BPS Spyware inefficace

Laeti77144 -  
Bonjour,

J'ai téléchargé la version light de BPS Spyware, puis j'ai acheté la licence pour avoir la version complète.

Quand je fais une analyse profonde du système, il détecte 341 "infected regitry items" et 112 "infeted files/folders", je fais toujours par défaut, et il "enlève" tous les fichiers... Je vide la poubelle, mais quand 2 min. après je refais le scan, j'ai exactement le même résultat !

Pourquoi svp ?
Merci
Bonne journée.
Configuration: Windows Vista
Internet Explorer 7.0

20 réponses

  2. Laeti77144
    C'est impeccable ça fonctionne avec Avast !

    Merci de votre aide !
    Bon week end !
    2. Laeti77144
      Antivir ne se met pas à jour.
      J'ai beau cliquer sur update, rien ne se fait...
      Et quelque fois mon PC bugsur certains sites internet, je ne peux plus rien faire, ni fermer la page, ni actualiser... Je pensais que c'était à cause d'un virus mais apparemment non.

      Peut être devrai ja changer d'antivirus, ou peut etre me manque t'il un logiciel...
      3. Laeti77144
        Bitdefender répond "impossible d'analyser"
        Kaspersky : Pas de logiciel malveillant détecté. Les sections analysées sont SAINES.
        1. jlpjlp Contributeur sécurité
          c'est quoi qui marche pas? antivir?

          colle le rapport d'un scan en ligne
          avec un des suivants: pour voir si une infection n'empeche pas antivir de marcher!

          bitdefender en ligne :
          http://www.bitdefender.fr/scan_fr/scan8/ie.html

          Panda en ligne :
          http://pandasoftware.fr

          Kaspersky en ligne
          https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

          ________________

          sinon pour reparer windows: http://www.informatruc.com/reparer-windows-xp/
          1. Laeti77144
            Rha là là, ça ne marche pas non plus, mon pc ne veut pas executer sfc /scannow...
            2. Laeti77144
              Bonjour,

              J'ai essayé mais zeb restore n'apparait pas correctement, j'ai juste les case (je les coche toutes) et quand j'appuie sur le bouton ne bas, rien ne se passe...

              Il doit me manquer un logiciel.
              1. jlpjlp Contributeur sécurité
                mets ceci
                MalwareByte's Anti-Malware + SPYBOT

                _______

                repare le registre (coche tout) avec zeb resotre puis remets a jour windows : DEMARRER puis TOUS LES PROGRAMMEs puis WINDOWS UPDATE

                http://telechargement.zebulon.fr/zeb-restore.html
                1. Laeti77144
                  Non toujours pareil, il met : last update : not performed et quand je clique sur start update, il ne se passe rien...

                  Pour les spywares, je dois tous les installer ?

                  Merci
                  2. jlpjlp Contributeur sécurité
                    ok c'est bon:

                    Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked".

                    R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
                    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
                    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)

                    O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)

                    O23 - Service: My Web Search Service (MyWebSearchService) - Unknown owner - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe (file missing)
                    O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)

                    _______

                    encore des soucis????????

                    pour protéger gratos ton ordi

                    http://www.commentcamarche.net/telecharger/logiciel 4 securite

                    mettre un antivirus

                    AVAST en français ou ANTIVIR (en anglais mais très efficace)
                    https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
                    -------------
                    des anti-espions :
                    MalwareByte's Anti-Malware + SPYBOT +/- si tea timer non active de spybot:
                    WINDOWS DEFENDER ou SPYWARE TERMINATOR

                    +
                    SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation : il suffit de faire "update" pour mettre à jour tous les mois et ensuite" enable all protection" pour immuniser)...

                    Rq : spybot a sorti de nouvelles versions cette année vérifiez que vous avez la dernière version
                    --------
                    un pare feu :
                    celui de (Windows) ou mieux Online armor ou KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit)

                    http://www.commentcamarche.net/telecharger/telecharger 34055356 online armor personal firewall

                    https://forum.pcastuces.com/sujet.asp?f=25&s=35606
                    https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
                    https://manuelsdaide.com/contact/
                    http://www.open-files.com/forum/index.php?showtopic=29277
                    http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm

                    -----------
                    CCLEANER pour effacer les traces de surf
                    ---------
                    naviguer avec firefox ou safari ou opera et non internet explorer plus touché par les virus
                    http://www.mozilla-europe.org/fr/products/firefox/
                    1. Laeti77144
                      Merci beaucoup pour cette aide !!!!
                      Heureusement que jai posté ici, grace à vous, je n'ai plus envie de jeter mon PC par la fenêtre !!! lol

                      Par contre, une dernière question, je n'arrive pas à mettre à jour antivir, j'ai beau cliquer sur start update, rien ne se passe...

                      Merci encore.
                  3. Laeti77144
                    Pardon, je n'avais pas compris, voilà le rapport.

                    Merci de ton aide.

                    SmitFraudFix v2.309

                    Scan done at 19:08:52,80, 30/03/2008
                    Run from C:\Downloads\SmitfraudFix
                    OS: Microsoft Windows [version 6.0.6000] - Windows_NT
                    The filesystem type is NTFS
                    Fix run in normal mode

                    »»»»»»»»»»»»»»»»»»»»»»»» Process

                    C:\Windows\system32\csrss.exe
                    C:\Windows\system32\wininit.exe
                    C:\Windows\system32\csrss.exe
                    C:\Windows\system32\services.exe
                    C:\Windows\system32\lsass.exe
                    C:\Windows\system32\lsm.exe
                    C:\Windows\system32\winlogon.exe
                    C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe
                    C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe
                    C:\Windows\system32\svchost.exe
                    C:\Windows\system32\SLsvc.exe
                    C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe
                    C:\Windows\System32\spoolsv.exe
                    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                    C:\Windows\system32\svchost.exe
                    C:\Windows\system32\taskeng.exe
                    C:\Windows\system32\Dwm.exe
                    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                    C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
                    C:\Windows\system32\lxcjcoms.exe
                    C:\Windows\system32\svchost.exe
                    C:\Windows\system32\PSIService.exe
                    C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                    C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
                    C:\Windows\system32\svchost.exe
                    C:\Windows\System32\svchost.exe
                    C:\Windows\system32\SearchIndexer.exe
                    C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
                    C:\Windows\system32\WUDFHost.exe
                    C:\Windows\system32\taskeng.exe
                    C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
                    C:\Windows\RtHDVCpl.exe
                    C:\Windows\System32\rundll32.exe
                    C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
                    C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
                    C:\Program Files\Picasa2\PicasaMediaDetector.exe
                    C:\Program Files\Lexmark 8300 Series\lxcjmon.exe
                    C:\Program Files\Lexmark 8300 Series\ezprint.exe
                    C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
                    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
                    C:\Program Files\iTunes\iTunesHelper.exe
                    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
                    C:\Program Files\Orange\Systray\SystrayApp.exe
                    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
                    C:\Program Files\Windows Sidebar\sidebar.exe
                    C:\Windows\System32\rundll32.exe
                    C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
                    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                    C:\Windows\ehome\ehtray.exe
                    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                    C:\Program Files\WinZip\WZQKPICK.EXE
                    C:\Windows\system32\wbem\wmiprvse.exe
                    C:\Program Files\Orange\Launcher\Launcher.exe
                    C:\Windows\ehome\ehmsas.exe
                    C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
                    C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
                    C:\Program Files\Windows Sidebar\sidebar.exe
                    C:\Program Files\iPod\bin\iPodService.exe
                    C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
                    C:\Program Files\Orange\connectivity\connectivitymanager.exe
                    C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
                    C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
                    C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
                    C:\Windows\system32\conime.exe
                    C:\Windows\explorer.exe
                    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
                    C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
                    C:\Windows\system32\taskeng.exe
                    C:\Program Files\Internet Explorer\IEXPLORE.EXE
                    C:\Windows\servicing\TrustedInstaller.exe
                    C:\Program Files\BitComet\BitComet.exe
                    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                    C:\Windows\system32\cmd.exe
                    C:\Windows\system32\wbem\wmiprvse.exe

                    »»»»»»»»»»»»»»»»»»»»»»»» hosts

                    »»»»»»»»»»»»»»»»»»»»»»»» C:\

                    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows

                    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system

                    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web

                    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32

                    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles

                    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Laetitia et Fr‚d‚ric

                    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Laetitia et Fr‚d‚ric\Application Data

                    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu

                    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\LAETIT~1\FAVORI~1

                    »»»»»»»»»»»»»»»»»»»»»»»» Desktop

                    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

                    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

                    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

                    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
                    !!!Attention, following keys are not inevitably infected!!!

                    IEDFix
                    Credits: Malware Analysis & Diagnostic
                    Code: S!Ri

                    »»»»»»»»»»»»»»»»»»»»»»»» VACFix
                    !!!Attention, following keys are not inevitably infected!!!

                    VACFix
                    Credits: Malware Analysis & Diagnostic
                    Code: S!Ri

                    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
                    !!!Attention, following keys are not inevitably infected!!!

                    SrchSTS.exe by S!Ri
                    Search SharedTaskScheduler's .dll

                    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
                    !!!Attention, following keys are not inevitably infected!!!

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
                    "AppInit_DLLs"=""

                    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
                    !!!Attention, following keys are not inevitably infected!!!

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
                    "Userinit"="C:\\Windows\\system32\\userinit.exe,"
                    "System"=""

                    »»»»»»»»»»»»»»»»»»»»»»»» Rustock

                    »»»»»»»»»»»»»»»»»»»»»»»» DNS

                    Description: Realtek RTL8139/810x Family Fast Ethernet NIC
                    DNS Server Search Order: 192.168.1.1

                    HKLM\SYSTEM\CCS\Services\Tcpip\..\{131814BB-002A-4059-B2AA-82584BED62F8}: DhcpNameServer=192.168.1.1
                    HKLM\SYSTEM\CS1\Services\Tcpip\..\{131814BB-002A-4059-B2AA-82584BED62F8}: DhcpNameServer=192.168.1.1
                    HKLM\SYSTEM\CS3\Services\Tcpip\..\{131814BB-002A-4059-B2AA-82584BED62F8}: DhcpNameServer=192.168.1.1
                    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
                    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
                    HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

                    »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

                    »»»»»»»»»»»»»»»»»»»»»»»» End
                    2. jlpjlp Contributeur sécurité
                      smit fraud fix (colle le rapport)

                      1/ telecharger :

                      http://siri.urz.free.fr/Fix/SmitfraudFix.php

                      2/ double clique sur smitfraudfix. puis sélectionne 1 et appuyer sur entrée afin de créer le rapport des infection présentes.
                      _____________

                      recolle un nouveau rapport hijakchits
                      1. Laeti77144
                        Voilà ce que j'ai :

                        Logfile of HijackThis v1.99.1
                        Scan saved at 18:15:28, on 30/03/2008
                        Platform: Unknown Windows (WinNT 6.00.1904)
                        MSIE: Internet Explorer v7.00 (7.00.6000.16609)

                        Running processes:
                        C:\Windows\system32\taskeng.exe
                        C:\Windows\system32\Dwm.exe
                        C:\Windows\RtHDVCpl.exe
                        C:\Windows\System32\rundll32.exe
                        C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
                        C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
                        C:\Program Files\Picasa2\PicasaMediaDetector.exe
                        C:\Program Files\Lexmark 8300 Series\lxcjmon.exe
                        C:\Program Files\Lexmark 8300 Series\ezprint.exe
                        C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
                        C:\Program Files\Common Files\Real\Update_OB\realsched.exe
                        C:\Program Files\iTunes\iTunesHelper.exe
                        C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
                        C:\Program Files\Orange\Systray\SystrayApp.exe
                        C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
                        C:\Program Files\Windows Sidebar\sidebar.exe
                        C:\Windows\System32\rundll32.exe
                        C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
                        C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                        C:\Windows\ehome\ehtray.exe
                        C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                        C:\Program Files\WinZip\WZQKPICK.EXE
                        C:\Program Files\Orange\Launcher\Launcher.exe
                        C:\Windows\ehome\ehmsas.exe
                        C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
                        C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
                        C:\Program Files\Windows Sidebar\sidebar.exe
                        C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
                        C:\Program Files\Orange\Deskboard\deskboard.exe
                        C:\Program Files\Orange\connectivity\connectivitymanager.exe
                        C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
                        C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
                        C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
                        C:\Windows\system32\conime.exe
                        C:\Windows\explorer.exe
                        C:\Windows\system32\SearchFilterHost.exe
                        C:\Users\Laetitia et Frédéric\Desktop\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                        R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
                        R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                        O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                        O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                        O2 - BHO: BitComet Helper - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll
                        O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                        O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
                        O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
                        O4 - HKLM\..\Run: [Skytel] Skytel.exe
                        O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
                        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
                        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
                        O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
                        O4 - HKLM\..\Run: [MSPService] C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
                        O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
                        O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
                        O4 - HKLM\..\Run: [LXCJCATS] rundll32 C:\Windows\system32\spool\DRIVERS\W32X86\3\LXCJtime.dll,_RunDLLEntry@16
                        O4 - HKLM\..\Run: [lxcjmon.exe] "C:\Program Files\Lexmark 8300 Series\lxcjmon.exe"
                        O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 8300 Series\ezprint.exe"
                        O4 - HKLM\..\Run: [WrtMon.exe] C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe
                        O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
                        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
                        O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
                        O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
                        O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                        O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
                        O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
                        O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
                        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                        O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
                        O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
                        O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                        O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                        O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
                        O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
                        O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
                        O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
                        O8 - Extra context menu item: &Search - ?p=ZJxdm247MXFR
                        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                        O8 - Extra context menu item: Ouvrir l'image dans &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~3\Office\1036\phdintl.dll/phdContext.htm
                        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
                        O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
                        O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
                        O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
                        O11 - Options group: [INTERNATIONAL] International*
                        O13 - Gopher Prefix:
                        O15 - Trusted Zone: https://www.orange.fr/portail
                        O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
                        O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
                        O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
                        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
                        O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                        O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                        O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                        O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
                        O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
                        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                        O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                        O23 - Service: lxcj_device - - C:\Windows\system32\lxcjcoms.exe
                        O23 - Service: My Web Search Service (MyWebSearchService) - Unknown owner - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe (file missing)
                        O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
                        O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
                        O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                        O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
                        O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
                        O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
                        O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
                        O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
                        O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
                        O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

                        ça donne quoi ?
                        Merci
                    3. Laeti77144
                      Et voilà le résultat de combofix ci dessous, mais quel spyware et quel antivirus (en ce moment j'ai avira antivir) utiliser ?

                      Merci

                      ComboFix 08-03-30.2 - Laetitia et Frédéric 2008-03-30 16:26:05.1 - NTFSx86
                      Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1243 [GMT 2:00]
                      Endroit: C:\Users\Laetitia et Frédéric\Desktop\KillBagle.exe
                      * Création d'un nouveau point de restauration
                      .

                      (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                      .

                      C:\PROGRA~2\Microsoft\Network\Downloader\qmgr0.dat
                      C:\PROGRA~2\Microsoft\Network\Downloader\qmgr1.dat
                      C:\Program Files\internet explorer\msimg32.dll
                      C:\Program Files\MyWebSearch
                      C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
                      C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
                      C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
                      C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV
                      C:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
                      C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG
                      C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
                      C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
                      C:\Program Files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE
                      C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
                      C:\Program Files\MyWebSearch\bar\1.bin\M3MEDINT.EXE
                      C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
                      C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
                      C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
                      C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
                      C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
                      C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
                      C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\MWSSVC.EXE
                      C:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S
                      C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S
                      C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S
                      C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S
                      C:\Program Files\MyWebSearch\bar\icons\CM.ICO
                      C:\Program Files\MyWebSearch\bar\icons\MFC.ICO
                      C:\Program Files\MyWebSearch\bar\icons\PSS.ICO
                      C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO
                      C:\Program Files\MyWebSearch\bar\icons\WB.ICO
                      C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO
                      C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S
                      C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
                      C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
                      C:\Windows\system32\f3PSSavr.scr

                      ----- BITS: Possible sites infect‚s -----

                      hxxp://rad.msn.com
                      .
                      ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-02-28 to 2008-03-30 ))))))))))))))))))))))))))))))))))))
                      .

                      2008-03-30 16:11 . 2008-03-30 16:11 <REP> d-------- C:\Program Files\RogueRemover FREE
                      2008-03-30 15:46 . 2008-03-30 16:00 <REP> d-------- C:\Program Files\Yahoo!
                      2008-03-30 15:46 . 2008-03-30 15:48 <REP> d-------- C:\Program Files\CCleaner
                      2008-03-21 08:48 . 2008-03-21 08:48 <REP> d-------- C:\Windows\System32\Adobe
                      2008-03-21 08:48 . 2008-03-21 08:48 <REP> d-------- C:\Program Files\Common Files\Vbox
                      2008-03-21 08:48 . 2001-11-14 21:19 16,384 --a------ C:\Windows\System32\FileOps.exe
                      2008-03-12 08:06 . 2007-12-17 00:50 1,060,920 --a------ C:\Windows\System32\drivers\ntfs.sys
                      2008-03-12 08:06 . 2007-12-16 11:56 41,984 --a------ C:\Windows\System32\drivers\monitor.sys
                      2008-03-11 18:26 . 2008-03-11 18:26 <REP> d-------- C:\Program Files\Securitoo
                      2008-03-11 18:26 . 2008-03-11 18:26 <REP> d-------- C:\Program Files\SAGEM
                      2008-03-11 18:14 . 2006-11-28 22:46 28,224 --------- C:\Windows\System32\drivers\PCAMp50.sys
                      2008-03-11 18:14 . 2006-11-28 22:46 27,072 --------- C:\Windows\System32\drivers\PCASp50.sys
                      2008-03-11 18:12 . 2008-03-11 18:31 <REP> d-------- C:\Program Files\Orange
                      2008-03-11 18:12 . 2008-03-11 18:12 <REP> d-------- C:\Program Files\Common Files\France Telecom
                      2008-03-11 18:12 . 2007-09-25 20:31 65,536 --a------ C:\Windows\System32\Autodial2000.dll
                      2008-03-04 20:59 . 2008-03-04 20:59 2,560 --a------ C:\Windows\System32\bitcometres.dll
                      2008-02-29 18:40 . 2008-02-29 18:40 <REP> d-------- C:\Program Files\Java
                      2008-02-29 18:40 . 2007-09-25 00:31 69,632 --a------ C:\Windows\System32\javacpl.cpl
                      2008-02-29 18:39 . 2008-02-29 18:39 <REP> d-------- C:\Program Files\Common Files\Java
                      2008-02-16 08:21 . 2008-01-10 07:50 1,244,672 --a------ C:\Windows\System32\mcmde.dll
                      2008-02-14 04:09 . 2008-02-14 04:09 194,560 --a------ C:\Windows\System32\WebClnt.dll
                      2008-02-14 04:09 . 2008-02-14 04:09 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
                      2008-02-14 04:05 . 2008-02-14 04:05 3,504,696 --a------ C:\Windows\System32\ntkrnlpa.exe
                      2008-02-14 04:05 . 2008-02-14 04:05 3,470,392 --a------ C:\Windows\System32\ntoskrnl.exe
                      2008-02-14 04:05 . 2008-02-14 04:05 154,624 --a------ C:\Windows\System32\drivers\nwifi.sys
                      2008-02-14 04:05 . 2008-02-14 04:05 109,624 --a------ C:\Windows\System32\drivers\ataport.sys
                      2008-02-14 04:05 . 2008-02-14 04:05 45,112 --a------ C:\Windows\System32\drivers\pciidex.sys
                      2008-02-14 04:05 . 2008-02-14 04:05 21,560 --a------ C:\Windows\System32\drivers\atapi.sys
                      2008-02-14 04:05 . 2008-02-14 04:05 15,928 --a------ C:\Windows\System32\drivers\pciide.sys
                      2008-02-14 04:04 . 2008-02-14 04:04 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
                      2008-02-14 04:04 . 2008-02-14 04:04 1,686,528 --a------ C:\Windows\System32\gameux.dll
                      2008-02-14 04:04 . 2008-02-14 04:04 803,328 --a------ C:\Windows\System32\drivers\tcpip.sys
                      2008-02-14 04:04 . 2008-02-14 04:04 216,632 --a------ C:\Windows\System32\drivers\netio.sys
                      2008-02-14 04:04 . 2008-02-14 04:04 167,424 --a------ C:\Windows\System32\tcpipcfg.dll
                      2008-02-14 04:04 . 2008-02-14 04:04 24,064 --a------ C:\Windows\System32\netcfg.exe
                      2008-02-14 04:04 . 2008-02-14 04:04 22,016 --a------ C:\Windows\System32\netiougc.exe
                      2008-02-01 12:17 . 2008-02-01 12:17 587,264 --a------ C:\Windows\WLXPGSS.SCR

                      .
                      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                      .
                      2008-03-30 14:04 --------- d-----w C:\Program Files\Google
                      2008-03-30 13:59 --------- d-----w C:\Program Files\Packard Bell
                      2008-03-30 13:57 --------- d--h--w C:\Program Files\InstallShield Installation Information
                      2008-03-30 13:54 --------- d-----w C:\Program Files\Corel
                      2008-03-30 13:51 --------- d-----w C:\Program Files\Common Files\Adobe
                      2008-03-28 07:07 --------- d-----w C:\Program Files\Lx_cats
                      2008-03-13 05:24 --------- d-----w C:\Program Files\Windows Mail
                      2008-03-04 19:01 --------- d-----w C:\Program Files\BitComet
                      2008-02-28 02:01 --------- d-----w C:\Program Files\Windows Live
                      2008-02-19 20:30 --------- d-----w C:\PROGRA~2\WinZip
                      2008-02-14 02:04 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
                      2008-02-14 02:04 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
                      2008-02-14 02:04 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
                      2008-02-14 02:04 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
                      2008-02-14 02:01 824,832 ----a-w C:\Windows\System32\wininet.dll
                      2008-02-14 02:01 56,320 ----a-w C:\Windows\System32\iesetup.dll
                      2008-02-14 02:01 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
                      2008-02-14 02:01 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
                      2008-01-10 02:01 11,776 ----a-w C:\Windows\System32\sbunattend.exe
                      2008-01-01 15:31 174 --sha-w C:\Program Files\desktop.ini
                      2008-01-01 14:43 67,584 ----a-w C:\Windows\System32\wlanhlp.dll
                      2008-01-01 14:43 542,720 ----a-w C:\Windows\System32\sysmain.dll
                      2008-01-01 14:43 502,784 ----a-w C:\Windows\System32\wlansvc.dll
                      2008-01-01 14:43 47,104 ----a-w C:\Windows\System32\wlanapi.dll
                      2008-01-01 14:43 297,984 ----a-w C:\Windows\System32\wlansec.dll
                      2008-01-01 14:43 290,816 ----a-w C:\Windows\System32\wlanmsm.dll
                      2008-01-01 14:43 24,064 ----a-w C:\Windows\System32\wtsapi32.dll
                      2008-01-01 14:43 2,923,520 ----a-w C:\Windows\explorer.exe
                      2008-01-01 14:43 2,027,008 ----a-w C:\Windows\System32\win32k.sys
                      2008-01-01 14:42 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL
                      2008-01-01 14:42 7,680 ----a-w C:\Windows\System32\spwmp.dll
                      2008-01-01 14:42 4,096 ----a-w C:\Windows\System32\dxmasf.dll
                      2008-01-01 14:42 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll
                      2008-01-01 14:41 1,191,936 ----a-w C:\Windows\System32\msxml3.dll
                      2008-01-01 14:40 8,704 ----a-w C:\Windows\System32\hcrstco.dll
                      2008-01-01 14:40 8,704 ----a-w C:\Windows\System32\hccoin.dll
                      2008-01-01 14:39 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
                      2008-01-01 14:39 223,232 ----a-w C:\Windows\System32\WMASF.DLL
                      2008-01-01 14:39 1,327,104 ----a-w C:\Windows\System32\quartz.dll
                      2008-01-01 14:38 1,335,296 ----a-w C:\Windows\System32\msxml6.dll
                      2008-01-01 14:33 788,992 ----a-w C:\Windows\System32\rpcrt4.dll
                      2008-01-01 14:29 750,080 ----a-w C:\Windows\System32\qmgr.dll
                      2008-01-01 14:06 53,080 ----a-w C:\Windows\System32\wuauclt.exe
                      2008-01-01 14:06 43,352 ----a-w C:\Windows\System32\wups2.dll
                      2008-01-01 14:06 1,712,984 ----a-w C:\Windows\System32\wuaueng.dll
                      2008-01-01 14:06 1,524,224 ----a-w C:\Windows\System32\wucltux.dll
                      2008-01-01 14:05 80,896 ----a-w C:\Windows\System32\wudriver.dll
                      2008-01-01 14:05 549,720 ----a-w C:\Windows\System32\wuapi.dll
                      2008-01-01 14:05 33,624 ----a-w C:\Windows\System32\wups.dll
                      2008-01-01 14:04 31,232 ----a-w C:\Windows\System32\wuapp.exe
                      2008-01-01 14:04 163,000 ----a-w C:\Windows\System32\wuwebv.dll
                      .

                      ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                      .
                      .
                      REGEDIT4
                      *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

                      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                      "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-10 04:01 1232896]
                      "WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 14:34 2159104 C:\Windows\System32\oobefldr.dll]
                      "SmpcSys"="C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe" [2007-07-19 15:32 1120568]
                      "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
                      "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440]
                      "BitComet"="C:\Program Files\BitComet\BitComet.exe" [2008-01-08 12:25 2124088]
                      "BPS Spyware Remover"="C:\Program Files\BPS Remover\BPSRem.exe" [ ]

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                      "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-08-09 03:59 1006264]
                      "RtHDVCpl"="RtHDVCpl.exe" [2007-05-10 17:10 4468736 C:\Windows\RtHDVCpl.exe]
                      "Skytel"="Skytel.exe" [2007-05-07 18:51 1826816 C:\Windows\SkyTel.exe]
                      "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-06-02 06:16 86016]
                      "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-06-02 06:16 8429568]
                      "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-06-02 06:16 81920]
                      "RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-01-11 11:40 232184]
                      "MSPService"="C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe" [2007-06-12 23:36 102400]
                      "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-02-21 03:18 366400]
                      "toolbar_eula_launcher"="C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [2007-02-20 18:20 28672]
                      "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-08-31 13:25 249896]
                      "LXCJCATS"="C:\Windows\system32\spool\DRIVERS\W32X86\3\LXCJtime.dll" [2006-11-21 14:27 106496]
                      "lxcjmon.exe"="C:\Program Files\Lexmark 8300 Series\lxcjmon.exe" [2007-01-30 16:33 205744]
                      "EzPrint"="C:\Program Files\Lexmark 8300 Series\ezprint.exe" [2007-01-30 16:35 103344]
                      "WrtMon.exe"="C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 09:35 20480]
                      "My Web Search Bar Search Scope Monitor"="C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" [ ]
                      "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-05 16:12 185896]
                      "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 16:27 385024]
                      "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 04:22 267048]
                      "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
                      "ORAHSSSessionManager"="C:\Program Files\Orange\SessionManager\SessionManager.exe" [2007-09-25 20:10 102400]
                      "SystrayORAHSS"="C:\Program Files\Orange\Systray\SystrayApp.exe" [2007-09-25 21:08 94208]

                      C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
                      Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 10:15:56 65588]
                      WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2007-06-06 12:10:02 394856]

                      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
                      "DisableMonitoring"=dword:00000001

                      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
                      "DisableMonitoring"=dword:00000001

                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
                      "{55ADE297-4E2B-4433-9094-82C93A1D69F9}"= C:\Program Files\CyberLink\MagicSports\MagicSports.exe:CyberLink MagicSports
                      "{33EBDB45-7880-42BC-A6BE-2003E1022927}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
                      "{B66B330A-EE87-4740-8CA9-183419F95EA3}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
                      "{90F14DB1-1C3D-40BC-901E-FB8E04F3100B}"= UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
                      "{BD70D58B-D197-468E-B2E8-E4F4AEB295D0}"= TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype
                      "{43AB2D84-EBFB-4D04-82D9-0906BE495679}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
                      "{EB7AB97C-9CAC-46CC-987D-9F193EB3966C}"= UDP:C:\Windows\System32\spool\drivers\w32x86\3\lxcjpswx.exe:Printer Status Window
                      "{A654EBA0-5D60-4EF3-BEC7-A6C33C94FC31}"= TCP:C:\Windows\System32\spool\drivers\w32x86\3\lxcjpswx.exe:Printer Status Window
                      "{21B9F63A-DD86-4D9A-960C-E8C1FBCA3647}"= UDP:C:\Windows\System32\lxcjcoms.exe:Lexmark Communications System
                      "{123CA861-6EF7-4609-B9AF-6F93FD25A01E}"= TCP:C:\Windows\System32\lxcjcoms.exe:Lexmark Communications System
                      "TCP Query User{36E99D79-80E1-42BD-B2A3-CFDECCC372DB}C:\\program files\\real\\realplayer\\realplay.exe"= UDP:C:\program files\real\realplayer\realplay.exe:RealPlayer
                      "UDP Query User{4E5090C3-ECDC-4014-B524-E2AB4A80AD9D}C:\\program files\\real\\realplayer\\realplay.exe"= TCP:C:\program files\real\realplayer\realplay.exe:RealPlayer
                      "TCP Query User{5E7E80D5-E12C-4AAB-8F36-EE498C2F06D6}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
                      "UDP Query User{890F1A92-1B5C-49A3-A47C-3F3CE71AA3D1}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
                      "TCP Query User{5651D4F2-3895-4A1B-9329-E763D46DB287}C:\\program files\\bitcomet\\bitcomet.exe"= UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
                      "UDP Query User{42E40AA7-00B2-46F5-99EE-F69866391B15}C:\\program files\\bitcomet\\bitcomet.exe"= TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
                      "{33E997D1-9162-4A48-AADD-53C1DD0A3450}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
                      "{A1CE9CDF-AD95-41C7-A404-5EE7AD9B71BB}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
                      "{0D7CFB9D-B9AB-4C1F-B8EB-11623A2E1ADE}"= UDP:22316:BitComet 22316 TCP
                      "{5729D663-6BBA-45D3-BC72-8702B0063644}"= TCP:22316:BitComet 22316 UDP
                      "TCP Query User{8987DFA1-D588-4E78-A2CE-36E378DC9317}C:\\program files\\bitcomet\\bitcomet.exe"= UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
                      "UDP Query User{5D0F8683-509C-42FB-B38B-7794DBDA336E}C:\\program files\\bitcomet\\bitcomet.exe"= TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client

                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
                      "EnableFirewall"= 0 (0x0)

                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
                      "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
                      "C:\\Program Files\\Orange\\Connectivity\\ConnectivityManager.exe"= C:\Program Files\Orange\Connectivity\ConnectivityManager.exe:*:enabled:CSS

                      S2 MyWebSearchService;My Web Search Service;C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe []
                      S3 PCAMp50;PCAMp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50.sys [2006-11-28 22:46]
                      S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2006-11-28 22:46]

                      .
                      Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
                      "2008-03-30 14:30:00 C:\Windows\Tasks\Extension de garantie.job"
                      - C:\Program Files\Packard Bell\SetupmyPC\PBCarNot.exe
                      "2008-03-30 14:30:00 C:\Windows\Tasks\Recovery DVD Creator.job"
                      - C:\Program Files\Packard Bell\SetupMyPc\MCDCheck.exe
                      .
                      **************************************************************************

                      catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                      Rootkit scan 2008-03-30 16:30:06
                      Windows 6.0.6000 NTFS

                      Balayage processus cach‚s ...

                      Balayage cach‚ autostart entries ...

                      Balayage des fichiers cach‚s ...

                      Scan termin‚ avec succŠs
                      Les fichiers cach‚s: 0

                      **************************************************************************
                      .
                      ------------------------ Other Running Processes ------------------------
                      .
                      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                      C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                      C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                      C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\[u]0/u\FTRTSVC.exe
                      C:\Windows\system32\lxcjcoms.exe
                      C:\Windows\system32\PSIService.exe
                      C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                      C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
                      C:\Windows\system32\WUDFHost.exe
                      C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
                      C:\Windows\system32\conime.exe
                      C:\Windows\System32\rundll32.exe
                      C:\Windows\System32\rundll32.exe
                      C:\Program Files\Orange\Launcher\Launcher.exe
                      C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
                      C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\[u]0/u\AlertModule.exe
                      C:\Windows\ehome\ehmsas.exe
                      C:\Program Files\iPod\bin\iPodService.exe
                      C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
                      C:\Program Files\Orange\Deskboard\deskboard.exe
                      C:\Program Files\Orange\connectivity\connectivitymanager.exe
                      C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
                      C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
                      C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\[u]0/u\FTCOMModule.exe
                      .
                      **************************************************************************
                      .
                      Temps d'accomplissement: 2008-03-30 16:32:37 - machine was rebooted
                      ComboFix-quarantined-files.txt 2008-03-30 14:32:32
                      Pre-Run: 259,430,834,176 octets libres
                      Post-Run: 259,612,655,616 octets libres
                      .
                      2008-03-25 19:41:29 --- E O F ---
                      1. Laeti77144
                        Ah bah super je l'ai acheté moi cette salop***ie ! J'espère ne pas avoir de souci avec ma carte de crédit... pffff

                        Voilà le rapport de Hijackthis :

                        Logfile of HijackThis v1.99.1
                        Scan saved at 16:18:51, on 30/03/2008
                        Platform: Unknown Windows (WinNT 6.00.1904)
                        MSIE: Internet Explorer v7.00 (7.00.6000.16609)

                        Running processes:
                        C:\Windows\system32\taskeng.exe
                        C:\Windows\system32\Dwm.exe
                        C:\Windows\Explorer.EXE
                        C:\Program Files\Windows Defender\MSASCui.exe
                        C:\Windows\RtHDVCpl.exe
                        C:\Windows\System32\rundll32.exe
                        C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
                        C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
                        C:\Program Files\Picasa2\PicasaMediaDetector.exe
                        C:\Windows\System32\rundll32.exe
                        C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
                        C:\Program Files\Lexmark 8300 Series\lxcjmon.exe
                        C:\Program Files\Lexmark 8300 Series\ezprint.exe
                        C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
                        C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
                        C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
                        C:\Program Files\Common Files\Real\Update_OB\realsched.exe
                        C:\Program Files\iTunes\iTunesHelper.exe
                        C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
                        C:\Program Files\Orange\Systray\SystrayApp.exe
                        C:\Program Files\Windows Sidebar\sidebar.exe
                        C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
                        C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                        C:\Program Files\Orange\Launcher\Launcher.exe
                        C:\Windows\ehome\ehtray.exe
                        C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
                        C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
                        C:\Windows\ehome\ehmsas.exe
                        C:\Program Files\Windows Sidebar\sidebar.exe
                        C:\Program Files\WinZip\WZQKPICK.EXE
                        C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
                        C:\Program Files\Orange\Deskboard\deskboard.exe
                        C:\Program Files\Orange\connectivity\connectivitymanager.exe
                        C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
                        C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
                        C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
                        C:\Program Files\Internet Explorer\IEUser.exe
                        C:\Program Files\Internet Explorer\iexplore.exe
                        C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
                        C:\Windows\system32\SearchFilterHost.exe
                        C:\Users\Laetitia et Frédéric\Desktop\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                        R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
                        R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
                        R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                        O1 - Hosts: ::1 localhost
                        O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
                        O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                        O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
                        O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                        O2 - BHO: BitComet Helper - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll
                        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                        O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                        O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
                        O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
                        O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
                        O4 - HKLM\..\Run: [Skytel] Skytel.exe
                        O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
                        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
                        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
                        O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
                        O4 - HKLM\..\Run: [MSPService] C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
                        O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
                        O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
                        O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                        O4 - HKLM\..\Run: [LXCJCATS] rundll32 C:\Windows\system32\spool\DRIVERS\W32X86\3\LXCJtime.dll,_RunDLLEntry@16
                        O4 - HKLM\..\Run: [lxcjmon.exe] "C:\Program Files\Lexmark 8300 Series\lxcjmon.exe"
                        O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 8300 Series\ezprint.exe"
                        O4 - HKLM\..\Run: [WrtMon.exe] C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe
                        O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
                        O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=0
                        O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
                        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
                        O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
                        O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
                        O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
                        O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
                        O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
                        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                        O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
                        O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
                        O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
                        O4 - HKCU\..\Run: [BPS Spyware Remover] C:\Program Files\BPS Remover\BPSRem.exe /STARTUP
                        O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                        O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
                        O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
                        O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
                        O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
                        O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJxdm247MXFR
                        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                        O8 - Extra context menu item: Ouvrir l'image dans &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~3\Office\1036\phdintl.dll/phdContext.htm
                        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
                        O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
                        O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
                        O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
                        O11 - Options group: [INTERNATIONAL] International*
                        O13 - Gopher Prefix:
                        O15 - Trusted Zone: https://www.orange.fr/portail
                        O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-3/ZwinkyInitialSetup1.0.1.0.cab
                        O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
                        O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
                        O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
                        O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
                        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
                        O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                        O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                        O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                        O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
                        O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
                        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                        O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                        O23 - Service: lxcj_device - - C:\Windows\system32\lxcjcoms.exe
                        O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe
                        O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
                        O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
                        O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                        O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
                        O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
                        O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
                        O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
                        O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
                        O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)
                        1. jlpjlp Contributeur sécurité
                          slt,

                          BPS Spyware est un espion , il ne faut pas l'utiliser et ne pas l'acheter!!!!!!!!!!!!!!

                          pour info:

                          http://forum.malekal.com/ftopic1836.php

                          vire le!!!!

                          _______________

                          lance rogue remover

                          pour telecharger :
                          https://www.01net.com/telecharger/

                          ________________

                          colle un rapport hijackthis

                          http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

                          manuel :
                          http://pagesperso-orange.fr/rginformatique/section%20virus/demohijack.htm
                          https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

                          Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.

                          ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

                          Ensuite avec Explorer créer un dossier c:\hijackthis
                          Décompresser Hijackthis dans ce dossier.
                          C'est important pour les sauvegardes."

                          ____________________

                          Télécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315

                          http://download.bleepingcomputer.com/sUBs/ComboFix.exe
                          Sauvegarde le sur ton bureau et pas ailleurs !

                          Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic

                          Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
                          Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

                          Discussions similaires

                          bps-racing.com : Site internet fiable ?
                          F-BVXT

                          23 réponses