files\Gamenext\Family Restaurant\data moved successfully.
C:\Program Files\Gamenext\Family Restaurant\config moved successfully.
C:\Program Files\Gamenext\Family Restaurant\cached\sounds moved successfully.
C:\Program Files\Gamenext\Family Restaurant\cached moved successfully.
C:\Program Files\Gamenext\Family Restaurant moved successfully.
C:\Program Files\Gamenext moved successfully.
< C:\Program Files\AxBx >
C:\Program Files\AxBx\Clean Virus MSN moved successfully.
C:\Program Files\AxBx moved successfully.
< C:\Documents and Settings\Morgane\Application Data\GetRightToGo >
C:\Documents and Settings\Morgane\Application Data\GetRightToGo moved successfully.
< C:\Documents and Settings\Administrateur\Application Data\Symantec >
C:\Documents and Settings\Administrateur\Application Data\Symantec\Shared moved successfully.
C:\Documents and Settings\Administrateur\Application Data\Symantec moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.21 log created on 03292008_111759

Et le rapport Hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:38:34, on 29/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXE
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXE
C:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exe
C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
C:\Program Files\Securitoo\av_fw\Common\FSMB32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Securitoo\av_fw\Common\FCH32.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsqh.exe
C:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXE
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsrw.exe
C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\keyhook.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE
C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\PROGRA~1\SECURI~1\av_fw\ANTI-S~1\fsaw.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exe
C:\Program Files\Securitoo\av_fw\FSGUI\fsguidll.exe
C:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://outlook.live.com/owa/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Securitoo\av_fw\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exe
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\Securitoo\av_fw\Anti-Spyware\blockpopups.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\av_fw\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\av_fw\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://ak.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1102274155218
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://drivers1.free.fr/telecharger.php?id=2&version=
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game04.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe

le rapport combo fix

ComboFix 08-03-27.3 - HP_Propriétaire 2008-03-29 10:16:06.4 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.660 [GMT 1:00]
Endroit: C:\Documents and Settings\HP_Propriétaire\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\HP_Propri‚taire\Bureau\CFScript.txt
* Création d'un nouveau point de restauration
.

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-02-28 to 2008-03-29 ))))))))))))))))))))))))))))))))))))
.

2008-03-29 09:02 . <REP> C:\Documents and Settings\HP_PropriÚtaire\Local Settings
2008-03-29 09:02 . <REP> C:\Documents and Settings\HP_PropriÚtaire\Local Settings
2008-03-29 09:02 . <REP> C:\Documents and Settings\Franþoise\Local Settings
2008-03-29 09:02 . <REP> C:\Documents and Settings\Franþoise\Local Settings
2008-03-29 08:22 . 2008-03-29 08:22 <REP> d-------- C:\_OTMoveIt
2008-03-29 08:18 . 2008-03-29 08:18 <REP> d-------- C:\Program Files\AxBx
2008-03-28 20:13 . 2008-03-28 20:13 <REP> d-------- C:\WINDOWS\ERUNT
2008-03-28 20:11 . 2004-01-01 17:45 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS
2008-03-28 20:11 . 2004-01-01 14:59 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-03-28 20:11 . 2004-01-01 14:59 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-03-28 20:11 . 2004-11-09 16:20 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-03-28 20:11 . 2004-11-09 16:19 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2008-03-28 20:11 . 2004-11-09 16:19 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-03-28 20:11 . 2004-11-25 21:37 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2008-03-28 20:11 . 2008-03-28 20:16 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-03-28 20:11 . 2004-01-01 21:04 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec
2008-03-28 20:11 . 2004-01-01 18:12 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\SampleView
2008-03-28 20:11 . 2004-01-01 17:36 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Intervideo
2008-03-28 20:11 . 2004-01-01 17:45 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Apple Computer
2008-03-16 17:34 . 2004-11-24 21:10 516,096 --------- C:\WINDOWS\system32\ati2sgag.exe
2008-03-02 21:46 . 2008-03-02 21:46 <REP> d-------- C:\Program Files\Fichiers communs\Oberon Media
2008-03-02 10:51 . 2008-03-02 10:51 <REP> d-------- C:\Documents and Settings\Morgane\Application Data\GetRightToGo

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-16 16:33 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-16 10:32 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-15 19:37 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-15 18:14 --------- d-----w C:\Documents and Settings\Morgane\Application Data\OpenOffice.org2
2008-03-15 14:32 --------- d-----w C:\Documents and Settings\Corentin\Application Data\OpenOffice.org2
2008-03-11 19:09 14,496 ----a-w C:\Documents and Settings\Morgane\Application Data\wklnhst.dat
2008-03-11 18:55 --------- d-----w C:\Documents and Settings\Morgane\Application Data\F-Secure
2008-03-05 12:33 --------- d-----w C:\Program Files\Dofus
2008-03-02 20:47 --------- d-----w C:\Program Files\GamesBar
2008-03-02 20:46 --------- d-----w C:\Program Files\Gamenext
2008-02-29 09:51 9,658 ----a-w C:\Documents and Settings\Corentin\Application Data\wklnhst.dat
2008-02-27 19:01 --------- d-----w C:\Program Files\Windows Live
2008-02-26 12:36 --------- d-----w C:\Program Files\Ankama Games
2008-02-25 20:05 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-02-25 20:01 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-02-25 19:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-24 16:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kiwee Toolbar2
2008-02-15 17:26 71,088 ----a-w C:\Documents and Settings\Morgane\Application Data\GDIPFONTCACHEV1.DAT
2008-02-13 19:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-10 20:55 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-05 20:11 --------- d-----w C:\Program Files\Fichiers communs\English+
2008-02-05 20:10 --------- d-----w C:\Program Files\emme
2008-02-04 16:33 --------- d-----w C:\Program Files\Kiwee Toolbar2
2008-02-01 10:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2007-06-28 12:36 401,720 ----a-w C:\Program Files\HijackThis.exe
2007-02-08 15:12 69,112 ----a-w C:\Documents and Settings\Corentin\Application Data\GDIPFONTCACHEV1.DAT
2006-05-06 15:32 284 ----a-w C:\Documents and Settings\Morgane\Application Data\ViewerApp.dat
2004-12-18 20:47 0 --sha-w C:\WINDOWS\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}]
C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"= "C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll" [ ]

[HKEY_CLASSES_ROOT\clsid\{6638a9de-0745-4292-8a2e-ae530e7b9b3f}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{259EEB17-79AA-44DF-8410-8E55F82A902A}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"= C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll [ ]

[HKEY_CLASSES_ROOT\clsid\{6638a9de-0745-4292-8a2e-ae530e7b9b3f}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{259EEB17-79AA-44DF-8410-8E55F82A902A}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 11:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 16:04 52736]
"HPHUPD06"="c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 18:53 49152]
"HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [2004-06-07 18:43 659456]
"KBD"="C:\HP\KBD\KBD.EXE" [2003-02-11 20:02 61440]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 20:43 233472]
"VTTimer"="VTTimer.exe" []
"SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2004-05-20 09:47 249856]
"SoundMan"="SOUNDMAN.EXE" [2004-07-01 18:58 73728 C:\WINDOWS\SOUNDMAN.EXE]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 15:18 241664]
"F-Secure Manager"="C:\Program Files\Securitoo\av_fw\Common\FSM32.exe" [2005-10-26 02:51 122929]
"F-Secure TNB"="C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" [2005-07-18 15:51 700416]
"F-Secure Startup Wizard"="C:\Program Files\Securitoo\av_fw\FSGUI\FSSW.exe" [2005-10-18 09:29 372736]
"News Service"="C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe" [2005-05-31 13:45 356352]
"AlcWzrd"="ALCWZRD.EXE" [2004-07-06 01:05 2550272 C:\WINDOWS\ALCWZRD.EXE]
"KiweeHook"="C:\Program Files\Kiwee Toolbar2\1.2.116\kwtbaim.exe" [ ]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-24 21:10 344064]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 15:38 39264]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Morgane^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.1.lnk]
path=C:\Documents and Settings\Morgane\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.1.lnk
backup=C:\WINDOWS\pss\OpenOffice.org 2.1.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
--a------ 2004-06-29 17:06 88363 C:\WINDOWS\AGRSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
--a------ 2005-06-08 13:44 196608 C:\Program Files\Logitech\Video\ManifestEngine.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
--a------ 2005-06-08 14:24 458752 C:\Program Files\Logitech\Video\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Okay clock]
C:\DOCUME~1\Morgane\APPLIC~1\PLANTEST\FragComp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-03-31 11:05 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
--a------ 2004-12-10 20:33 868352 C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SsAAD.exe]
--a------ 2006-05-08 04:17 81920 C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
C:\Program Files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WooCnxMon]
C:\PROGRA~1\Wanadoo\CnxMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOKIT]
C:\Program Files\Wanadoo\Shell.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON]
C:\PROGRA~1\Wanadoo\TaskbarIcon.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\age2_x1.icd"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\WINDOWS\\system32\\rtcshare.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Securitoo\\av_fw\\backweb\\6588780\\Program\\fspex.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\WINDOWS\\system32\\mmc.exe"=
"C:\\WINDOWS\\system32\\mcoinstall.exe"=
"C:\\Program Files\\Ankama Games\\Dofus\\Dofus.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=

R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-11-18 16:04]
R2 BackWeb Plug-in - 6588780;Antivirus Firewall;C:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXE [2006-11-12 10:32]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Securitoo\av_fw\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 16:14]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Securitoo\av_fw\Anti-Virus\Win2K\FSgk.sys [2008-03-28 19:21]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Securitoo\av_fw\Anti-Virus\Win2K\FSrec.sys [2004-06-01 10:03]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
S0 Cdr4vsd;Cdr4vsd;C:\WINDOWS\system32\drivers\Cdr4vsd.sys [2005-04-29 16:10]
S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys [2002-10-15 21:41]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-03-29 00:03:40 C:\WINDOWS\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\SECURI~1\av_fw\ANTI-V~1\fsav.exe` /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\SECURI~1\av_fw\ANTI-V~1\report.txt $C:\PROGRA~1\SECURI~1\av_fw\ANTI-V~1.SYSTEM'Tƒche ajout‚e par F-Secure Anti-Virus.
"2008-02-28 15:59:00 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2007-09-01 14:48:13 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-29 10:20:13
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXE
C:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exe
C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
C:\Program Files\Securitoo\av_fw\Common\FSMB32.EXE
C:\Program Files\Securitoo\av_fw\Common\FCH32.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXE
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsqh.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsrw.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exe
C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\SECURI~1\av_fw\ANTI-S~1\fsaw.exe
C:\Program Files\Securitoo\av_fw\FSGUI\fsguidll.exe
C:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-03-29 10:24:09 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-29 09:24:06
ComboFix2.txt 2008-03-29 09:09:37
ComboFix3.txt 2008-03-29 08:36:34
ComboFix4.txt 2008-03-29 08:02:01
Pre-Run: 64,413,569,024 octets libres
Post-Run: 64,398,131,200 octets libres
.
2008-03-12 19:05:33 --- E O F ---

@domiet le rapport hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:29:04, on 29/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXE
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXE
C:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exe
C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
C:\Program Files\Securitoo\av_fw\Common\FSMB32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Securitoo\av_fw\Common\FCH32.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXE
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsqh.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsrw.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exe
C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exe
C:\WINDOWS\system32\wscntfy.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\keyhook.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE
C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe
C:\WINDOWS\ALCWZRD.EXE
C:\PROGRA~1\SECURI~1\av_fw\ANTI-S~1\fsaw.exe
C:\Program Files\Securitoo\av_fw\FSGUI\fsguidll.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://outlook.live.com/owa/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll (file missing)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll (file missing)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Securitoo\av_fw\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [KiweeHook] "C:\Program Files\Kiwee Toolbar2\1.2.116\kwtbaim.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exe
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\Securitoo\av_fw\Anti-Spyware\blockpopups.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\av_fw\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\av_fw\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://ak.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1102274155218
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://drivers1.free.fr/telecharger.php?id=2&version=
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game04.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe

Combofix prépare son rapport

Et j'ai un autre problème ... mon écran s'éteint par intermittence ... je suis obligé de fonctionner en mode VGA et cela ne marche pas toujours .... je pensais que c'était un problème de carte graphique et m'apprêtais à la changer ... mais je crois que cela est apparu lorsque j'ai attrapé le virus msn (ta photo ...) .... je l'ai traité avec MSNFIX et SD FIX ...

le pc redémarre mais qand combofix s'est lancé il a dit qu'il ne trouvait pas chemin spécifié

J'ai relancé combofix avait le même fichier que la fois dernière

Je crois que le problème vient du fait que je n'avais pas arrêté F-Secure.

Je recommence alors ?

@dodoDodo c'est domi ... c'est parce que j'ai répondu de mon pc portable ... c'est plus facile de traiter le fixe pendant ce temps là

Voici lme rapport combo

ComboFix 08-03-27.3 - HP_Propriétaire 2008-03-29 9:27:53.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.582 [GMT 1:00]
Endroit: C:\Documents and Settings\HP_Propriétaire\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\HP_Propri‚taire\Bureau\CFScript.txt
* Création d'un nouveau point de restauration
* Resident AV is active

.

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-02-28 to 2008-03-29 ))))))))))))))))))))))))))))))))))))
.

2008-03-29 09:02 . <REP> C:\Documents and Settings\HP_PropriÚtaire\Local Settings
2008-03-29 09:02 . <REP> C:\Documents and Settings\HP_PropriÚtaire\Local Settings
2008-03-29 09:02 . <REP> C:\Documents and Settings\Franþoise\Local Settings
2008-03-29 09:02 . <REP> C:\Documents and Settings\Franþoise\Local Settings
2008-03-29 08:22 . 2008-03-29 08:22 <REP> d-------- C:\_OTMoveIt
2008-03-29 08:18 . 2008-03-29 08:18 <REP> d-------- C:\Program Files\AxBx
2008-03-28 20:13 . 2008-03-28 20:13 <REP> d-------- C:\WINDOWS\ERUNT
2008-03-28 20:11 . 2004-01-01 17:45 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS
2008-03-28 20:11 . 2004-01-01 14:59 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-03-28 20:11 . 2004-01-01 14:59 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-03-28 20:11 . 2004-11-09 16:20 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-03-28 20:11 . 2004-11-09 16:19 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2008-03-28 20:11 . 2004-11-09 16:19 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-03-28 20:11 . 2004-11-25 21:37 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2008-03-28 20:11 . 2008-03-28 20:16 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-03-28 20:11 . 2004-01-01 21:04 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec
2008-03-28 20:11 . 2004-01-01 18:12 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\SampleView
2008-03-28 20:11 . 2004-01-01 17:36 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Intervideo
2008-03-28 20:11 . 2004-01-01 17:45 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Apple Computer
2008-03-16 17:34 . 2004-11-24 21:10 516,096 --------- C:\WINDOWS\system32\ati2sgag.exe
2008-03-02 21:46 . 2008-03-02 21:46 <REP> d-------- C:\Program Files\Fichiers communs\Oberon Media
2008-03-02 10:51 . 2008-03-02 10:51 <REP> d-------- C:\Documents and Settings\Morgane\Application Data\GetRightToGo

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-16 16:33 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-16 10:32 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-15 19:37 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-15 18:14 --------- d-----w C:\Documents and Settings\Morgane\Application Data\OpenOffice.org2
2008-03-15 14:32 --------- d-----w C:\Documents and Settings\Corentin\Application Data\OpenOffice.org2
2008-03-11 19:09 14,496 ----a-w C:\Documents and Settings\Morgane\Application Data\wklnhst.dat
2008-03-11 18:55 --------- d-----w C:\Documents and Settings\Morgane\Application Data\F-Secure
2008-03-05 12:33 --------- d-----w C:\Program Files\Dofus
2008-03-02 20:47 --------- d-----w C:\Program Files\GamesBar
2008-03-02 20:46 --------- d-----w C:\Program Files\Gamenext
2008-02-29 09:51 9,658 ----a-w C:\Documents and Settings\Corentin\Application Data\wklnhst.dat
2008-02-27 19:01 --------- d-----w C:\Program Files\Windows Live
2008-02-26 12:36 --------- d-----w C:\Program Files\Ankama Games
2008-02-25 20:05 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-02-25 20:01 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-02-25 19:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-24 16:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kiwee Toolbar2
2008-02-15 17:26 71,088 ----a-w C:\Documents and Settings\Morgane\Application Data\GDIPFONTCACHEV1.DAT
2008-02-13 19:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-10 20:55 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-05 20:11 --------- d-----w C:\Program Files\Fichiers communs\English+
2008-02-05 20:10 --------- d-----w C:\Program Files\emme
2008-02-04 16:33 --------- d-----w C:\Program Files\Kiwee Toolbar2
2008-02-01 10:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2007-06-28 12:36 401,720 ----a-w C:\Program Files\HijackThis.exe
2007-02-08 15:12 69,112 ----a-w C:\Documents and Settings\Corentin\Application Data\GDIPFONTCACHEV1.DAT
2006-05-06 15:32 284 ----a-w C:\Documents and Settings\Morgane\Application Data\ViewerApp.dat
2004-12-18 20:47 0 --sha-w C:\WINDOWS\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}]
C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"= "C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll" [ ]

[HKEY_CLASSES_ROOT\clsid\{6638a9de-0745-4292-8a2e-ae530e7b9b3f}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{259EEB17-79AA-44DF-8410-8E55F82A902A}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"= C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll [ ]

[HKEY_CLASSES_ROOT\clsid\{6638a9de-0745-4292-8a2e-ae530e7b9b3f}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{259EEB17-79AA-44DF-8410-8E55F82A902A}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 11:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 16:04 52736]
"HPHUPD06"="c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 18:53 49152]
"HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [2004-06-07 18:43 659456]
"KBD"="C:\HP\KBD\KBD.EXE" [2003-02-11 20:02 61440]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 20:43 233472]
"VTTimer"="VTTimer.exe" []
"SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2004-05-20 09:47 249856]
"SoundMan"="SOUNDMAN.EXE" [2004-07-01 18:58 73728 C:\WINDOWS\SOUNDMAN.EXE]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 15:18 241664]
"F-Secure Manager"="C:\Program Files\Securitoo\av_fw\Common\FSM32.exe" [2005-10-26 02:51 122929]
"F-Secure TNB"="C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" [2005-07-18 15:51 700416]
"F-Secure Startup Wizard"="C:\Program Files\Securitoo\av_fw\FSGUI\FSSW.exe" [2005-10-18 09:29 372736]
"News Service"="C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe" [2005-05-31 13:45 356352]
"AlcWzrd"="ALCWZRD.EXE" [2004-07-06 01:05 2550272 C:\WINDOWS\ALCWZRD.EXE]
"KiweeHook"="C:\Program Files\Kiwee Toolbar2\1.2.116\kwtbaim.exe" [ ]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-24 21:10 344064]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 15:38 39264]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Morgane^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.1.lnk]
path=C:\Documents and Settings\Morgane\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.1.lnk
backup=C:\WINDOWS\pss\OpenOffice.org 2.1.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
--a------ 2004-06-29 17:06 88363 C:\WINDOWS\AGRSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
--a------ 2005-06-08 13:44 196608 C:\Program Files\Logitech\Video\ManifestEngine.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
--a------ 2005-06-08 14:24 458752 C:\Program Files\Logitech\Video\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Okay clock]
C:\DOCUME~1\Morgane\APPLIC~1\PLANTEST\FragComp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-03-31 11:05 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
--a------ 2004-12-10 20:33 868352 C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SsAAD.exe]
--a------ 2006-05-08 04:17 81920 C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
C:\Program Files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WooCnxMon]
C:\PROGRA~1\Wanadoo\CnxMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOKIT]
C:\Program Files\Wanadoo\Shell.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON]
C:\PROGRA~1\Wanadoo\TaskbarIcon.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\age2_x1.icd"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\WINDOWS\\system32\\rtcshare.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Securitoo\\av_fw\\backweb\\6588780\\Program\\fspex.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\WINDOWS\\system32\\mmc.exe"=
"C:\\WINDOWS\\system32\\mcoinstall.exe"=
"C:\\Program Files\\Ankama Games\\Dofus\\Dofus.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=

R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-11-18 16:04]
R2 BackWeb Plug-in - 6588780;Antivirus Firewall;C:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXE [2006-11-12 10:32]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Securitoo\av_fw\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 16:14]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Securitoo\av_fw\Anti-Virus\Win2K\FSgk.sys [2008-03-28 19:21]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Securitoo\av_fw\Anti-Virus\Win2K\FSrec.sys [2004-06-01 10:03]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
S0 Cdr4vsd;Cdr4vsd;C:\WINDOWS\system32\drivers\Cdr4vsd.sys [2005-04-29 16:10]
S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys [2002-10-15 21:41]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-03-29 00:03:40 C:\WINDOWS\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\SECURI~1\av_fw\ANTI-V~1\fsav.exe` /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\SECURI~1\av_fw\ANTI-V~1\report.txt $C:\PROGRA~1\SECURI~1\av_fw\ANTI-V~1.SYSTEM'Tƒche ajout‚e par F-Secure Anti-Virus.
"2008-02-28 15:59:00 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2007-09-01 14:48:13 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-29 09:32:44
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
C:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXE
C:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exe
C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
C:\Program Files\Securitoo\av_fw\Common\FSMB32.EXE
C:\Program Files\Securitoo\av_fw\Common\FCH32.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsqh.exe
C:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXE
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsrw.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exe
C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\SECURI~1\av_fw\ANTI-S~1\fsaw.exe
C:\Program Files\Securitoo\av_fw\FSGUI\fsguidll.exe
C:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-03-29 9:36:33 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-29 08:36:30
ComboFix2.txt 2008-03-29 08:02:01
Pre-Run: 64,493,260,800 octets libres
Post-Run: 64,477,794,304 octets libres
.
2008-03-12 19:05:33 --- E O F ---

@domiEt le rapport hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:42:01, on 29/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXE
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
C:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXE
C:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exe
C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
C:\Program Files\Securitoo\av_fw\Common\FSMB32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Securitoo\av_fw\Common\FCH32.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsqh.exe
C:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXE
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsrw.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exe
C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exe
C:\WINDOWS\system32\wscntfy.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\keyhook.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE
C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe
C:\WINDOWS\ALCWZRD.EXE
C:\PROGRA~1\SECURI~1\av_fw\ANTI-S~1\fsaw.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Securitoo\av_fw\FSGUI\fsguidll.exe
C:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://outlook.live.com/owa/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll (file missing)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll (file missing)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Securitoo\av_fw\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [KiweeHook] "C:\Program Files\Kiwee Toolbar2\1.2.116\kwtbaim.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exe
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\Securitoo\av_fw\Anti-Spyware\blockpopups.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\av_fw\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\av_fw\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://ak.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1102274155218
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://drivers1.free.fr/telecharger.php?id=2&version=
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game04.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe

voici le rapport

ComboFix 08-03-27.3 - HP_Propriétaire 2008-03-29 8:50:14.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.676 [GMT 1:00]
Endroit: C:\Documents and Settings\HP_Propriétaire\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
.
TimedOut: Windir.dat

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_npf

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-02-28 to 2008-03-29 ))))))))))))))))))))))))))))))))))))
.

2008-03-29 08:22 . 2008-03-29 08:22 <REP> d-------- C:\_OTMoveIt
2008-03-29 08:18 . 2008-03-29 08:18 <REP> d-------- C:\Program Files\AxBx
2008-03-28 20:13 . 2008-03-28 20:13 <REP> d-------- C:\WINDOWS\ERUNT
2008-03-28 20:11 . 2004-01-01 17:45 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS
2008-03-28 20:11 . 2004-01-01 14:59 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-03-28 20:11 . 2004-01-01 14:59 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-03-28 20:11 . 2004-11-09 16:20 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-03-28 20:11 . 2004-11-09 16:19 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2008-03-28 20:11 . 2004-11-09 16:19 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-03-28 20:11 . 2004-11-25 21:37 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2008-03-28 20:11 . 2008-03-28 20:16 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-03-28 20:11 . 2004-01-01 21:04 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec
2008-03-28 20:11 . 2004-01-01 18:12 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\SampleView
2008-03-28 20:11 . 2004-01-01 17:36 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Intervideo
2008-03-28 20:11 . 2004-01-01 17:45 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Apple Computer
2008-03-16 17:34 . 2004-11-24 21:10 516,096 --------- C:\WINDOWS\system32\ati2sgag.exe
2008-03-02 21:46 . 2008-03-02 21:46 <REP> d-------- C:\Program Files\Fichiers communs\Oberon Media
2008-03-02 10:51 . 2008-03-02 10:51 <REP> d-------- C:\Documents and Settings\Morgane\Application Data\GetRightToGo

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-16 16:33 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-16 10:32 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-15 19:37 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-15 18:14 --------- d-----w C:\Documents and Settings\Morgane\Application Data\OpenOffice.org2
2008-03-15 14:32 --------- d-----w C:\Documents and Settings\Corentin\Application Data\OpenOffice.org2
2008-03-11 19:09 14,496 ----a-w C:\Documents and Settings\Morgane\Application Data\wklnhst.dat
2008-03-11 18:55 --------- d-----w C:\Documents and Settings\Morgane\Application Data\F-Secure
2008-03-05 12:33 --------- d-----w C:\Program Files\Dofus
2008-03-02 20:47 --------- d-----w C:\Program Files\GamesBar
2008-03-02 20:46 --------- d-----w C:\Program Files\Gamenext
2008-02-29 09:51 9,658 ----a-w C:\Documents and Settings\Corentin\Application Data\wklnhst.dat
2008-02-27 19:01 --------- d-----w C:\Program Files\Windows Live
2008-02-26 12:36 --------- d-----w C:\Program Files\Ankama Games
2008-02-25 20:05 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-02-25 20:01 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-02-25 19:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-24 16:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kiwee Toolbar2
2008-02-15 17:26 71,088 ----a-w C:\Documents and Settings\Morgane\Application Data\GDIPFONTCACHEV1.DAT
2008-02-13 19:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-10 20:55 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-05 20:11 --------- d-----w C:\Program Files\Fichiers communs\English+
2008-02-05 20:10 --------- d-----w C:\Program Files\emme
2008-02-04 16:33 --------- d-----w C:\Program Files\Kiwee Toolbar2
2008-02-01 10:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2007-06-28 12:36 401,720 ----a-w C:\Program Files\HijackThis.exe
2007-02-08 15:12 69,112 ----a-w C:\Documents and Settings\Corentin\Application Data\GDIPFONTCACHEV1.DAT
2006-05-06 15:32 284 ----a-w C:\Documents and Settings\Morgane\Application Data\ViewerApp.dat
2004-12-18 20:47 0 --sha-w C:\WINDOWS\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}]
C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"= "C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll" [ ]

[HKEY_CLASSES_ROOT\clsid\{6638a9de-0745-4292-8a2e-ae530e7b9b3f}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{259EEB17-79AA-44DF-8410-8E55F82A902A}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"= C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll [ ]

[HKEY_CLASSES_ROOT\clsid\{6638a9de-0745-4292-8a2e-ae530e7b9b3f}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{259EEB17-79AA-44DF-8410-8E55F82A902A}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 11:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 16:04 52736]
"HPHUPD06"="c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 18:53 49152]
"HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [2004-06-07 18:43 659456]
"KBD"="C:\HP\KBD\KBD.EXE" [2003-02-11 20:02 61440]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 20:43 233472]
"VTTimer"="VTTimer.exe" []
"SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2004-05-20 09:47 249856]
"SoundMan"="SOUNDMAN.EXE" [2004-07-01 18:58 73728 C:\WINDOWS\SOUNDMAN.EXE]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 15:18 241664]
"F-Secure Manager"="C:\Program Files\Securitoo\av_fw\Common\FSM32.exe" [2005-10-26 02:51 122929]
"F-Secure TNB"="C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" [2005-07-18 15:51 700416]
"F-Secure Startup Wizard"="C:\Program Files\Securitoo\av_fw\FSGUI\FSSW.exe" [2005-10-18 09:29 372736]
"News Service"="C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe" [2005-05-31 13:45 356352]
"AlcWzrd"="ALCWZRD.EXE" [2004-07-06 01:05 2550272 C:\WINDOWS\ALCWZRD.EXE]
"KiweeHook"="C:\Program Files\Kiwee Toolbar2\1.2.116\kwtbaim.exe" [ ]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-24 21:10 344064]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 15:38 39264]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Morgane^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.1.lnk]
path=C:\Documents and Settings\Morgane\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.1.lnk
backup=C:\WINDOWS\pss\OpenOffice.org 2.1.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
--a------ 2004-06-29 17:06 88363 C:\WINDOWS\AGRSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
--a------ 2005-06-08 13:44 196608 C:\Program Files\Logitech\Video\ManifestEngine.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
--a------ 2005-06-08 14:24 458752 C:\Program Files\Logitech\Video\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Okay clock]
C:\DOCUME~1\Morgane\APPLIC~1\PLANTEST\FragComp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-03-31 11:05 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
--a------ 2004-12-10 20:33 868352 C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SsAAD.exe]
--a------ 2006-05-08 04:17 81920 C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
C:\Program Files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WooCnxMon]
C:\PROGRA~1\Wanadoo\CnxMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOKIT]
C:\Program Files\Wanadoo\Shell.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON]
C:\PROGRA~1\Wanadoo\TaskbarIcon.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\age2_x1.icd"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\WINDOWS\\system32\\rtcshare.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Securitoo\\av_fw\\backweb\\6588780\\Program\\fspex.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\WINDOWS\\system32\\mmc.exe"=
"C:\\WINDOWS\\system32\\mcoinstall.exe"=
"C:\\Program Files\\Ankama Games\\Dofus\\Dofus.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=

R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-11-18 16:04]
R2 BackWeb Plug-in - 6588780;Antivirus Firewall;C:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXE [2006-11-12 10:32]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Securitoo\av_fw\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 16:14]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Securitoo\av_fw\Anti-Virus\Win2K\FSgk.sys [2008-03-28 19:21]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Securitoo\av_fw\Anti-Virus\Win2K\FSrec.sys [2004-06-01 10:03]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
S0 Cdr4vsd;Cdr4vsd;C:\WINDOWS\system32\drivers\Cdr4vsd.sys [2005-04-29 16:10]
S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys [2002-10-15 21:41]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-03-29 00:03:40 C:\WINDOWS\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\SECURI~1\av_fw\ANTI-V~1\fsav.exe` /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\SECURI~1\av_fw\ANTI-V~1\report.txt $C:\PROGRA~1\SECURI~1\av_fw\ANTI-V~1.SYSTEM'Tƒche ajout‚e par F-Secure Anti-Virus.
"2008-02-28 15:59:00 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2007-09-01 14:48:13 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-29 08:58:23
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXE
C:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exe
C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
C:\Program Files\Securitoo\av_fw\Common\FSMB32.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Securitoo\av_fw\Common\FCH32.EXE
C:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXE
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsqh.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsrw.exe
C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\SECURI~1\av_fw\ANTI-S~1\fsaw.exe
C:\Program Files\Securitoo\av_fw\FSGUI\fsguidll.exe
C:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-03-29 9:02:00 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-29 08:01:57
Pre-Run: 64,643,973,120 octets libres
Post-Run: 64,520,675,328 octets libres
.
2008-03-12 19:05:33 --- E O F ---

c'est tres tres tres tres clair ....... merci

Voici le rapport F secure ... et j'ai bien redémarré.

Rapport d'analyse
vendredi 28 mars 2008 21:44:33 - 02:39:20
Nom de l'ordinateur : BIDULE
Type d'analyse : Effectuer une analyse complète de l'ordinateur
Cible : C:\ D:\ + registre système + rootkits

Résultat : 3 antiprogramme(s) détecté(s)
Backdoor.Win32.IRCBot.bal (virus)
• C:\RECYCLER\S-1-5-21-3606903490-3660578231-963331933-1009\Dc24.zip\files1.scr
• C:\RECYCLER\S-1-5-21-3606903490-3660578231-963331933-1009\Dc24.zip Action : supprimé
Trojan-Dropper.Win32.Agent.frl (virus)
• C:\RECYCLER\S-1-5-21-3606903490-3660578231-963331933-1009\DC237.0OM Action : supprimé

Statistiques
Analysés :
• Fichiers : 1009716
• Registre système : 5608
• Non analysés : 104
Résultat :
• Virus : 3
• Logiciel espion : 0
• Eléments suspects: 0
Actions :
• Désinfectés : 0
• Renommés : 0
• Supprimés : 2
• Quarantaine : 0
• Echec : 0
Secteurs d'amorçage :
• Analysés : 1
• Infectés : 0
• Eléments suspects: 0
• Désinfectés : 0
Fichiers non analysés :
• Erreur d'ouverture du fichier C:\hiberfil.sys.
• Erreur d'ouverture du fichier C:\pagefile.sys.
• Impossible d'ouvrir le fichier dans l'archive C:\WINDOWS\system32\bios1.rom.
• Erreur d'ouverture du fichier C:\WINDOWS\system32\config\default.
• Erreur d'ouverture du fichier C:\WINDOWS\system32\config\SAM.
• Erreur d'ouverture du fichier C:\WINDOWS\system32\config\SECURITY.
• Erreur d'ouverture du fichier C:\WINDOWS\system32\config\system.
• Impossible d'ouvrir le fichier dans l'archive C:\WINDOWS\Installer\MSI280.tmp.
• Impossible d'ouvrir le fichier dans l'archive C:\WINDOWS\I386\BIOS1.RO_.
• L'analyse de C:\RECYCLER\S-1-5-21-3606903490-3660578231-963331933-1010\Dc8.exe a été interrompue. [F-Secure AVP]
• L'analyse de C:\RECYCLER\S-1-5-21-3606903490-3660578231-963331933-1009\Dc222.exe a été interrompue. [F-Secure AVP]
• L'analyse de C:\RECYCLER\S-1-5-21-3606903490-3660578231-963331933-1009\Dc231.exe a été interrompue. [F-Secure AVP]
• Impossible d'ouvrir le fichier dans l'archive C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\RamCheck.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\toc.dat.
• Erreur d'ouverture du fichier C:\Program Files\Securitoo\av_fw\Common\admin.pub.
• Erreur d'ouverture du fichier C:\Program Files\Securitoo\av_fw\Common\policy.ipf.
• Erreur d'ouverture du fichier C:\Program Files\Securitoo\av_fw\backweb\6588780\Users\Default\Data\chandir.dat.
• Erreur d'ouverture du fichier C:\Program Files\Securitoo\av_fw\backweb\6588780\Users\Default\Data\L0000001.FCS.
• Erreur d'ouverture du fichier C:\Program Files\Securitoo\av_fw\backweb\6588780\Users\Default\Data\prs.dat.
• Erreur d'ouverture du fichier C:\Program Files\Securitoo\av_fw\backweb\6588780\Users\Default\Data\storydb.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Program Files\PIXELA\ImageMixer\RamCheck.dat.
• L'analyse de C:\Program Files\Microsoft Games\Zoo Tycoon\animals.ztd a été interrompue. [F-Secure AVP]
• L'analyse de C:\Program Files\Microsoft Games\Zoo Tycoon\ztatb00.ztd a été interrompue. [F-Secure AVP]
• L'analyse de C:\Program Files\Microsoft Games\Zoo Tycoon\ztatb02.ztd a été interrompue. [F-Secure AVP]
• L'analyse de C:\Program Files\Microsoft Games\Zoo Tycoon\ztatb03.ztd a été interrompue. [F-Secure AVP]
• L'analyse de C:\Program Files\Microsoft Games\Zoo Tycoon\ztatb04.ztd a été interrompue. [F-Secure AVP]
• L'analyse de C:\Program Files\Microsoft Games\Zoo Tycoon\ztatb05.ztd a été interrompue. [F-Secure AVP]
• L'analyse de C:\Program Files\Microsoft Games\Zoo Tycoon\ztatb06.ztd a été interrompue. [F-Secure AVP]
• L'analyse de C:\Program Files\Microsoft Games\Zoo Tycoon\XPACK2\animals9.ztd a été interrompue. [F-Secure AVP]
• L'analyse de C:\Program Files\Microsoft Games\Zoo Tycoon\XPACK1\animals5.ztd a été interrompue. [F-Secure AVP]
• Impossible d'ouvrir le fichier dans l'archive C:\Program Files\Infogrames\RollerCoaster Tycoon 2\Data\hang.dat.
• L'analyse de C:\Program Files\Ankama Games\Dofus\Dofus.jar a été interrompue. [F-Secure AVP]
• Impossible d'ouvrir le fichier dans l'archive C:\Program Files\Ankama Games\Dofus\.torrent\Dofus_v1.jar.
• Impossible d'ouvrir le fichier dans l'archive C:\hp\drivers\printers\deskjet\program files\Hewlett-Packard\hp deskjet assistant\5600\sample1.pcl.
• Impossible d'ouvrir le fichier dans l'archive C:\hp\drivers\printers\deskjet\program files\Hewlett-Packard\hp deskjet assistant\5100\sample1.pcl.
• L'analyse de C:\hp\drivers\hpiz402\setup\PhotoGallery\PhotoGallery.cab a été interrompue. [F-Secure AVP]
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users.LOG.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\Default User.LOG.
• Erreur d'ouverture du fichier C:\Documents and Settings\NetworkService\NTUSER.DAT.
• Erreur d'ouverture du fichier C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.
• L'analyse de C:\Documents and Settings\Morgane\Mes documents\DofusInstaller_v1_15_2.exe a été interrompue. [F-Secure AVP]
• L'analyse de C:\Documents and Settings\Morgane\Mes documents\DofusInstaller_v1_15_4.exe a été interrompue. [F-Secure AVP]
• L'analyse de C:\Documents and Settings\Morgane\Mes documents\DofusInstaller_v1_16_2.exe a été interrompue. [F-Secure AVP]
• L'analyse de C:\Documents and Settings\Morgane\Mes documents\DofusInstaller_v1_17_0.exe a été interrompue. [F-Secure AVP]
• Le fichier C:\Documents and Settings\Morgane\Local Settings\Application Data\Microsoft\Messenger\morgui1256@hotmail.fr\ObjectStore\Backgrounds\+vLvEybekHm4NdZv6YI3IK1T3GY=.id2\+vLvEybekHm4NdZv6YI3IK1T3GY= est crypté.
• Erreur d'ouverture du fichier C:\Documents and Settings\LocalService\NTUSER.DAT.
• Erreur d'ouverture du fichier C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.
• Erreur d'ouverture du fichier C:\Documents and Settings\HP_Propriétaire\NTUSER.DAT.
• Erreur d'ouverture du fichier C:\Documents and Settings\HP_Propriétaire\Mes documents\dominique.kervadec\CAF5VZ6O..
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\HP_Propriétaire\Local Settings\Application Data\Mozilla\Firefox\Profiles\kva3r783.default\Cache\_CACHE_001_.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\HP_Propriétaire\Local Settings\Application Data\Mozilla\Firefox\Profiles\kva3r783.default\Cache\_CACHE_002_.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\HP_Propriétaire\Local Settings\Application Data\Mozilla\Firefox\Profiles\kva3r783.default\Cache\_CACHE_003_.
• Erreur d'ouverture du fichier C:\Documents and Settings\HP_Propriétaire\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.
• Erreur d'ouverture du fichier C:\Documents and Settings\HP_Propriétaire\Local Settings\Application Data\Kiwee Toolbar2\Logs\KiweeHook.log.
• Erreur d'ouverture du fichier C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\kva3r783.default\parent.lock.
• Erreur d'ouverture du fichier C:\Documents and Settings\HP_Propriétaire\Application Data\ispnews\ispn.ini.
• L'analyse de C:\Documents and Settings\Corentin\Bureau\DofusInstaller_v1_20_0.exe a été interrompue. [F-Secure AVP]
• L'analyse de C:\Documents and Settings\Corentin\Bureau\DofusInstaller_v1_22_0.exe a été interrompue. [F-Secure AVP]
• Le fichier C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CometCursors.zip\sbRecovery.reg est crypté.
• Le fichier C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\FunWebProducts.zip\sbRecovery.reg est crypté.
• Le fichier C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\FunWebProducts1.zip\sbRecovery.reg est crypté.
• Le fichier C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MicrosoftWindowsSecurityCenterAntiVirusOverride.zip\sbRecovery.reg est crypté.
• Le fichier C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MicrosoftWindowsSecurityCenterFirewallDisableNotify.zip\sbRecovery.reg est crypté.
• Le fichier C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch.zip\sbRecovery.reg est crypté.
• Le fichier C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch1.zip\sbRecovery.reg est crypté.
• Le fichier C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch2.zip\sbRecovery.reg est crypté.
• Le fichier C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch3.zip\sbRecovery.reg est crypté.
• Le fichier C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch4.zip\sbRecovery.reg est crypté.
• Le fichier C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MyWebSearch.zip\sbRecovery.reg est crypté.
• Le fichier C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MyWebSearch1.zip\sbRecovery.reg est crypté.
• Le fichier C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde.zip\sbRecovery.reg est crypté.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Microsoft\WIA\{6BDD1FC6-810F-11D0-BEC7-08002BE2092F}\0005\Image 108.jpg.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#226483448C40.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#2438F7B88872.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#257CA131705F.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#2A44AB5491EC.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#2D5C566C60E6.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#2E34E1E73BD6.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#3050E9817E6C.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#30982509036A.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#34886114902E.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#35A8AA008859.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#395067BA3D93.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#397408AD05F4.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#3B00238A0459.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#3C448F463342.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#3CF83355FC37.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#417C462093A1.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#419C326DAAA1.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#456883859955.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#4C289CD6BFB0.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#5840C31B0BF0.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#5E4C8A0E6F9F.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#5E4CF3560E46.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#5FB4D4366F03.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#647C233BE52E.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#64E8188705A3.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#67B895403D5A.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#69F8D907C185.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#6BF0E52DE0E0.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#716C79918B8B.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#71FC27DCE2F4.dat.
• Impossible d'ouvrir le fichier dans l'archive C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\#7484A7F6B66E.dat.
• Impossible d'ouvrir le fichier dans l'archive D:\I386\BIOS1.RO_.

Options
Version des définitions :
• Virus : 2008-03-28_07
• Logiciel espion : 2008-02-14_04
Moteurs d'analyse :
• F-Secure AVP: 6.00.169, 2008-03-28
• F-Secure Libra: 2.04.04, 2008-03-28
• F-Secure Orion: 1.02.37, 2008-03-28
• F-Secure Draco: 1.00.35, 2008-02-13
• F-Secure BlackLight: 1.00.23
Options d'analyse :
• Analyser tous les fichiers
• Analyser le contenu des archives
Actions :
• Virus : Interroger l'utilisateur après l'analyse
• Logiciel espion : Interroger l'utilisateur après l'analyse

Copyright © 1998-2005 Assistance produit | Envoi d'un échantillon de virus à F-Secure
F-Secure n'assume aucune responsabilité quant au matériel créé ou publié par une tierce partie et référencé par un lien dans les pages Web de F-Secure. Sauf mention contraire explicite, vous acceptez qu'en soumettant du matériel sur l'un de nos serveurs, par exemple via courrier électronique ou formulaire CGI de F-Secure, le matériel mis à disposition peut dès lors être publié sur les pages Web de F-Secure ou sur support papier. Vous accéderez au site web public de F-Secure en cliquant sur les liens soulignés. Ainsi, votre accès est enregistré dans nos statistiques privées avec votre nom de domaine. Ces informations ne sont communiquées à aucune tierce partie. Vous vous engagez à ne pas intenter de procédure judiciaire contre notre société en relation avec le matériel soumis. Sauf mention contraire explicite, F-Secure peut inclure dans ses propres produits/publications tout concept relatif au matériel mis à sa disposition, sans aucun engagement de responsabilité.

Et le nouveau rapport hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:37:50, on 29/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXE
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXE
C:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exe
C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
C:\Program Files\Securitoo\av_fw\Common\FSMB32.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Securitoo\av_fw\Common\FCH32.EXE
C:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXE
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsqh.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsrw.exe
C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\keyhook.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE
C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\ALCMTR.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\SECURI~1\av_fw\ANTI-S~1\fsaw.exe
C:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exe
C:\Program Files\Securitoo\av_fw\FSGUI\fsguidll.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://outlook.live.com/owa/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll (file missing)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll (file missing)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Securitoo\av_fw\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [KiweeHook] "C:\Program Files\Kiwee Toolbar2\1.2.116\kwtbaim.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exe
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\Securitoo\av_fw\Anti-Spyware\blockpopups.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\av_fw\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\av_fw\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://ak.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1102274155218
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://drivers1.free.fr/telecharger.php?id=2&version=
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game04.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe