Désinstaller gestionnaire orange?!?

soop -  
Bonjour,

je navigue sous firefox par une connexion livebox sagem et un fournisseur orange, mais le gestionnaire de navigation orange me dérange car il n'arrive pas a se connecter alors il fait planter firefox et je suis obligé de rallumer mon pc pour me reconnecter (bug des fois), voulant le désinstaller j'ai fait:
panneau de conf> ajj/suppr de prog/ supprimer gestionnaire orange.

le programme n'est plus dans la liste mais le gestionnaire est toujours bien présent ainsi que le soucis.

comment désinstaller ce gestionnaire? (si c'est la bonne question)

merci d'avance
Configuration: Windows XP
Firefox 2.0.0.16

36 réponses

Résumé de la discussion

Le problème décrit concerne un gestionnaire Orange qui persiste sur une connexion Livebox, entraînant des plantages de Firefox sous Windows XP et nécessitant un redémarrage. Plusieurs réponses recommandent des outils de suppression et de nettoyage comme HijackThis, OTMoveIt, Malwarebytes et CCleaner, afin d’identifier et d’éliminer les composants indésirables. Des scans en mode sans échec, des analyses en ligne et des recherches manuelles dans les dossiers Program Files et les éléments liés à Orange sont aussi évoqués comme voies possibles. En dernier option, certaines interventions suggèrent d’utiliser des scripts et des outils plus avancés pour nettoyer des barres d’outils et des restes de logiciels malveillants, potentiellement liés au gestionnaire.

Bobot (l’IA à votre service)
  1. soop
    salut DllD!

    oui bonnes vacances!merci

    je vais refaire l'analyse kaspersky, pour que tu ai le rapport sinon j'ai toujours les memes soucis de déconnexion intempestive!!

    je repasse demain avec le rapport.

    merci beaucoup!
    1. Utilisateur anonyme
      Bonsoir Soop,
      j'espère que tu as passé de bonnes vacances.

      :-)

      Alors,
      pour le scanne en ligne Kaspersky il faut à la fin du scanne cliquer sur le bouton <afficher le rapport>.

      Puis un fichier texte va s'ouvrir, tu l'enregistres sur ton bureau puis tu le copie/colle sur le forum.

      Je pense que tu es obligé de refaire l'analyse..... Sinon regarde dans tous les programmes si tu as des indices sur Kasper en ligne.

      Bon courage, on a presque terminé.

      Comment va le PC aussi ?

      Bonne soirée.
      1. soop
        salut DllD;

        merci d'avoir penser a moi, je ne peut répondre que maintenant désolé (vacances)!

        je te poste tout les rapports demander:

        hijackthis:

        Logfile of Trend Micro HijackThis v2.0.0 (BETA)
        Scan saved at 10:21:16, on 16/08/2008
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\csrss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        C:\Program Files\Alwil Software\Avast4\ashServ.exe
        C:\WINDOWS\Explorer.EXE
        C:\WINDOWS\system32\spoolsv.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\drivers\CDAC11BA.EXE
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        C:\WINDOWS\System32\alg.exe
        C:\WINDOWS\soundman.exe
        C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
        C:\WINDOWS\system32\rundll32.exe
        C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
        C:\Program Files\SuperCopier2\SuperCopier2.exe
        C:\Program Files\Mozilla Firefox\firefox.exe
        C:\WINDOWS\system32\wuauclt.exe
        C:\Documents and Settings\endeavour\Bureau\HiJackThis_v2.exe
        C:\WINDOWS\System32\wbem\wmiprvse.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.zhaodao123.com/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fimg%2ffr%2ffr-fr%2fdivertissement%2fcelebrites%2fgalery%2fwentworth02.jpg%3f
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
        O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
        O4 - HKLM\..\Run: [SoundMan] soundman.exe
        O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
        O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
        O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
        O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe
        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
        O4 - HKCU\..\Run: [EPSON Stylus DX7400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE /FU "C:\WINDOWS\TEMP\E_SA1D.tmp" /EF "HKCU"
        O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
        O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
        O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
        O15 - Trusted Zone: https://www.orange.fr/portail
        O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
        O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
        O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
        O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
        O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
        O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
        O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - Unknown owner - C:\Program Files\Securitoo\av_fw\fswsclds.exe (file missing)
        O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
        O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
        O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
        O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
        O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
        O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
        O23 - Service: Telnet (TlntSvr) - Unknown owner - C:\WINDOWS\System32\tlntsvr.exe
        O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
        O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
        O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

        combofix:

        ComboFix 08-08-01.05 - endeavour 2008-08-14 16:32:09.2 - [color=red][b]FAT32/b/colorx86
        Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.140 [GMT 2:00]
        Endroit: C:\Documents and Settings\endeavour\Bureau\ComboFix.exe
        Command switches used :: C:\Documents and Settings\endeavour\Bureau\CFScript.txt
        * Création d'un nouveau point de restauration

        [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!/b/color
        .
        - FONCTIONNALITES REDUITES -

        FILE ::
        C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\sysloader.exe
        C:\Program Files\Dealio
        C:\WINDOWS\system32\D96E2D9601.sys
        C:\WINDOWS\system32\drivers\ALCICH.DAT
        C:\WINDOWS\system32\drivers\bqm05.sys
        C:\WINDOWS\system32\systemdrv.dll
        C:\WINDOWS\TEMP\E_SA1D.tmp
        .

        (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
        .

        C:\WINDOWS\system32\D96E2D9601.sys
        C:\WINDOWS\system32\drivers\ALCICH.DAT
        C:\WINDOWS\system32\systemdrv.dll

        .
        ((((((((((((((((((((((((((((( Fichiers créés 2008-07-14 to 2008-08-14 ))))))))))))))))))))))))))))))))))))
        .

        2008-08-13 19:44 . 2008-08-13 19:44 <REP> d-------- C:\Documents and Settings\endeavour\Application Data\DivX
        2008-08-13 00:12 . 2008-08-13 00:12 268 --ah----- C:\sqmdata00.sqm
        2008-08-13 00:12 . 2008-08-13 00:12 244 --ah----- C:\sqmnoopt00.sqm
        2008-07-31 16:47 . 2008-07-31 16:47 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
        2008-07-31 16:47 . 2008-07-31 16:47 <REP> d-------- C:\Documents and Settings\endeavour\Application Data\Malwarebytes
        2008-07-31 16:47 . 2008-07-31 16:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
        2008-07-31 16:47 . 2008-07-30 20:07 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
        2008-07-31 16:47 . 2008-07-30 20:07 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
        2008-07-31 16:44 . 2008-07-31 16:44 <REP> d-------- C:\_OTMoveIt
        2008-07-31 15:17 . 2008-07-31 15:17 <REP> d-------- C:\Program Files\Navilog1
        2008-07-31 15:14 . 2008-07-31 15:14 <REP> d-------- C:\Toolbar SD
        2008-07-30 22:10 . 2008-07-30 22:10 <REP> d-------- C:\Program Files\Yahoo!
        2008-07-30 22:10 . 2008-07-30 22:10 <REP> d-------- C:\Program Files\CCleaner
        2008-07-27 13:35 . 1998-06-17 01:00 516,173 --a------ C:\WINDOWS\system32\MSVCP60D.DLL
        2008-07-27 13:35 . 1998-06-17 01:00 385,100 --a------ C:\WINDOWS\system32\MSVCRTD.DLL
        2008-07-27 13:34 . 2003-08-07 17:01 237,568 --a------ C:\WINDOWS\system32\lame_enc.dll
        2008-07-27 12:00 . 2008-07-27 12:00 <REP> d-------- C:\Program Files\eMule
        2008-07-25 10:36 . 2008-07-25 10:36 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe
        2008-07-25 10:36 . 2008-07-25 10:36 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb
        2008-07-23 18:50 . 2008-07-23 18:50 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
        2008-07-23 18:50 . 2008-07-23 18:50 9,878 --a------ C:\WINDOWS\system32\dsm_fr.qm
        2008-07-23 18:48 . 2008-07-23 18:48 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
        2008-07-23 18:48 . 2008-07-23 18:48 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
        2008-07-23 18:47 . 2008-07-23 18:47 634,880 --a------ C:\WINDOWS\system32\DivXdec.ax
        2008-07-23 18:47 . 2008-07-23 18:47 352,401 --a------ C:\WINDOWS\system32\DivXMedia.ax
        2008-07-23 18:47 . 2008-07-23 18:47 8,835 --a------ C:\WINDOWS\system32\dpufr.qm
        2008-07-23 18:47 . 2008-07-23 18:47 3,067 --a------ C:\WINDOWS\system32\dtu_fr.qm
        2008-07-23 18:47 . 2008-07-23 18:47 416 --a------ C:\WINDOWS\system32\dtu100.dll.manifest
        2008-07-23 18:47 . 2008-07-23 18:47 416 --a------ C:\WINDOWS\system32\dpl100.dll.manifest
        2008-07-23 18:46 . 2008-07-23 18:46 12,288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll

        .
        (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-07-23 16:50 129,784 ------w C:\WINDOWS\system32\pxafs.dll
        2008-07-23 16:50 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
        2008-07-23 16:50 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
        2008-06-29 07:27 --------- d-----w C:\Program Files\Veoh Networks
        2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
        2008-06-20 17:41 247,808 ------w C:\WINDOWS\system32\dllcache\mswsock.dll
        2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
        2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
        2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
        2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
        2008-06-20 10:44 138,368 ------w C:\WINDOWS\system32\dllcache\afd.sys
        2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
        2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
        2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
        2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\dllcache\bthport.sys
        2008-06-14 12:22 --------- d-----w C:\Program Files\Free Audio Pack
        2008-06-14 12:04 --------- d-----w C:\Program Files\AliveMedia
        2007-10-27 16:54 1,682 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
        .

        ((((((((((((((((((((((((((((( snapshot@2008-08-03_13.42.28.39 )))))))))))))))))))))))))))))))))))))))))
        .
        + 2008-07-25 08:34:36 683,520 ----a-w C:\WINDOWS\system32\DivX.dll
        + 2008-07-25 08:34:42 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
        + 2008-07-25 08:34:40 815,104 ----a-w C:\WINDOWS\system32\divx_xx0a.dll
        + 2008-07-25 08:34:40 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
        + 2008-07-25 08:34:40 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
        + 2008-07-25 08:34:30 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
        + 2008-07-25 08:34:54 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
        + 2008-07-25 08:34:46 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
        + 2008-07-25 08:34:46 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
        + 2008-07-25 08:34:50 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
        + 2008-07-25 08:34:46 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
        + 2008-07-25 08:34:46 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
        + 2008-07-25 08:34:46 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
        + 2008-07-25 08:34:52 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
        + 2008-07-23 16:50:46 551,672 ------w C:\WINDOWS\system32\px.dll
        + 2008-07-23 16:50:46 66,296 ------w C:\WINDOWS\system32\pxcpya64.exe
        + 2008-07-23 16:50:48 518,904 ------w C:\WINDOWS\system32\pxdrv.dll
        + 2008-07-23 16:50:48 72,440 ------w C:\WINDOWS\system32\pxhpinst.exe
        + 2008-07-23 16:50:46 64,760 ------w C:\WINDOWS\system32\pxinsa64.exe
        + 2008-07-23 16:50:50 187,128 ------w C:\WINDOWS\system32\pxmas.dll
        + 2008-07-23 16:50:48 1,628,920 ------w C:\WINDOWS\system32\pxsfs.dll
        + 2008-07-23 16:50:48 379,640 ------w C:\WINDOWS\system32\pxwave.dll
        + 2008-07-23 16:50:46 88,824 ------w C:\WINDOWS\system32\vxblock.dll
        + 2008-08-14 13:38:58 16,384 ----a-w C:\WINDOWS\Temp\Perflib_Perfdata_6ec.dat
        .
        ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        REGEDIT4
        *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
        "OM_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" [2005-07-19 11:14 57344]
        "EPSON Stylus DX7400 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE" [2007-04-12 07:00 182272]
        "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
        "SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 17:45 1052672]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2003-09-05 06:59 878080]
        "RoxioDragToDisc"="C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe" [2004-04-13 23:36 1470464]
        "OM_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [2005-07-19 11:06 40960]
        "SoundMan"="soundman.exe" [2001-05-29 17:02 124416 C:\WINDOWS\soundman.exe]
        "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-20 01:10 110592 C:\WINDOWS\system32\bthprops.cpl]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]

        C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
        Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 22:05:56 65588]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
        "VIDC.MJPG"= pvmjpg21.dll

        [HKEY_LOCAL_MACHINE\software\microsoft\security center]
        "AntiVirusDisableNotify"=dword:00000001
        "UpdatesDisableNotify"=dword:00000001

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "C:\\Program Files\\Messenger\\MSMSGS.EXE"=
        "C:\\Program Files\\eMule\\emule.exe"=
        "C:\\Program Files\\eMule\\LinkCreator.exe"=
        "C:\\Program Files\\Mozilla Firefox\\FIREFOX.EXE"=
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
        "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
        "C:\\Program Files\\uTorrent\\uTorrent.exe"=

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
        "18376:TCP"= 18376:TCP:NortonAV
        "18114:TCP"= 18114:TCP:NortonAV
        "13406:TCP"= 13406:TCP:NortonAV
        "17565:TCP"= 17565:TCP:NortonAV
        "14629:TCP"= 14629:TCP:NortonAV
        "46662:TCP"= 46662:TCP:emuletcp
        "46672:UDP"= 46672:UDP:emule udp
        "12830:TCP"= 12830:TCP:NortonAV
        "18314:TCP"= 18314:TCP:NortonAV
        "17627:TCP"= 17627:TCP:NortonAV
        "16500:TCP"= 16500:TCP:NortonAV
        "16881:TCP"= 16881:TCP:NortonAV
        "16207:TCP"= 16207:TCP:NortonAV
        "15463:TCP"= 15463:TCP:NortonAV
        "18166:TCP"= 18166:TCP:NortonAV
        "16472:TCP"= 16472:TCP:NortonAV
        "16059:TCP"= 16059:TCP:NortonAV
        "14327:TCP"= 14327:TCP:NortonAV

        R0 1qax990p;1qax990;C:\WINDOWS\system32\DRIVERS\1qax990p.sys [2004-08-20 01:09]
        R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
        R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
        S2 bqm05;bqm05;C:\WINDOWS\system32\drivers\bqm05.sys []
        S2 Fswsclds;F-Secure Windows Security Center Legacy Detection Service;C:\Program Files\Securitoo\av_fw\fswsclds.exe []
        S4 Lmhaudska-;Lmhaudska-;C:\WINDOWS\system32\drivers\rdpcdd.sys [2001-08-28 12:00]
        .
        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-08-14 16:32:40
        Windows 5.1.2600 Service Pack 2 FAT NTAPI

        Balayage processus cachés ...

        Balayage caché autostart entries ...

        Balayage des fichiers cachés ...

        Scan terminé avec succès
        Les fichiers cachés: 0

        **************************************************************************
        .
        Temps d'accomplissement: 2008-08-14 16:33:48
        ComboFix-quarantined-files.txt 2008-08-14 14:33:44
        ComboFix2.txt 2008-08-03 11:43:22

        Pre-Run: 51,392,806,912 octets libres
        Post-Run: 51,399,819,264 octets libres

        182 --- E O F --- 2008-07-23 22:08:08

        par contre j'ai fait l'analyse on line kaspersky mais je ne trouve plus le fichier? il avait trouvé deux fichiers infectés, ou puis-je retrouver le fichier?

        merci, a bientot...
        1. Utilisateur anonyme
          Bonjour,
          désolé pour le retard mais j'ai beaucoup de travail en ce moment et j'ai toujours pas récupéré mon PC.

          Alors, on continue (j'espère que tu es encore là) :
          > Lance Hijackthis :
          - Puis sélectionne < Do a system scan only >
          - Coche les cases des lignes suivantes : 

          O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe

O23 - Service: System Event loader (sysloader) - Unknown owner - C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\sysloader.exe (file missing)

          Ensuite,
          - Ferme toutes les autres fenêtres et applications (même internet)
          - Clic sur < fixe checked >

          > Relance ton PC en mode normal puis Hijackthis :
          Puis sélectionne < do a system scan and save a logfile >,

          Et envoie, par collier/coller, ton log Hijackthis,

          Alors,
          > Avec Combofix :
          - Ferme tout tes navigateurs (donc copie ou imprime les instructions suivantes avant)
          - Crée un nouveau document texte : clic droit de souris sur le bureau => Nouveau => Document Texte, et copie/colle dedans les lignes suivantes : 

          Registry::
[-HKEY_LOCAL_MACHINE\System\ControlSet004\Services\mchInjDrv]

File::
C:\WINDOWS\system32\drivers\ALCICH.DAT
C:\WINDOWS\system32\systemdrv.dll 
C:\WINDOWS\TEMP\E_SA1D.tmp
C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\sysloader.exe
C:\Program Files\Dealio
C:\WINDOWS\system32\D96E2D9601.sys 
C:\WINDOWS\system32\drivers\bqm05.sys

Driver::
ACPIDISK
CNPROV 
MS_2FAX
MXDISPDR
NTPTDB
SYSLOADER
YIQILAI
sysloader 
D96E2D9601
1qax990p
bqm05

          - Enregistre ce fichier sous le nom CFScript (Type du fichier : tous les fichiers)
          - Fait un glisser/déposer de ce fichier CFScript sur le programme ComboFix.exe comme sur cette image.
          (Explications du glisser/coller : Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relâche alors le bouton de la souris).
          - Combofix va démarrer puis une fenêtre bleue va apparaître. Au message qui s'affiche (Type 1 to continue, or 2 to abort) : tape 1 puis valide.
          - Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal !
          - Ne touche à rien tant que le scan n'est pas terminé sinon le PC peut planter !
          - Une fois le scan achevé, un rapport va s'afficher: poste le stp.
          PS : Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt

          Pour finir,
          > Fais un scan en ligne avec Kaspersky : https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
          N.B. : Le scan ne marche que sous Internet Explorer.
          - Commence par connecter tout ton matériel de stockage à ton PC (clés USB, DD amovible...) si possible. Allume les si necessaire.
          - Sous Démonstration en ligne, on t'explique la marche à suivre, et pour lancer le scan il faut sélectionner < Exécuter l'analyse en ligne >.
          - On va te demander de télécharger un contrôle active x, accepte .
          - Dans le menu < Choisissez la cible de l'analyse >, sélectionne < Poste de travail >. Le scan va commencer.
          - Poste le rapport qui sera généré stp.
          S'il y a un problème, assure toi que les contrôles active x sont bien configurés dans les options internet comme décrit sur ce lien : http://www.inoculer.com/activex.php3
          Rappel : le scan est à faire sous Internet Explorer
          Tuto ici si problème : http://www.vista-xp.fr/forum/topic109.html

          Bonne soirée.

          A+

          2. soop
            bonjour,

            je comprends pas ,je suis désolé ,j'ai du faire une fausse manip ,car j'avais ecrit plus de choses(dont le bonjour et la réponse a tes questions), mais j'ai du pinailler au cop/col!!!

            oui biensur j'ai envoyé le zip a MAD...

            mon office craqué???? peut etre, je sais pas, c'est pas moi qui l'ai installé... pourquoi, il pourrait poser problème??

            sinon le pc est toujours dans le meme état, déconnexion intempestive (10/20min) bug au redemarrage...

            merci encore DllD
            1. g!rly Contributeur
              Salut Ludo,

              Désolé d´entendre tes déboires :(...

              Franck m´a expliqué, comme il a pu (manque de pô certain :(

              Manu c´est tout de suite proposé pour t´aider :) je ne sais pas si tu as vu son message ?

              J´espére que ça va s´arranger !

              @ bientôt

              Kisses`

              Julie`
              2. Utilisateur anonyme
                Re,
                Tu as encore oublié le bonjour....
                C'est pourtant simple.

                Et tu n'as pas répondu à ma question : pour Office ? C'est un crack ?

                Deux questions de plus :
                1°/ comment va le PC ?
                2°/ As tu envoyé le Zip à MAD (je vais prendre contacte avec eux pour savoir aussi, mais ta réponse sera plus rapide) ?

                PS : il reste quelques fichiers infectieux que révèle le Combofix.
                Après m'avoir répondu on termine.

                A+
                1. soop
                  Malwarebytes' Anti-Malware 1.24
                  Version de la base de données: 1018
                  Windows 5.1.2600 Service Pack 2

                  13:27:40 03/08/2008
                  mbam-log-8-3-2008 (13-27-40).txt

                  Type de recherche: Examen complet (C:\|)
                  Eléments examinés: 113691
                  Temps écoulé: 25 minute(s), 37 second(s)

                  Processus mémoire infecté(s): 0
                  Module(s) mémoire infecté(s): 0
                  Clé(s) du Registre infectée(s): 44
                  Valeur(s) du Registre infectée(s): 0
                  Elément(s) de données du Registre infecté(s): 0
                  Dossier(s) infecté(s): 26
                  Fichier(s) infecté(s): 69

                  Processus mémoire infecté(s):
                  (Aucun élément nuisible détecté)

                  Module(s) mémoire infecté(s):
                  (Aucun élément nuisible détecté)

                  Clé(s) du Registre infectée(s):
                  HKEY_CLASSES_ROOT\CLSID\{c86488af-13d5-4fef-9ddf-9fb88698cfc1} (Trojan.BHO) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\CLSID\{f9ba1aa9-cad4-4c14-bde6-922dff5f6f38} (Trojan.BHO) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\Interface\{d3342887-aab1-428c-90c6-642be0b6cffe} (Trojan.BHO) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\Typelib\{e6bec792-a39d-4512-aa44-41627908dc2e} (Trojan.BHO) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\Interface\{50c4cdd9-22d7-49ff-ac6d-7d4d528a3ab2} (Trojan.BHO) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\webbrowser.browser (Trojan.BHO) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\webbrowser.browser.1 (Trojan.BHO) -> Quarantined and deleted successfully.
                  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7dbc6adb-5788-4fb9-aec3-b40a58ac11df} (Adware.Agent) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\Interface\{0ad3ab16-6d0e-4f04-8660-fb1f36bc2dc0} (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\Interface\{2f685b36-c53a-4653-9231-1dae5736de45} (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\Typelib\{de2267bd-b163-407f-9e8d-6adec771e7ab} (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\newscocomediumspop.popcoco (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\newscocomediumspop.popcoco.1 (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\CLSID\{cde9eb54-a08e-4570-b748-13f5ddb5781c} (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\newadpopup.toolbardetector (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\newadpopup.toolbardetector.1 (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\CLSID\{34a12a06-48c0-420d-8f11-73552ee9631a} (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\newadspushor.bslogic (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\newadspushor.bslogic.1 (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\newpushedshower.bologic (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\newpushedshower.bologic.1 (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\newsadvpusher.brlogic (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\newsadvpusher.brlogic.1 (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\newsmediaspusher.bllogic (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\newsmediaspusher.bllogic.1 (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\newspushershower.bplogic (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\newspushershower.bplogic.1 (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\newspushingshower.bqlogic (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\newspushingshower.bqlogic.1 (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\CLSID\{11f09afd-75ad-4e51-ab43-e09e9351ce16} (Trojan.Clicker) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\Interface\{385ab8c4-fb22-4d17-8834-064e2ba0a6f0} (Adware.Cinmus) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\Typelib\{385ab8c5-fb22-4d17-8834-064e2ba0a6f0} (Adware.Cinmus) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\CLSID\{385ab8c6-fb22-4d17-8834-064e2ba0a6f0} (Trojan.Yigather) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\spyware-secure (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ntptdb (Adware.Agent) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Yiqilai (Adware.Agent) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Spyware-Secure (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Spyware-Secure (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\acpidisk (Adware.Cinmus) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\iehpr.invoke (Trojan.BHO) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\iehpr.invoke.1 (Trojan.BHO) -> Quarantined and deleted successfully.
                  HKEY_CURRENT_USER\SOFTWARE\newpush (Adware.CPush) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\cpush (Adware.CPush) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\MicroPlugins (Malware.Trace) -> Quarantined and deleted successfully.

                  Valeur(s) du Registre infectée(s):
                  (Aucun élément nuisible détecté)

                  Elément(s) de données du Registre infecté(s):
                  (Aucun élément nuisible détecté)

                  Dossier(s) infecté(s):
                  C:\Program Files\Fichiers communs\CPUSH (Adware.CPush) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\resources (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\images (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\FR (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Yiqilai (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Program Files\Yiqilai\wmp (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Program Files\Yiqilai\Temp (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Program Files\Yiqilai\winamp (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Program Files\Yiqilai\foobar (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Program Files\Yiqilai\lib (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Program Files\Yiqilai\html (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Program Files\Yiqilai\tools (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools (Trojan.Yigather) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\t (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\t\ad (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\t\ad\d139d5c216 (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\t\ad\d2087d1212 (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\t\ad\df7609d205 (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\t\ad\d31255c21a (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\t\ad\d8a2c1220f (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\t\ad\d267e10212 (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\t\ad\d2bab8121a (Trojan.Agent) -> Quarantined and deleted successfully.

                  Fichier(s) infecté(s):
                  C:\Program Files\Spyware-Secure\Spyware-Secure_trial.exe (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\System Volume Information\_restore{94D6633F-9D8D-48C4-A605-F1F1C370EA88}\RP606\A0187788.exe (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\sqlite3.dll (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\unrar.dll (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\Spyware-Secure.url (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\uninst.exe (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\language (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\config.s3db (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\skin (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\Gfx_fr.bin (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\quarantine.s3db (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\nbmw (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\resources\malwaresDB_1-12 (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\resources\cookies_1-12.dat (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\resources\filesDesc_1-12.dat (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\resources\filesDesc_1-12.dic (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\resources\filesExt_1-12.dat (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\resources\register_1-12.dat (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\resources\filesMulti_1-12.idx (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\resources\filesSimple_1-12.idx (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR.zip (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\explo_intro.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\explo_menu.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\file.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\folder.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\folder_f.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\folder_o.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\index.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\menu3.js (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\spy.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\trait_coud.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\trait_droit.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\trait_vert.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\fleche.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\folder.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\key.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\menu.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\support.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\title-hepfile.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\FR\dowload-file-antispyware.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\FR\menu.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\FR\scstep2.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs\3differentscan.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs\contactus.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs\found-objects.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs\lexic.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs\navigtabs.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs\quarantine.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs\register.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                  C:\Program Files\Yiqilai\wmp\icon2.ico (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Program Files\Yiqilai\wmp\_keepfile (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Program Files\Yiqilai\wmp\_inifid (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Program Files\Yiqilai\wmp\_inifiletime (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Program Files\Yiqilai\Temp\gen_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Program Files\Yiqilai\Temp\foo_vis_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Program Files\Yiqilai\Temp\icon2.ico (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Program Files\Yiqilai\winamp\gen_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Program Files\Yiqilai\foobar\foo_vis_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Program Files\Yiqilai\lib\YQL_Lyrics_Common.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Program Files\Yiqilai\tools\YiqilaiLyrics.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\t\r2001.dat (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\t\b2001.dat (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\t\k2001.dat (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\t\a2001.dat (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\t\p2001.dat (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\sysloader.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\mscpx32r.det (Malware.Trace) -> Quarantined and deleted successfully.
                  C:\WINDOWS\tempaq (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\mprmsgse.axz (Adware.Cinmus) -> Quarantined and deleted successfully.

                  _____________________________________________________________________

                  Logfile of Trend Micro HijackThis v2.0.0 (BETA)
                  Scan saved at 13:29:40, on 03/08/2008
                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                  Boot mode: Normal

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\csrss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                  C:\Program Files\Alwil Software\Avast4\ashServ.exe
                  C:\WINDOWS\Explorer.EXE
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                  C:\WINDOWS\System32\alg.exe
                  C:\WINDOWS\soundman.exe
                  C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
                  C:\WINDOWS\system32\rundll32.exe
                  C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
                  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                  C:\WINDOWS\system32\ctfmon.exe
                  C:\Program Files\SuperCopier2\SuperCopier2.exe
                  C:\WINDOWS\system32\wuauclt.exe
                  C:\Documents and Settings\endeavour\Bureau\HiJackThis_v2.exe
                  C:\WINDOWS\System32\wbem\wmiprvse.exe

                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.zhaodao123.com/
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.acer.com/worldwide/selection.html
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fimg%2ffr%2ffr-fr%2fmsger%2ftabs%2f_pictos%2fcoca%2fPictoCoke02.png%3f
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
                  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                  O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                  O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                  O4 - HKLM\..\Run: [SoundMan] soundman.exe
                  O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
                  O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
                  O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
                  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                  O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe
                  O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange HSS\Systray\SystrayApp.exe"
                  O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange HSS\SessionManager\SessionManager.exe
                  O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
                  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                  O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
                  O4 - HKCU\..\Run: [EPSON Stylus DX7400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE /FU "C:\WINDOWS\TEMP\E_SA1D.tmp" /EF "HKCU"
                  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                  O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
                  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
                  O15 - Trusted Zone: https://www.orange.fr/portail
                  O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
                  O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
                  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                  O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                  O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
                  O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
                  O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - Unknown owner - C:\Program Files\Securitoo\av_fw\fswsclds.exe (file missing)
                  O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
                  O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
                  O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
                  O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
                  O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
                  O23 - Service: System Event loader (sysloader) - Unknown owner - C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\sysloader.exe (file missing)
                  O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
                  O23 - Service: Telnet (TlntSvr) - Unknown owner - C:\WINDOWS\System32\tlntsvr.exe
                  O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
                  O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
                  O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
                  1. Utilisateur anonyme
                    Bonjour à tous,

                    Ok Soop, pas de souci. Sauf pour ton PC.
                    Si je mets du temps à répondre c'est que mes problèmes ne se sont pas arrangés. J'ai planté le MBR de mon PC (la zone amorce), ce qui fait que je ne peux plus booter : aucun démarrage possible et le disque dur n'est plus reconnu même démonter et branché en USB sur une autre bécane : Kedall alors que j'ai de précieuses informations dessus.
                    Si ça avait été un moteur de voiture, après deux jours de recherches intensives, je serais couvert de camboui.

                    Bref,
                    place à ton PC :
                    Quand je te parle d'infection chinoise, regarde un peu ici :

                    MBAM dit ici : http://www.commentcamarche.net/forum/affich 7664818 desinstaller gestionnaire orange?page=2#23

                    C:\Program Files\Yiqilai\wmp\icon2.ico (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\Program Files\Yiqilai\wmp\_keepfile (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\Program Files\Yiqilai\wmp\_inifid (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\Program Files\Yiqilai\wmp\_inifiletime (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\Program Files\Yiqilai\Temp\gen_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\Program Files\Yiqilai\Temp\foo_vis_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\Program Files\Yiqilai\Temp\icon2.ico (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\Program Files\Yiqilai\winamp\gen_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\Program Files\Yiqilai\foobar\foo_vis_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\Program Files\Yiqilai\lib\YQL_Lyrics_Common.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\Program Files\Yiqilai\tools\YiqilaiLyrics.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\Program Files\Yiqilai\wmp\icon2.ico (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\Program Files\Yiqilai\wmp\_keepfile (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\Program Files\Yiqilai\wmp\_inifid (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\Program Files\Yiqilai\wmp\_inifiletime (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\Program Files\Yiqilai\Temp\gen_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\Program Files\Yiqilai\Temp\foo_vis_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\Program Files\Yiqilai\Temp\icon2.ico (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\Program Files\Yiqilai\winamp\gen_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\Program Files\Yiqilai\foobar\foo_vis_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\Program Files\Yiqilai\lib\YQL_Lyrics_Common.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\Program Files\Yiqilai\tools\YiqilaiLyrics.exe (Trojan.Agent) -> Quarantined and deleted successfully.

                    Google dit là :
                    https://www.google.com/search?client=firefox-a&rls=org.mozilla%3Afr%3Aofficial&channel=s&hl=fr&q=Yiqilai&lr=lang_fr&btnG=Recherche+Google&gws_rd=ssl
                    et
                    https://www.google.com/search?hl=fr&client=firefox-a&channel=s&rls=org.mozilla%3Afr%3Aofficial&q=YiqilaiLyrics.exe+&btnG=Rechercher&lr=lang_fr&gws_rd=ssl
                    http://www.commentcamarche.net/forum/affich 3884524 virus chinois

                    Comme tu peux le voir c'est très peu référencé : une infection ""nouvelle"" mais pas temporellement. Je dirais plutôt infection rare en fait. Tu es donc pour moi un cas très intéressant. Merci.
                    Je vais pouvoir en informer certains services qui font de la recherche en ce domaine et avertissent les fabricants d'antivirus pour assurer les mises à jour. C'est comme cela que ça fonctionne. Si les bases antivirales de ton AV sont à jour c'est, en partie, due à des bénévoles passionnés.

                    Je vais donc te demander ceci :
                    - Ouvre Malwarebyte's antimalwares puis fais les mises à jour.
                    - Clique sur l'onglet "Quarantaine" puis sur le bouton "Tout restaurer".
                    - Navigue dans ton disque dur jusqu'à C:\Program Files\Yiqilai
                    - Fais un copier/coller du dossier Yiqilai dans un nouveau dossier nommé MAD-DllD-Yiqilai (copie/colle ce nom en gras) préalablement crée sur ton bureau.
                    - Transforme ce dossier en une archive pourtant le même nom. Choisis comme taux de compression le plus élevé si c'est possible. (Si tu n'as pas de logiciel d'archivage tu peux utiliser Izarc : http://www.commentcamarche.net/telecharger/telecharger 231 izarc Tuto : http://artic.ac-besancon.fr/arts_plastiques/ArtTice/apdidactic/TUTOizarc.pdf (partie comment zipper un dossier)).
                    - Rends toi sur ce site : http://secubox.gateweb.org/mad.php et envoie le zip grâce à parcourir => bureau => MAD-DllD.zip
                    - Poste en temps que commentaire dans Veuillez indiquer ci-dessous le message destiné à notre équipe: le texte en italique suivant (fais un copier/coller) :

                    Bonjour,
                    Je suis actuellement sur la discussion suivante : http://www.commentcamarche.net/forum/affich 7664818 desinstaller gestionnaire orange contenant des informations susceptibles de vous intéresser.
                    J'ai demander à l'utilisateur Soop de vous faire parvenir un Zip des infections incriminées. J'espère que ces informations vous seront utiles dans votre lutte antimalwares.
                    En vous souhaitant bonne réception du document.
                    Bien à vous,
                    DllD

                    Merci pour ta contribution : à travers cette action tu vas participer à la lutte contre les véroles du web. C'est important que tu effectues cette opération.
                    PS : si, à tout hasard, le zip est trop lourd pour être envoyé directement, alors utilise ce service : http://dl.free.fr/

                    Alors, je t'explique :
                    Dans ton dernier rapport (HJT) :

                    O8 - Extra context menu item: Ò×Ȥ¹ºÎï - C:\Program Files\AD4All\link1\eachlink.htm

                    C'est là, en partie, le problème (je pense). Regarde ici :
                    http://www.ca.com/ca/fr/securityadvisor/pest/pest.aspx?id=453099549
                    => Catégorie : Adware

                    Après on verra ce qu'il reste dans les futurs rapports.

                    Aller,
                    suffit de tergiverser, place au nettoyage :

                    Supprime le dossier et l'archive MAD-DllD-Yiqilai présent sur ton bureau puis vide ta corbeille.

                    Lance MalwareByte's en mode sans échec, effectue une examen complet, supprime tous les éléments trouvés puis poste le rapport obtenu après suppression.

                    Ensuite,
                    > Lance Hijackthis :
                    - Puis sélectionne < Do a system scan only >
                    - Coche les cases des lignes suivantes : 

                    R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) 

O8 - Extra context menu item: Ò×Ȥ¹ºÎï - C:\Program Files\AD4All\link1\eachlink.htm 

O23 - Service: System Event loader (sysloader) - Unknown owner - C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\sysloader.exe (file missing)

                    Ensuite,
                    - Ferme toutes les autres fenêtres et applications (même internet)
                    - Clic sur < fixe checked >

                    > Relance ton PC en mode normal puis Hijackthis :
                    Puis sélectionne < do a system scan and save a logfile >,

                    Et envoie, par collier/coller, ton log Hijackthis stp,

                    Après,
                    > Télécharge ComboFix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe (par sUBs) sur ton Bureau.
                    Déconnecte toi du net et désactive ton antivirus pour que Combofix puisse s'exécuter normalement.
                    - Double clique combofix.exe
                    - Tape sur la touche 1 (Yes) pour démarrer le scan.
                    - Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
                    NOTE : Le rapport se trouve également ici : C:\Combofix.txt
                    Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

                    Bon courage,
                    Honnêtement ta version d'Office est crackée, non ?

                    PS : info : http://www.who.is/domain_archive-com/yiqilai.com/

                    A+
                    1. soop
                      bonjour,

                      désolé je suis vraiment confu ,c'est pas à mon habitude de ne pas prendre le temps pour les politesses sur le net ,le coeur yest mais c'est ptet le stress de devoir copier tout mes posts ,rallumez mon pc reprendre la copie et n'arriver qu'une fois sur deux a vous poster ça!

                      excusez moi, j'espere que vous ne m'y reprendrez pas !

                      et merci a clem d'avoir avertit DllD qui m'a bien aidé jusqu'ici, j'espere que tu m'en veut pas trop!!!

                      a plus...
                      1. clem73 Modérateur
                        Bonsoir soop,

                        C'est vrai que les bug de post sur le site en ce moment, mettent un peu à cran...ça va bien finir par s'arranger.
                        Mais bon, ça n'excuse pas tout non plus... être poli et courtois c'est plutôt apprécié sur le site ;-)

                        En plus les problèmes de machine, eh bien ça arrive aussi aux helpers, pas de bol !

                        DllD a des soucis avec son PC (Linux...),alors patiente un peu jusqu'à son retour...

                        ;)
                    2. Utilisateur anonyme
                      BONJOUR !

                      Mon PC a planté suite à l'installation d'une distribution Linux. Je t'écris actuellement d'un autre PC.

                      Jusqu'à présent nous avons retiré beaucoup de cochonneries sur ta bécane. Il en reste : je les vois très bien, notamment une infection d'origine chinoise qui doit certainement être à l'origine de tes problèmes.

                      Mais,
                      http://www.commentcamarche.net/forum/affich 7664818 desinstaller gestionnaire orange?page=2#24
                      http://www.commentcamarche.net/forum/affich 7664818 desinstaller gestionnaire orange?page=2#25

                      Donc commence par utiliser ce fix : http://www.technicland.com/malpolitus.swf

                      Après on continuera.

                      Bonne journée.
                      1. soop
                        plus personne pour me guider?

                        vous n'avez plus d'idée , les rapports otmoveit; hijack et malware n'indiquent rien?
                        2. soop
                          File/Folder C:\WINDOWS\system32\SoTools.dll not found.
                          File/Folder C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\sysloader.exe not found.

                          OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07312008_164455

                          ________________________________________________________________________________

                          Malwarebytes' Anti-Malware 1.24
                          Version de la base de données: 1012
                          Windows 5.1.2600 Service Pack 2

                          17:07:00 31/07/2008
                          mbam-log-7-31-2008 (17-07-00).txt

                          Type de recherche: Examen complet (C:\|)
                          Eléments examinés: 111843
                          Temps écoulé: 15 minute(s), 36 second(s)

                          Processus mémoire infecté(s): 0
                          Module(s) mémoire infecté(s): 0
                          Clé(s) du Registre infectée(s): 47
                          Valeur(s) du Registre infectée(s): 2
                          Elément(s) de données du Registre infecté(s): 1
                          Dossier(s) infecté(s): 26
                          Fichier(s) infecté(s): 69

                          Processus mémoire infecté(s):
                          (Aucun élément nuisible détecté)

                          Module(s) mémoire infecté(s):
                          (Aucun élément nuisible détecté)

                          Clé(s) du Registre infectée(s):
                          HKEY_CLASSES_ROOT\CLSID\{c86488af-13d5-4fef-9ddf-9fb88698cfc1} (Trojan.BHO) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\CLSID\{f9ba1aa9-cad4-4c14-bde6-922dff5f6f38} (Trojan.BHO) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\Interface\{d3342887-aab1-428c-90c6-642be0b6cffe} (Trojan.BHO) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\Typelib\{e6bec792-a39d-4512-aa44-41627908dc2e} (Trojan.BHO) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\Interface\{50c4cdd9-22d7-49ff-ac6d-7d4d528a3ab2} (Trojan.BHO) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\webbrowser.browser (Trojan.BHO) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\webbrowser.browser.1 (Trojan.BHO) -> Quarantined and deleted successfully.
                          HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7dbc6adb-5788-4fb9-aec3-b40a58ac11df} (Adware.Agent) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\Interface\{0ad3ab16-6d0e-4f04-8660-fb1f36bc2dc0} (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\Interface\{2f685b36-c53a-4653-9231-1dae5736de45} (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\Typelib\{de2267bd-b163-407f-9e8d-6adec771e7ab} (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\newscocomediumspop.popcoco (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\newscocomediumspop.popcoco.1 (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\CLSID\{cde9eb54-a08e-4570-b748-13f5ddb5781c} (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\newadpopup.toolbardetector (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\newadpopup.toolbardetector.1 (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\CLSID\{34a12a06-48c0-420d-8f11-73552ee9631a} (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\newadspushor.bslogic (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\newadspushor.bslogic.1 (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\newpushedshower.bologic (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\newpushedshower.bologic.1 (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\newsadvpusher.brlogic (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\newsadvpusher.brlogic.1 (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\newsmediaspusher.bllogic (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\newsmediaspusher.bllogic.1 (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\newspushershower.bplogic (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\newspushershower.bplogic.1 (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\newspushingshower.bqlogic (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\newspushingshower.bqlogic.1 (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\CLSID\{11f09afd-75ad-4e51-ab43-e09e9351ce16} (Trojan.Clicker) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\Interface\{385ab8c4-fb22-4d17-8834-064e2ba0a6f0} (Adware.Cinmus) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\Typelib\{385ab8c5-fb22-4d17-8834-064e2ba0a6f0} (Adware.Cinmus) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\CLSID\{385ab8c6-fb22-4d17-8834-064e2ba0a6f0} (Trojan.Yigather) -> Quarantined and deleted successfully.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\spyware-secure (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ntptdb (Adware.Agent) -> Quarantined and deleted successfully.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Yiqilai (Adware.Agent) -> Quarantined and deleted successfully.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Spyware-Secure (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Spyware-Secure (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\acpidisk (Adware.Cinmus) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\iehpr.invoke (Trojan.BHO) -> Quarantined and deleted successfully.
                          HKEY_CLASSES_ROOT\iehpr.invoke.1 (Trojan.BHO) -> Quarantined and deleted successfully.
                          HKEY_CURRENT_USER\SOFTWARE\newpush (Adware.CPush) -> Quarantined and deleted successfully.
                          HKEY_LOCAL_MACHINE\SOFTWARE\cpush (Adware.CPush) -> Quarantined and deleted successfully.
                          HKEY_LOCAL_MACHINE\SOFTWARE\MicroPlugins (Malware.Trace) -> Quarantined and deleted successfully.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IDSCNP (Malware.Trace) -> Quarantined and deleted successfully.
                          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ms_2fax (Trojan.Adclicker) -> Quarantined and deleted successfully.
                          HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\ntptdb (Trojan.Agent) -> Quarantined and deleted successfully.

                          Valeur(s) du Registre infectée(s):
                          HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{7dbc6adb-5788-4fb9-aec3-b40a58ac11df} (Adware.Agent) -> Quarantined and deleted successfully.
                          HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{ee60714f-ac17-427e-861a-fd60cbdf119a} (Trojan.Agent) -> Quarantined and deleted successfully.

                          Elément(s) de données du Registre infecté(s):
                          HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

                          Dossier(s) infecté(s):
                          C:\Program Files\Fichiers communs\CPUSH (Adware.CPush) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\resources (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\images (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\FR (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Yiqilai (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Program Files\Yiqilai\wmp (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Program Files\Yiqilai\Temp (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Program Files\Yiqilai\winamp (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Program Files\Yiqilai\foobar (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Program Files\Yiqilai\lib (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Program Files\Yiqilai\html (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Program Files\Yiqilai\tools (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools (Trojan.Yigather) -> Quarantined and deleted successfully.
                          C:\Documents and Settings\All Users\Application Data\t (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Documents and Settings\All Users\Application Data\t\ad (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Documents and Settings\All Users\Application Data\t\ad\d139d5c216 (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Documents and Settings\All Users\Application Data\t\ad\d2087d1212 (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Documents and Settings\All Users\Application Data\t\ad\df7609d205 (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Documents and Settings\All Users\Application Data\t\ad\d31255c21a (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Documents and Settings\All Users\Application Data\t\ad\d8a2c1220f (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Documents and Settings\All Users\Application Data\t\ad\d267e10212 (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Documents and Settings\All Users\Application Data\t\ad\d2bab8121a (Trojan.Agent) -> Quarantined and deleted successfully.

                          Fichier(s) infecté(s):
                          C:\Program Files\Spyware-Secure\Spyware-Secure_trial.exe (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\sqlite3.dll (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\unrar.dll (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\Spyware-Secure.url (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\uninst.exe (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\language (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\config.s3db (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\skin (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\Gfx_fr.bin (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\quarantine.s3db (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\nbmw (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\resources\malwaresDB_1-12 (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\resources\cookies_1-12.dat (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\resources\filesDesc_1-12.dat (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\resources\filesDesc_1-12.dic (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\resources\filesExt_1-12.dat (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\resources\register_1-12.dat (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\resources\filesMulti_1-12.idx (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\resources\filesSimple_1-12.idx (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR.zip (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\explo_intro.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\explo_menu.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\file.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\folder.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\folder_f.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\folder_o.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\index.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\menu3.js (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\spy.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\trait_coud.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\trait_droit.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\trait_vert.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\fleche.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\folder.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\key.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\menu.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\support.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\title-hepfile.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\FR\dowload-file-antispyware.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\FR\menu.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\FR\scstep2.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs\3differentscan.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs\contactus.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs\found-objects.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs\lexic.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs\navigtabs.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs\quarantine.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs\register.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                          C:\Program Files\Yiqilai\wmp\icon2.ico (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Program Files\Yiqilai\wmp\_keepfile (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Program Files\Yiqilai\wmp\_inifid (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Program Files\Yiqilai\wmp\_inifiletime (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Program Files\Yiqilai\Temp\gen_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Program Files\Yiqilai\Temp\foo_vis_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Program Files\Yiqilai\Temp\icon2.ico (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Program Files\Yiqilai\winamp\gen_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Program Files\Yiqilai\foobar\foo_vis_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Program Files\Yiqilai\lib\YQL_Lyrics_Common.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Program Files\Yiqilai\tools\YiqilaiLyrics.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Documents and Settings\All Users\Application Data\t\r2001.dat (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Documents and Settings\All Users\Application Data\t\b2001.dat (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Documents and Settings\All Users\Application Data\t\k2001.dat (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Documents and Settings\All Users\Application Data\t\a2001.dat (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\Documents and Settings\All Users\Application Data\t\p2001.dat (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\WINDOWS\system32\sysloader.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\WINDOWS\system32\mscpx32r.det (Malware.Trace) -> Quarantined and deleted successfully.
                          C:\WINDOWS\tempaq (Trojan.Agent) -> Quarantined and deleted successfully.
                          C:\WINDOWS\system32\mprmsgse.axz (Adware.Cinmus) -> Quarantined and deleted successfully.
                          C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\SYSTEM\ntptdb.sys (Trojan.Agent) -> Quarantined and deleted successfully.

                          ______________________________________________________________________

                          Logfile of Trend Micro HijackThis v2.0.0 (BETA)
                          Scan saved at 17:14:17, on 31/07/2008
                          Platform: Windows XP SP2 (WinNT 5.01.2600)
                          Boot mode: Normal

                          Running processes:
                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                          C:\Program Files\Alwil Software\Avast4\ashServ.exe
                          C:\WINDOWS\Explorer.EXE
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                          C:\WINDOWS\System32\svchost.exe
                          C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                          C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                          C:\WINDOWS\soundman.exe
                          C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
                          C:\WINDOWS\system32\rundll32.exe
                          C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
                          C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                          C:\WINDOWS\system32\ctfmon.exe
                          C:\WINDOWS\system32\wuauclt.exe
                          C:\Program Files\Mozilla Firefox\firefox.exe
                          C:\Documents and Settings\endeavour\Bureau\HiJackThis_v2.exe

                          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.zhaodao123.com/
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.acer.com/worldwide/selection.html
                          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fimg%2ffr%2ffr-fr%2fmsger%2ftabs%2f_pictos%2fcoca%2fPictoCoke02.png%3f
                          R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                          R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                          R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
                          R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                          O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
                          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                          O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                          O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                          O4 - HKLM\..\Run: [SoundMan] soundman.exe
                          O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
                          O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
                          O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
                          O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                          O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe
                          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                          O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
                          O4 - HKCU\..\Run: [EPSON Stylus DX7400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE /FU "C:\WINDOWS\TEMP\E_SA1D.tmp" /EF "HKCU"
                          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                          O8 - Extra context menu item: Ò×Ȥ¹ºÎï - C:\Program Files\AD4All\link1\eachlink.htm
                          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
                          O15 - Trusted Zone: https://www.orange.fr/portail
                          O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
                          O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
                          O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                          O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                          O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                          O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                          O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                          O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
                          O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
                          O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - Unknown owner - C:\Program Files\Securitoo\av_fw\fswsclds.exe (file missing)
                          O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
                          O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
                          O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
                          O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
                          O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
                          O23 - Service: System Event loader (sysloader) - Unknown owner - C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\sysloader.exe (file missing)
                          O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
                          O23 - Service: Telnet (TlntSvr) - Unknown owner - C:\WINDOWS\System32\tlntsvr.exe
                          O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
                          O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
                          O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
                          1. Utilisateur anonyme
                            Ok,

                            Alors :
                            > Lance Hijackthis :
                            - Puis sélectionne < Do a system scan only >
                            - Coche les cases des lignes suivantes : 

                            R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll (file missing)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Adobe Common Objects - {986488AF-13D5-9DDF-4FEF-9FB88698CFC1} - C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\LHyhCo29Sb.dll (file missing)
O2 - BHO: Century Class - {B9893324-6B8F-4C54-98A8-D22194403550} - C:\WINDOWS\system32\SoTools.dll

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

O9 - Extra button: Ò»ÆðÀ´ÒôÀÖÉçÇø - {7DBC6ADB-5788-4FB9-AEC3-B40A58AC11DF} - http://www.yiqilai.com (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O16 - DPF: {14578416-1111-1111-1111-111111411123} - file://c:\windows\system32\calc.exe

O23 - Service: System Event loader (sysloader) - Unknown owner - C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\sysloader.exe (file missing)

                            Ensuite,
                            - Ferme toutes les autres fenêtres et applications (même internet)
                            - Clic sur < fixe checked >

                            > Télécharge OTMoveIT (de Old_Timer) : http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe sur ton bureau...
                            - Double-clique sur OTMoveIt.exe pour le lancer.
                            - Assure toi que la case "Unregister Dll's and Ocx's" est bien cochée !!!
                            - Copie le texte qui se trouve ci-dessous et colle-le dans le cadre de gauche de OTMoveIt nommé <Paste standard List of Files/Folders to be moved>. 

                            C:\WINDOWS\system32\SoTools.dll
C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\sysloader.exe

                            - Clique sur < MoveIt! > pour lancer la suppression.
                            - Lorsqu'un résultat apparaît dans le cadre Results clique sur Exit
                            N.B :Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. Accepte en cliquant sur YES.
                            Un rapport est créé dans %SYSTEMDRIVE%\_OTMoveIt\MovedFiles\date du jour (C:\_OTMoveIt\MovedFiles\), copie-colle-le dans ta réponse suivante stp.

                            Ensuite,
                            > Les logiciels suivants (MalwareByte's Anti-Malware et Ccleaner) te seront utiles par la suite - ils sont à conserver...

                            > Télécharge MalwareByte's Anti-Malware :
                            - Installe le programme puis lance le stp.
                            NB : S'il te manque COMCTL32.OCX alors télécharge le ici
                            - Fais les mises à jour (clique sur "Mises à jour" puis "Recherche de mises à jour") puis ferme le programme.
                            NB : Si tu as besoin : Tuto

                            > Télécharge et installe Ccleaner :
                            Si besoin est tu trouveras des Tutoriaux : ici, ici et là.

                            > Commence par faire un copier/coller de ce poste (cette manip.): (conseillé)
                            Ouvre un nouveau fichier Bloc notes (clique sur "Démarrer" => "Programmes" =>"Accessoires" => "Bloc notes"),
                            puis fait un copier/coller de tout le contenu de la fenêtre de ce poste dans le fichier texte.
                            Sauvegarde le sur le bureau, tu pourras alors y avoir accès même déconnecté ou en mode sans échec.

                            > Démarre en mode sans échec (ne passe pas par MSconfig pour le faire): (image). Si problème : tuto ici

                            > Lance MalwareByte's Anti-Malware,
                            - Clique sur "Executer un examen complet" puis "Rechercher" et sélectionne tous tes disques durs => le scan débute....patiente...
                            - A la fin du scanne, clique sur "supprimer" (Si des éléments sont difficiles à supprimer, un message te demandera de redémarrer : clique sur "Oui" alors)
                            - après suppression des infections : un rapport va être généré : sauvegarde le et poste le sur forum.

                            > Lance Ccleaner,
                            - Choisi l’onglet "Options" puis clique sur "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier temp de Windows, plus vieux que 48 heures" (tout doit être supprimé).
                            - Dans l'onglet "Nettoyeur" clique sur "Analyse".
                            - Une fois l'analyse terminée, clique sur "Lancer le Nettoyage".
                            - Dans l'onglet "registre" => Recherches des erreurs => Réparer les erreurs sélectionnées => enregistre une sauvegarde => corriger toutes erreurs sélectionnées => ok => fermer.
                            N.B : Si Ccleaner te propose d'enregistrer une sauvegarde, reponds oui et enregistre sous 'Bureau'
                            Recommence jusqu’à ce qu’il ne trouve plus rien (cela varie en général entre 1 et 4 fois).

                            > Relance ton PC en mode normal

                            > Relance Hijackthis :
                            Puis sélectionne < do a system scan and save a logfile >,
                            Et envoie moi, par collier/coller, ton log Hijackthis,

                            Bon courage,

                            A+
                            1. soop
                              Logfile of Trend Micro HijackThis v2.0.0 (BETA)
                              Scan saved at 16:13:21, on 31/07/2008
                              Platform: Windows XP SP2 (WinNT 5.01.2600)
                              Boot mode: Normal

                              Running processes:
                              C:\WINDOWS\System32\smss.exe
                              C:\WINDOWS\system32\winlogon.exe
                              C:\WINDOWS\system32\services.exe
                              C:\WINDOWS\system32\lsass.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\System32\svchost.exe
                              C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                              C:\Program Files\Alwil Software\Avast4\ashServ.exe
                              C:\WINDOWS\system32\spoolsv.exe
                              C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                              C:\WINDOWS\System32\svchost.exe
                              C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                              C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                              C:\WINDOWS\Explorer.EXE
                              C:\WINDOWS\soundman.exe
                              C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
                              C:\WINDOWS\system32\rundll32.exe
                              C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
                              C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                              C:\WINDOWS\system32\ctfmon.exe
                              C:\WINDOWS\system32\wuauclt.exe
                              C:\WINDOWS\system32\wuauclt.exe
                              C:\Program Files\Mozilla Firefox\firefox.exe
                              C:\Documents and Settings\endeavour\Bureau\HiJackThis_v2.exe

                              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.zhaodao123.com/
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://GLOBAL.ACER.COM/
                              R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fimg%2ffr%2ffr-fr%2fmsger%2ftabs%2f_pictos%2fcoca%2fPictoCoke02.png%3f
                              R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                              R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                              R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                              R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange HSS\SearchURLHook\SearchPageURL.dll (file missing)
                              R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll (file missing)
                              R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                              O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
                              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                              O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                              O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                              O2 - BHO: Adobe Common Objects - {986488AF-13D5-9DDF-4FEF-9FB88698CFC1} - C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\LHyhCo29Sb.dll (file missing)
                              O2 - BHO: Century Class - {B9893324-6B8F-4C54-98A8-D22194403550} - C:\WINDOWS\system32\SoTools.dll
                              O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                              O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                              O4 - HKLM\..\Run: [SoundMan] soundman.exe
                              O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
                              O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
                              O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
                              O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                              O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe
                              O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                              O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
                              O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
                              O4 - HKCU\..\Run: [EPSON Stylus DX7400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE /FU "C:\WINDOWS\TEMP\E_SA1D.tmp" /EF "HKCU"
                              O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                              O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                              O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                              O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                              O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                              O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
                              O8 - Extra context menu item: Ò×Ȥ¹ºÎï - C:\Program Files\AD4All\link1\eachlink.htm
                              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                              O9 - Extra button: Ò»ÆðÀ´ÒôÀÖÉçÇø - {7DBC6ADB-5788-4FB9-AEC3-B40A58AC11DF} - http://www.yiqilai.com (file missing)
                              O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
                              O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                              O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                              O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
                              O15 - Trusted Zone: https://www.orange.fr/portail
                              O16 - DPF: {14578416-1111-1111-1111-111111411123} - file://c:\windows\system32\calc.exe
                              O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
                              O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
                              O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                              O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                              O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                              O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                              O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                              O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
                              O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
                              O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - Unknown owner - C:\Program Files\Securitoo\av_fw\fswsclds.exe (file missing)
                              O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
                              O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
                              O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
                              O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
                              O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
                              O23 - Service: System Event loader (sysloader) - Unknown owner - C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\sysloader.exe (file missing)
                              O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
                              O23 - Service: Telnet (TlntSvr) - Unknown owner - C:\WINDOWS\System32\tlntsvr.exe
                              O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
                              O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
                              O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
                              1. clem73 Modérateur
                                Encore des problèmes d'affichage de post...

                                Et "Sézame ouvre toi"... Ludo, ça marche aussi pour le faire réapparaître, tu crois ? ;-)

                                1. Utilisateur anonyme
                                  Re,

                                  je crois que j'ai pas fait les deux dans le bon sens! une importance?,
                                  aucune. Pas grave.

                                  Peux reposter un nouveau rapport HiJackT ?

                                  Et pour ta connexion ?

                                  A+
                                  1. soop
                                    Clean Navipromo version 3.6.1 commencé le 31/07/2008 à 15:42:34,95

                                    Outil exécuté depuis C:\Program Files\navilog1
                                    Session actuelle : "endeavour"

                                    Mise à jour le 19.07.2008 à 20h00 par IL-MAFIOSO

                                    Microsoft Windows XP [version 5.1.2600]
                                    Internet Explorer : 6.0.2900.2180
                                    Système de fichiers : FAT32

                                    Mode suppression automatique
                                    avec prise en charge résultats Catchme et GNS

                                    Nettoyage exécuté au redémarrage de l'ordinateur

                                    *** fsbl1.txt non trouvé ***
                                    (Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)

                                    *** Suppression avec sauvegardes résultats GenericNaviSearch ***

                                    * Suppression dans "C:\WINDOWS\System32" *

                                    * Suppression dans "C:\Documents and Settings\endeavour\locals~1\applic~1" *

                                    * Suppression dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *

                                    * Suppression dans "C:\DOCUME~1\MIREILLE\locals~1\applic~1" *

                                    *** Suppression dossiers dans "C:\WINDOWS" ***

                                    *** Suppression dossiers dans "C:\Program Files" ***

                                    *** Suppression dossiers dans "C:\Documents and Settings\All Users\menudÉ~1\progra~1" ***

                                    *** Suppression dossiers dans "C:\Documents and Settings\All Users\menudÉ~1" ***

                                    *** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***

                                    *** Suppression dossiers dans "C:\Documents and Settings\endeavour\applic~1" ***

                                    *** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" ***

                                    *** Suppression dossiers dans "C:\DOCUME~1\MIREILLE\applic~1" ***

                                    *** Suppression dossiers dans "C:\Documents and Settings\endeavour\locals~1\applic~1" ***

                                    *** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" ***

                                    *** Suppression dossiers dans "C:\DOCUME~1\MIREILLE\locals~1\applic~1" ***

                                    *** Suppression dossiers dans "C:\Documents and Settings\endeavour\menud+~1\progra~1" ***

                                    *** Suppression fichiers ***

                                    C:\WINDOWS\system32\nvs2.inf supprimé !

                                    *** Suppression fichiers temporaires ***

                                    Nettoyage contenu C:\WINDOWS\Temp effectué !
                                    Nettoyage contenu C:\Documents and Settings\endeavour\locals~1\Temp effectué !

                                    *** Traitement Recherche complémentaire ***
                                    (Recherche fichiers spécifiques)

                                    1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

                                    2)Recherche, création sauvegardes et suppression Heuristique :

                                    * Dans "C:\WINDOWS\system32" *

                                    * Dans "C:\Documents and Settings\endeavour\locals~1\applic~1" *

                                    jignndllod.dat trouvé !
                                    Copie jignndllod.dat réalisée avec succès !
                                    jignndllod.dat supprimé !

                                    jignndllod_nav.dat trouvé !
                                    Copie jignndllod_nav.dat réalisée avec succès !
                                    jignndllod_nav.dat supprimé !

                                    jignndllod_navps.dat trouvé !
                                    Copie jignndllod_navps.dat réalisée avec succès !
                                    jignndllod_navps.dat supprimé !

                                    * Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *

                                    * Dans "C:\DOCUME~1\MIREILLE\locals~1\applic~1" *

                                    *** Sauvegarde du Registre vers dossier Safebackup ***

                                    sauvegarde du Registre réalisée avec succès !

                                    *** Nettoyage Registre ***

                                    Nettoyage Registre Ok

                                    *** Certificats ***

                                    Certificat Egroup supprimé !
                                    Certificat Electronic-Group supprimé !
                                    Certificat OOO-Favorit supprimé !
                                    Certificat Sunny-Day-Design-Ltdt absent !

                                    *** Nettoyage terminé le 31/07/2008 à 15:46:22,43 ***

                                    ________________________________________
                                    je crois que j'ai pas fait les deux dans le bon sens! une importance?
                                    • 1
                                    • 2

                                    Discussions similaires

                                    Livebox 4 Réseau Orange non détecté
                                    Azfun

                                    10 réponses
                                    Comment désinstaller une application sous Mac
                                    rory gallagher

                                    24 réponses