éliminer antivirus 2008

Résolu
pierre83 -  
Bonjour,
je suis infecté par le rogue "antivirus 2008", j'utilise windows XP.
Je viens de faire tourner "Malwarebyte's antimalware"
j'ai supprimé toutes les infections trouvées, puis j'ai redémarrer mon ordi, mais ça ne marche pas, j'ai toujours le virus et il y en a même d'autres qui sont apparus.
Voici le copie du rapport de maware :

Malwarebytes' Anti-Malware 1.26
Version de la base de données: 1104
Windows 5.1.2600 Service Pack 2

03/09/2008 07:22:34
mbam-log-2008-09-03 (07-22-33).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 227264
Temps écoulé: 1 hour(s), 26 minute(s), 20 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 34
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 63

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\xml.xml (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{9233c3c0-1472-4091-a505-5580a23bb4ac} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\xml.xml.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{54645654-2225-4455-44a1-9f4543d34545} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5c7f15e1-f31a-44fd-aa1a-2ec63aaffd3a} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\dpcproxy (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Classes\hol5_vxiewer.full.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Invictus (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Golden Palace Casino PT (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\rdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Security Tools (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video ActiveX Solution (Trojan.Zlob) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Somefox (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.113.126 85.255.112.227 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.113.126 85.255.112.227 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.113.126 85.255.112.227 -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\WINDOWS\system32\smp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\msxml71.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\4ZADEGTD\scan[1].exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\smp\msrc.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sav.cpl (Rogue.SystemAntivirus2008) -> Quarantined and deleted successfully.
C:\Program Files\SAV\sav.exe (Rogue.SystemAntivirus) -> Quarantined and deleted successfully.
C:\Program Files\SAV\sav.cpl (Rogue.SystemAntivirus) -> Quarantined and deleted successfully.
C:\Program Files\SAV\sav0.dat (Rogue.SystemAntivirus) -> Quarantined and deleted successfully.
C:\Program Files\SAV\sav1.dat (Rogue.SystemAntivirus) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tdssadw.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssl.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssserf.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssmain.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssinit.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdsslog.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssservers.dat (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\drivers\tdssserv.sys (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\a.bat (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\base64.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\FVProtect.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\userconfig9x.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\winsystem.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\zip1.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\zip2.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\zip3.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\zipped.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\bdn.com (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\iTunesMusic.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\mssecu.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\akttzn.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bdn.com (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bsva-egihsg52.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hxiwlgpm.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hxiwlgpm.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\medup020.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\msgp.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mssecu.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\msvchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mtr2.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mwin32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\netode.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\newsd32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ps1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\psof1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\psoft1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\regc64.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\regm64.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\Rundl1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ssvchost.com (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ssvchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sysreq.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\taack.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\taack.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\thun.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\thun32.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\VBIEWER.OCX (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winlogonpc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winsystem.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\WINWGPX.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vbsys2.dll (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\WINDOWS\Downloaded Program Files\EGCOMSERVICE_pack.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\etc\.protected (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\.protected (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Bureau\System Antivirus 2008.lnk (Rogue.SystemAntivirus2008) -> Quarantined and deleted successfully.

que faire ? Merci de votre aide
Configuration: Windows XP
Internet Explorer 7.0

40 réponses

Résumé de la discussion

Un utilisateur confronté au rogue antivirus 2008 sur Windows XP signale qu’un balayage avec Malwarebytes' Anti-Malware a détecté de nombreuses infections et qu’un redémarrage n’a pas éliminé le problème. Le rapport indique la quarantaine et la suppression de clés et valeurs du Registre, de dossiers et de fichiers, notamment Trojan.FakeAlert, Fake.Dropped.Malware et Trojan.DNSChanger, ainsi que des entrées Hijack.Wallpaper. Certaines entrées étaient marquées Delete on reboot et des noms serveur DNS ont été modifiés, signalant une persistance; une étape recommandée est de redémarrer et de relancer un balayage avec des définitions à jour. En cas de persistance, l’utilisation d’autres outils de sécurité et la vérification des paramètres réseau et des éléments de démarrage peuvent être nécessaires pour neutraliser complètement l’infection.

Bobot (l’IA à votre service)
  2. letoubib
    Super !! problème résolu
    Merci beaucoup pour tes conseils clairs précis et efficaces
    à +
    0
    2. letoubib
      rapport de Tool cleaner :

      [ Rapport ToolsCleaner version 2.2.3 (par A.Rothstein & dj QUIOU) ]

      -->- Recherche:

      C:\Combofix.txt: trouvé !
      C:\Qoobox: trouvé !
      C:\_OtMoveIt: trouvé !
      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
      C:\Documents and Settings\Propriétaire\Bureau\HijackThis.lnk: trouvé !
      C:\Documents and Settings\Propriétaire\Bureau\OtMoveIt2.exe: trouvé !
      C:\Documents and Settings\Propriétaire\Bureau\ComboFix.exe: trouvé !
      C:\Documents and Settings\Propriétaire\Bureau\HJTInstall.exe: trouvé !
      C:\Documents and Settings\Propriétaire\Bureau\hijackthis.log: trouvé !
      C:\Program Files\Trend Micro\HijackThis: trouvé !
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
      C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
      C:\_OTMoveIt\MovedFiles\09062008_001510\SDFIX: trouvé !

      ---------------------------------
      -->- Suppression:

      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
      C:\Documents and Settings\Propriétaire\Bureau\HijackThis.lnk: supprimé !
      C:\Documents and Settings\Propriétaire\Bureau\OtMoveIt2.exe: supprimé !
      C:\Documents and Settings\Propriétaire\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
      C:\Documents and Settings\Propriétaire\Bureau\HJTInstall.exe: supprimé !
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
      C:\Combofix.txt: supprimé !
      C:\Documents and Settings\Propriétaire\Bureau\hijackthis.log: supprimé !
      C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
      C:\Qoobox: supprimé !
      C:\_OtMoveIt: supprimé !
      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
      C:\Program Files\Trend Micro\HijackThis: supprimé !
      0
      2. Utilisateur anonyme
        réouvre hijackthis
        fais scan only
        coches ces lignes :

        O4 - HKCU\..\Run: [sysui] C:\WINDOWS\system32\fsbwfwvk.exe
        O4 - HKCU\..\Run: [SrvCom] C:\WINDOWS\system32\fubwvyji.exe
        O4 - HKCU\..\Run: [shen] C:\WINDOWS\system32\uhcholwl.exe
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')

        et clic sur fix checked

        ensuiet ;

        -> Télécharge Ccleaner (n'installe pas la barre d'outil Yahoo):

        http://download.piriform.com/ccsetup210.exe

        https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

        -> Tuto : https://www.malekal.com/tutoriel-ccleaner/

        * pour supprimer les outils/fix utilisés :

        Télécharge ToolsCleaner sur ton bureau.
        -->
        ftp://ftp.commentcamarche.com/download/ToolsCleaner2.exe
        http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
        http://pc-system.fr/

        # Clique sur Recherche et laisse le scan agir ...
        # Clique sur Suppression pour finaliser.
        # Tu peux, si tu le souhaites, te servir des Options facultatives.
        # Clique sur Quitter pour obtenir le rapport.
        # Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

        Désactive et réactive ta restauration system :

        (1) Désactiver la Restauration du système

        cliques sur Démarrer
        Cliques droit sur Poste de travail
        cliques sur Propriétés
        Cliques sur l'onglet Restauration du système
        Coches Désactiver la Restauration du système sur tous les lecteurs
        Cliques sur Appliquer, Lorsque le message de confirmation apparaît,
        cliques sur Oui.
        Cliques sur OK.

        (2) Activer la Restauration du système

        cliques sur Démarrer
        Cliques droit sur Poste de travail
        cliques sur Propriétés
        Cliques sur l'onglet Restauration du système
        Décoches Désactiver la Restauration du système sur tous les lecteurs
        Cliques sur Appliquer, Lorsque le message de confirmation apparaît,
        cliques sur Oui.
        Cliques sur OK.

        Tuto xp : http://service1.symantec.com/support/inter/tsgeninfointl.Nsf/fr_docid/20020830101856924

        0
        1. letoubib
          bonjour,

          Voila le nouveau scan hijackthis après fix.reg

          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 09:08:33, on 06/09/2008
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v7.00 (7.00.6000.16705)
          Boot mode: Normal

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
          C:\WINDOWS\System32\drivers\CDAC11BA.EXE
          C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
          c:\PROGRA~1\FICHIE~1\mcafee\mna\mcnasvc.exe
          c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
          C:\WINDOWS\Explorer.EXE
          C:\Program Files\McAfee\VirusScan\McShield.exe
          C:\Program Files\McAfee\MPF\MPFSrv.exe
          c:\PROGRA~1\mcafee.com\agent\mcagent.exe
          C:\Program Files\McAfee\MSK\MskSrver.exe
          C:\WINDOWS\system32\nvsvc32.exe
          C:\WINDOWS\system32\HPZipm12.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\wanmpsvc.exe
          C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
          C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
          C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
          C:\windows\system\hpsysdrv.exe
          C:\WINDOWS\system32\ps2.exe
          C:\WINDOWS\system32\RUNDLL32.EXE
          C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
          C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
          C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
          C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
          C:\Program Files\Fichiers communs\AOL\1132475792\ee\AOLSoftware.exe
          C:\Program Files\Winamp\winampa.exe
          C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
          C:\Program Files\AOL 9.0\aoltray.exe
          C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
          C:\Program Files\Palm\Hotsync.exe
          c:\program files\fichiers communs\aol\1132475792\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
          C:\Program Files\HOTALBUMMyBOX\MediaChecker.exe
          c:\program files\fichiers communs\aol\1132475792\ee\aolsoftware.exe
          C:\Program Files\Nikon\NkView6\NkvMon.exe
          C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearch.exe
          C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearchIndexer.exe
          C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
          C:\WINDOWS\system32\wuauclt.exe
          C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
          C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
          C:\Program Files\Internet Explorer\IEXPLORE.EXE
          C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
          C:\PROGRA~1\AOL9~1.0\waol.exe
          C:\PROGRA~1\AOL9~1.0\shellmon.exe
          C:\Program Files\Fichiers communs\Aol\aoltpspd.exe
          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
          C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearchFilter.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
          O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
          O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
          O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
          O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
          O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
          O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
          O2 - BHO: Barre d'outils MSN Search Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
          O3 - Toolbar: Barre d'outils MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
          O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
          O4 - HKLM\..\Run: [AOLSAV] C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
          O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
          O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
          O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
          O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
          O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
          O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
          O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
          O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
          O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
          O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
          O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
          O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
          O4 - HKLM\..\Run: [MBBalloon] C:\Program Files\HOTALBUMMyBOX\MBBalloon.exe
          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
          O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
          O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
          O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
          O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
          O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
          O4 - HKLM\..\Run: [HostManager] "C:\Program Files\Fichiers communs\AOL\1132475792\ee\AOLSoftware.exe"
          O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
          O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
          O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
          O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
          O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
          O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
          O4 - HKCU\..\Run: [sysui] C:\WINDOWS\system32\fsbwfwvk.exe
          O4 - HKCU\..\Run: [SrvCom] C:\WINDOWS\system32\fubwvyji.exe
          O4 - HKCU\..\Run: [shen] C:\WINDOWS\system32\uhcholwl.exe
          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
          O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
          O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
          O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
          O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
          O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
          O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
          O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
          O4 - Global Startup: MediaChecker.lnk = C:\Program Files\HOTALBUMMyBOX\MediaChecker.exe
          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
          O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
          O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearch.exe
          O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
          O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/229?c05944136ba24bc284a992f0e272c246
          O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/230?c05944136ba24bc284a992f0e272c246
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
          O17 - HKLM\System\CCS\Services\Tcpip\..\{DB4624A1-E489-4033-82E7-0E04FFA6D20E}: NameServer = 205.188.146.145
          O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
          O20 - AppInit_DLLs: sockspy.dll sockspy.dll
          O23 - Service: McAfee Application Installer Cleanup (0288891220538305) (0288891220538305mcinstcleanup) - Unknown owner - C:\WINDOWS\TEMP\028889~1.EXE (file missing)
          O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
          O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
          O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Fichiers communs\AOL\AOL Spyware Protection\\aolserv.exe (file missing)
          O23 - Service: Aluria Spyware Eliminator Service (ASEService) - Unknown owner - C:\PROGRA~1\ALURIA~1\ASE\ASEServ.exe (file missing)
          O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing)
          O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
          O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
          O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
          O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mna\mcnasvc.exe
          O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
          O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
          O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
          O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
          O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
          O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
          O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
          O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
          0
          1. Utilisateur anonyme
            Fix.reg

            Ouvre le bloc-notes (click droit sur le bureau > dans l´arborescence choisie nouveau et nouveau fichier texte) et fais un copier coller de ce qui est en citation ci-dessous (copie tout d'un trait-sans les barres(x)) :

            XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
            REGEDIT4

            [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion­\Run]
            "sysui"=-
            "SrvCom"=-
            "shen"=-

            XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
            Note : Regedit4 est sur la premiere ligne dans le bloc note et il y a une ligne blanche a la fin.
            Puis click sur "fichier"/"enregistrer sous" :
            dans : sur le bureau
            Nom du fichier : fix.reg
            Type de fichier : "tous les fichiers"
            clique sur "enregistrer"

            ca doit ressembler a ca une fois enrregistré :

            http://img520.imageshack.us/img520/4251/screenshot005ps2.png

            double clique sur fix.reg => tu dois obligatoirement avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?"
            Si c'est bien le cas, clique sur "oui"

            ensuite refais un scan hijackthis et post le rapport
            0
            1. letoubib
              tout à l'air de marcher !!! a priori problème résolu
              Merci ++++
              bonne nuit je déconnecte
              0
              1. letoubib
                lignes cohées et fix checked

                voici le rapport du nouveau scan hijackthis :

                Logfile of Trend Micro HijackThis v2.0.2
                Scan saved at 00:50:21, on 06/09/2008
                Platform: Windows XP SP2 (WinNT 5.01.2600)
                MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                Boot mode: Normal

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\system32\spoolsv.exe
                C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
                c:\PROGRA~1\FICHIE~1\mcafee\mna\mcnasvc.exe
                c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
                C:\WINDOWS\Explorer.EXE
                C:\Program Files\McAfee\VirusScan\McShield.exe
                C:\Program Files\McAfee\MPF\MPFSrv.exe
                c:\PROGRA~1\mcafee.com\agent\mcagent.exe
                C:\Program Files\McAfee\MSK\MskSrver.exe
                C:\WINDOWS\system32\nvsvc32.exe
                C:\WINDOWS\system32\HPZipm12.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\wanmpsvc.exe
                C:\WINDOWS\notepad.exe
                C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
                C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
                C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
                C:\windows\system\hpsysdrv.exe
                C:\WINDOWS\system32\ps2.exe
                C:\WINDOWS\system32\RUNDLL32.EXE
                C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
                C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
                C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
                C:\Program Files\Fichiers communs\AOL\1132475792\ee\AOLSoftware.exe
                C:\Program Files\Winamp\winampa.exe
                C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                C:\WINDOWS\system32\ctfmon.exe
                C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                C:\Program Files\AOL 9.0\aoltray.exe
                C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
                C:\Program Files\Palm\Hotsync.exe
                c:\program files\fichiers communs\aol\1132475792\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
                C:\Program Files\HOTALBUMMyBOX\MediaChecker.exe
                c:\program files\fichiers communs\aol\1132475792\ee\aolsoftware.exe
                C:\Program Files\Nikon\NkView6\NkvMon.exe
                C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearch.exe
                C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearchIndexer.exe
                C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
                C:\WINDOWS\system32\wuauclt.exe
                C:\Program Files\Internet Explorer\iexplore.exe
                C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
                C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
                C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
                O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
                O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
                O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
                O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
                O2 - BHO: Barre d'outils MSN Search Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
                O3 - Toolbar: Barre d'outils MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
                O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
                O4 - HKLM\..\Run: [AOLSAV] C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
                O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
                O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
                O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
                O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
                O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
                O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
                O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
                O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
                O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
                O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                O4 - HKLM\..\Run: [MBBalloon] C:\Program Files\HOTALBUMMyBOX\MBBalloon.exe
                O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
                O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
                O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
                O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
                O4 - HKLM\..\Run: [HostManager] "C:\Program Files\Fichiers communs\AOL\1132475792\ee\AOLSoftware.exe"
                O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
                O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
                O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
                O4 - HKCU\..\Run: [sysui] C:\WINDOWS\system32\fsbwfwvk.exe
                O4 - HKCU\..\Run: [SrvCom] C:\WINDOWS\system32\fubwvyji.exe
                O4 - HKCU\..\Run: [shen] C:\WINDOWS\system32\uhcholwl.exe
                O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
                O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
                O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
                O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
                O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                O4 - Global Startup: MediaChecker.lnk = C:\Program Files\HOTALBUMMyBOX\MediaChecker.exe
                O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
                O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearch.exe
                O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
                O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/229?c05944136ba24bc284a992f0e272c246
                O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/230?c05944136ba24bc284a992f0e272c246
                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
                O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                O20 - AppInit_DLLs: sockspy.dll sockspy.dll
                O23 - Service: McAfee Application Installer Cleanup (0288891220538305) (0288891220538305mcinstcleanup) - Unknown owner - C:\WINDOWS\TEMP\028889~1.EXE (file missing)
                O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Fichiers communs\AOL\AOL Spyware Protection\\aolserv.exe (file missing)
                O23 - Service: Aluria Spyware Eliminator Service (ASEService) - Unknown owner - C:\PROGRA~1\ALURIA~1\ASE\ASEServ.exe (file missing)
                O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing)
                O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
                O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
                O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mna\mcnasvc.exe
                O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
                O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
                O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
                O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
                O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
                O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
                O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
                0
                1. Utilisateur anonyme
                  réouvre hijackthis
                  fais scan only
                  coches ces lignes :

                  O16 - DPF: Dice Derby by pogo - http://game1.pogo.com/applet-6.5.2.26/checkeredflag/checkeredflag-fr_FR.cab
                  O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cab
                  O16 - DPF: Mah Jong Garden by pogo - http://game1.pogo.com/applet-6.5.2.33/mahjong/mahjong-fr_FR.cab
                  O16 - DPF: Phlinx by pogo - http://game1.pogo.com/applet-6.5.2.33/flinger/flinger-fr_FR.cab
                  O16 - DPF: Squelchies by pogo - http://game1.pogo.com/applet-6.4.4.34/squelchies/squelchies-ob-assets.cab
                  O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
                  O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.com/applet-6.6.3.34/holdem/holdem-fr_FR.cab
                  O16 - DPF: Word Whomp Whackdown by pogo - http://game1.pogo.com/applet-6.8.1.30/whackdown/whackdown-fr_FR.cab
                  O16 - DPF: World Class Solitaire by pogo - http://game1.pogo.com/applet-6.8.1.30/worldclass/worldclass-fr_FR.cab
                  O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
                  O16 - DPF: {26FCCDF9-A7E1-452A-A73D-7BF7B4D0BA6C} (AOL Pictures Uploader Class) - http://o.aolcdn.com/pictures/ap/Resources/2.0.6.9/cab/aolpPlugins.10.6.0.4.cab
                  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
                  O16 - DPF: {45E83043-1F6F-4D22-A5E7-0138EA171B49} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/
                  O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.fr/s/v/27.38/uploader2.cab
                  O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} - http://aolcc.aol.fr/computercheckup/qdiagcc.cab
                  O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-12.cab
                  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by20fd.bay20.hotmail.msn.com/resources/MsnPUpld.cab
                  O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
                  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
                  O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://aol.metaboli.fr/components/Metaboli.ocx
                  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://housecall.trendmicro-europe.com/housecall/Xscan53.cab
                  O16 - DPF: {A031D222-B496-11D2-9CC8-00105A10AAF6} - http://62.39.141.133/tools/FlipsideWebLauncherControl.cab
                  O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
                  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
                  O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
                  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                  O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
                  O16 - DPF: {E991BDE0-9816-4094-853E-6BDB60F0342D} (Get_ActiveX Control) - https://www.corel.com/fr/?red=apps.corel.com/nos_dl_manager/plugin/IENetOpPlugin.ocx

                  tu les coches et tu clic sur fix checked

                  ensuite refais un scan hijackthis et post le rapport stp
                  0
                  1. letoubib
                    le rapport de OTMovel

                    C:\WINDOWS\system32\VCCLSID.exe moved successfully.
                    C:\WINDOWS\system32\SrchSTS.exe moved successfully.
                    C:\WINDOWS\system32\AntiXPVSTFix.exe moved successfully.
                    C:\WINDOWS\system32\VACFix.exe moved successfully.
                    C:\WINDOWS\system32\IEDFix.exe moved successfully.
                    C:\WINDOWS\system32\IEDFix.C.exe moved successfully.
                    C:\WINDOWS\system32\404Fix.exe moved successfully.
                    File move failed. C:\WINDOWS\system32\Process.exe scheduled to be moved on reboot.
                    C:\WINDOWS\system32\dumphive.exe moved successfully.
                    C:\WINDOWS\system32\WS2Fix.exe moved successfully.
                    C:\WINDOWS\system32\uhcholwl.exe moved successfully.
                    C:\WINDOWS\system32\fubwvyji.exe moved successfully.
                    C:\WINDOWS\system32\fsbwfwvk.exe moved successfully.
                    File/Folder C:\WINDOWS\system32\uhcholwl.exe not found.
                    C:\SDFix moved successfully.
                    C:\Program Files\Fichiers communs\BOONTY Shared\Service moved successfully.
                    C:\Program Files\Fichiers communs\BOONTY Shared moved successfully.

                    OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 09062008_001510
                    0
                    1. Utilisateur anonyme
                      télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau.
                      double-clique sur OTMoveIt.exe pour le lancer.
                      Assure toi que la case Unregister Dll's and Ocx's soit bien cochée
                      copie la liste qui se trouve en gras ci-dessous,
                      et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

                      C:\WINDOWS\system32\VCCLSID.exe
                      C:\WINDOWS\system32\SrchSTS.exe
                      C:\WINDOWS\system32\AntiXPVSTFix.exe
                      C:\WINDOWS\system32\VACFix.exe
                      C:\WINDOWS\system32\IEDFix.exe
                      C:\WINDOWS\system32\IEDFix.C.exe
                      C:\WINDOWS\system32\404Fix.exe
                      C:\WINDOWS\system32\Process.exe
                      C:\WINDOWS\system32\dumphive.exe
                      C:\WINDOWS\system32\WS2Fix.exe
                      C:\WINDOWS\system32\uhcholwl.exe
                      C:\WINDOWS\system32\fubwvyji.exe
                      C:\WINDOWS\system32\fsbwfwvk.exe
                      C:\WINDOWS\system32\uhcholwl.exe
                      C:\SDFix
                      C:\Program Files\Fichiers communs\BOONTY Shared

                      clique sur MoveIt! pour lancer la suppression.
                      le résultat apparaitra dans le cadre "Results".
                      clique sur Exit pour fermer.
                      poste le rapport situé dans C:\_OTMoveIt\MovedFiles. il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.
                      0
                      1. Utilisateur anonyme
                        combofix n a pas marché
                        http://www.commentcamarche.net/forum/affich 8235637 eliminer antivirus 2008?page=2#24
                        0
                        1. letoubib
                          rapport combo fix :

                          ComboFix 08-09-03.06 - Propriétaire 2008-09-04 22:30:11.4 - NTFSx86
                          Endroit: C:\Documents and Settings\Propriétaire\Bureau\ComboFix.exe
                          Command switches used :: C:\Documents and Settings\Propriétaire\Bureau\CFScript.txt.lnk
                          * Création d'un nouveau point de restauration
                          * Resident AV is active

                          [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
                          .

                          ((((((((((((((((((((((((((((( Fichiers créés 2008-08-04 to 2008-09-04 ))))))))))))))))))))))))))))))))))))
                          .

                          2008-09-04 16:24 . 2008-09-04 16:24 <REP> d-------- C:\WINDOWS\LastGood
                          2008-09-03 22:13 . 2008-09-04 20:02 <REP> d-------- C:\WINDOWS\ERUNT
                          2008-09-03 22:13 . 2008-09-03 23:08 <REP> d-------- C:\Backups
                          2008-09-03 22:10 . 2008-09-04 20:02 <REP> d-------- C:\SDFix
                          2008-09-03 21:50 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
                          2008-09-03 21:50 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
                          2008-09-03 21:50 . 2008-08-31 00:53 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe
                          2008-09-03 21:50 . 2008-08-27 15:17 87,040 --a------ C:\WINDOWS\system32\VACFix.exe
                          2008-09-03 21:50 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
                          2008-09-03 21:50 . 2008-08-28 22:36 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
                          2008-09-03 21:50 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe
                          2008-09-03 21:50 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
                          2008-09-03 21:50 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
                          2008-09-03 21:50 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
                          2008-09-03 20:23 . 2008-09-03 20:23 98,304 --a------ C:\WINDOWS\system32\uhcholwl.exe
                          2008-09-03 07:28 . 2008-09-03 19:07 <REP> d-------- C:\Program Files\MSA
                          2008-09-03 07:27 . 2008-09-03 07:27 81,920 --a------ C:\WINDOWS\system32\fubwvyji.exe
                          2008-09-02 21:27 . 2008-09-03 19:05 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                          2008-09-02 21:27 . 2008-09-02 21:27 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\Malwarebytes
                          2008-09-02 21:27 . 2008-09-02 21:27 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                          2008-09-02 21:27 . 2008-09-02 00:16 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
                          2008-09-02 21:27 . 2008-09-02 00:16 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                          2008-09-01 23:18 . 2008-09-01 23:18 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\InterMute
                          2008-09-01 13:32 . 2008-09-01 13:32 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Teleca
                          2008-09-01 13:25 . 2008-09-01 13:25 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sony Ericsson
                          2008-08-31 22:03 . 2008-09-01 20:45 <REP> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\SiteAdvisor
                          2008-08-31 22:02 . 2008-09-03 07:22 <REP> d-------- C:\Program Files\SAV
                          2008-08-31 22:02 . 2008-08-31 22:02 <REP> d-------- C:\Documents and Settings\All Users\Application Data\rsjmpitq
                          2008-08-31 22:02 . 2008-08-31 22:02 90,112 --a------ C:\WINDOWS\system32\fsbwfwvk.exe
                          2008-08-24 10:34 . 2008-08-24 10:34 31 --a------ C:\WINDOWS\pixcache.ini
                          2008-08-20 21:10 . 2008-08-20 21:17 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\Winamp
                          2008-08-16 08:56 . 2008-05-01 16:31 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll

                          .
                          (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                          .
                          2008-09-04 14:35 --------- d-----w C:\Program Files\Everest Poker
                          2008-08-28 04:15 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\Canon
                          2008-08-23 11:29 --------- d-----w C:\Program Files\HOTALBUMMyBOX
                          2008-08-21 17:26 --------- d-----w C:\Program Files\WinDAC32
                          2008-08-20 19:11 --------- d-----w C:\Program Files\Winamp
                          2008-08-17 15:52 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\LimeWire
                          2008-08-16 06:45 --------- d-----w C:\Program Files\BoontyGames
                          2008-07-18 05:09 --------- d-----w C:\Program Files\Roguescanfix
                          2007-10-23 19:29 63,960 ----a-w C:\Documents and Settings\Propriétaire\Application Data\GDIPFONTCACHEV1.DAT
                          2006-09-09 13:49 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
                          2006-08-03 18:04 461 ----a-w C:\Program Files\INSTALL.LOG
                          2005-11-29 18:12 229,376 ----a-w C:\Documents and Settings\Propriétaire\cwshredder.dll
                          2005-11-29 18:12 229,376 ----a-w C:\Documents and Settings\Propriétaire\cwshredder.dll
                          2005-11-23 21:54 74 ----a-w C:\Documents and Settings\Propriétaire\getfile.dat
                          2005-11-23 21:54 74 ----a-w C:\Documents and Settings\Propriétaire\getfile.dat
                          2004-12-30 14:20 146,364 --sh--r C:\WINDOWS\MsxwCtrl.dll
                          2006-04-16 18:55 88 --sh--r C:\WINDOWS\system32\BD80C7A136.sys
                          2006-04-16 18:55 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
                          .

                          ((((((((((((((((((((((((((((( snapshot@2008-09-04_21.19.20.82 )))))))))))))))))))))))))))))))))))))))))
                          .
                          - 2008-09-04 14:25:08 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
                          + 2008-09-04 19:07:20 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
                          - 2008-09-04 14:25:08 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
                          + 2008-09-04 19:07:20 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
                          .
                          ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                          .
                          .
                          *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                          REGEDIT4

                          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                          "LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2006-09-15 20480]
                          "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 15360]
                          "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-20 68856]
                          "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 443968]
                          "sysui"="C:\WINDOWS\system32\fsbwfwvk.exe" [2008-08-31 90112]
                          "SrvCom"="C:\WINDOWS\system32\fubwvyji.exe" [2008-09-03 81920]
                          "shen"="C:\WINDOWS\system32\uhcholwl.exe" [2008-09-03 98304]

                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                          "AOLSAV"="C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe" [2004-11-10 80384]
                          "WCOLOREAL"="C:\Program Files\COMPAQ\Coloreal\coloreal.exe" [2002-02-20 143360]
                          "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816]
                          "PPMemCheck"="C:\PROGRA~1\PESTPA~1\PPMemCheck.exe" [2004-04-02 148480]
                          "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 7700480]
                          "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
                          "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2002-09-27 59392]
                          "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-06-14 278528]
                          "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
                          "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
                          "HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-03-28 188416]
                          "AOLDialer"="C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe" [2007-06-21 70952]
                          "PS2"="C:\WINDOWS\system32\ps2.exe" [2002-07-31 81920]
                          "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 86016]
                          "MBBalloon"="C:\Program Files\HOTALBUMMyBOX\MBBalloon.exe" [2006-12-15 787096]
                          "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 286720]
                          "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
                          "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992]
                          "SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-08-24 36640]
                          "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-04-18 185896]
                          "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe" [2007-03-16 63712]
                          "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-03-28 593920]
                          "HostManager"="C:\Program Files\Fichiers communs\AOL\1132475792\ee\AOLSoftware.exe" [2006-09-26 50736]
                          "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-08-04 36352]
                          "IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2002-09-27 44032]
                          "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-09-27 455168]
                          "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-09-27 455168]
                          "nwiz"="nwiz.exe" [2006-10-22 C:\WINDOWS\system32\nwiz.exe]

                          C:\Documents and Settings\Propri‚taire\Menu D‚marrer\Programmes\D‚marrage\
                          Adobe Gamma.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2003-06-15 110592]

                          C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                          Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2003-06-15 110592]
                          AOL 9.0 Ic“ne AOL.lnk - C:\Program Files\AOL 9.0\aoltray.exe [2007-08-17 156784]

                          [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
                          "{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= "c:\Program Files\interMute\SpySubtract\sshook.dll" [2008-09-01 77824]

                          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
                          "AppInit_DLLs"=sockspy.dll sockspy.dll

                          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                          "vidc.DIVF"= DivX412.dll
                          "VIDC.HFYU"= huffyuv.dll
                          "VIDC.VP40"= vp4vfw.dll

                          [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
                          path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
                          backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

                          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CookiePatrol]
                          --a------ 2004-04-02 15:10 69632 C:\PROGRA~1\PESTPA~1\CookiePatrol.exe

                          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PestPatrol Control Center]
                          --a------ 2004-04-02 15:11 53248 C:\PROGRA~1\PESTPA~1\PPControl.exe

                          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
                          --a------ 2008-08-04 01:02 36352 C:\Program Files\Winamp\winampa.exe

                          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
                          "DisableMonitoring"=dword:00000001

                          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
                          "DisableMonitoring"=dword:00000001

                          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                          "%windir%\\system32\\sessmgr.exe"=
                          "C:\\Program Files\\eMule\\emule.exe"=
                          "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
                          "C:\\Program Files\\iTunes\\iTunes.exe"=
                          "C:\\Program Files\\Soulseek-Test\\slsk.exe"=
                          "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
                          "C:\\Program Files\\Messenger\\msmsgs.exe"=
                          "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
                          "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
                          "C:\\Program Files\\MSN Messenger\\livecall.exe"=
                          "C:\\Program Files\\SecondLife\\SecondLife.exe"=
                          "C:\\Program Files\\Fichiers communs\\AOL\\1132475792\\ee\\aolsoftware.exe"=
                          "C:\\Program Files\\AOL 9.0\\waol.exe"=
                          "C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe"=
                          "C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLAcsd.exe"=

                          R0 PzWDM;PzWDM;C:\WINDOWS\system32\Drivers\PzWDM.sys [2007-11-17 15172]
                          R2 ScFBPNT2;CanoScan FBP2 Port Driver;C:\WINDOWS\System32\drivers\ScFBPNT2.SYS [1999-05-21 15488]
                          R2 X4HS16;X4HS16;C:\Program Files\EXEtender\X4HS16.Sys [2003-11-10 21323]
                          R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 15104]
                          R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
                          S2 0288891220538305mcinstcleanup;McAfee Application Installer Cleanup (0288891220538305);C:\WINDOWS\TEMP\[u]0[/u]28889~1.EXE C:\PROGRA~1\FICHIE~1\McAfee\INSTAL~1\cleanup.ini [ ]
                          S2 ASEService;Aluria Spyware Eliminator Service;C:\PROGRA~1\ALURIA~1\ASE\ASEServ.exe [ ]
                          S3 alcan5ln;SpeedTouch(tm) USB ADSL RFC1483 Networking Driver (NDIS);C:\WINDOWS\system32\DRIVERS\alcan5ln.sys [2003-12-08 36256]
                          S3 ATWPKT;ATWPKT;C:\WINDOWS\system32\Drivers\ATWPKT.SYS [2001-12-12 19448]
                          S3 BENDER;Pinnacle DV/AV Capture;C:\WINDOWS\system32\drivers\bender.sys [2005-08-22 200320]
                          S3 Boonty Games;Boonty Games;C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe [2005-11-23 69120]
                          S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-03-04 52384]
                          S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-03-04 6096]
                          S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-03-04 87456]
                          S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-03-04 79248]
                          S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-03-04 77072]
                          S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\w300bus.sys [2006-03-13 60800]
                          S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w300mdfl.sys [2006-03-13 9264]
                          S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w300mdm.sys [2006-03-13 96352]
                          S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w300mgmt.sys [2006-03-13 87824]
                          S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w300obex.sys [2006-03-13 85696]
                          .
                          Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
                          .

                          **************************************************************************

                          catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                          Rootkit scan 2008-09-04 22:45:00
                          Windows 5.1.2600 Service Pack 2 NTFS

                          Balayage processus cachés ...

                          Balayage caché autostart entries ...

                          Balayage des fichiers cachés ...

                          **************************************************************************
                          .
                          --------------------- DLLs a chargé sous des processus courants ---------------------

                          PROCESS: C:\WINDOWS\explorer.exe
                          -> C:\Program Files\SiteAdvisor\6253\saHook.dll
                          .
                          Temps d'accomplissement: 2008-09-04 23:10:40
                          ComboFix-quarantined-files.txt 2008-09-04 21:08:32
                          ComboFix2.txt 2008-09-04 19:21:21

                          Pre-Run: 22,810,345,472 octets libres
                          Post-Run: 22,801,653,760 octets libres

                          210 --- E O F --- 2008-08-17 03:16:06

                          --------------
                          Rapport hijackthis
                          Logfile of Trend Micro HijackThis v2.0.2
                          Scan saved at 00:38:30, on 05/09/2008
                          Platform: Windows XP SP2 (WinNT 5.01.2600)
                          MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                          Boot mode: Normal

                          Running processes:
                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                          C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                          C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
                          c:\PROGRA~1\FICHIE~1\mcafee\mna\mcnasvc.exe
                          c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
                          C:\Program Files\McAfee\VirusScan\McShield.exe
                          C:\Program Files\McAfee\MPF\MPFSrv.exe
                          c:\PROGRA~1\mcafee.com\agent\mcagent.exe
                          C:\Program Files\McAfee\MSK\MskSrver.exe
                          C:\WINDOWS\system32\nvsvc32.exe
                          C:\WINDOWS\system32\HPZipm12.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\wanmpsvc.exe
                          C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
                          C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
                          C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
                          C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
                          C:\windows\system\hpsysdrv.exe
                          C:\WINDOWS\system32\ps2.exe
                          C:\WINDOWS\system32\RUNDLL32.EXE
                          C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
                          C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                          C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
                          C:\Program Files\Winamp\winampa.exe
                          C:\Program Files\Fichiers communs\AOL\1132475792\ee\aolsoftware.exe
                          C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                          C:\WINDOWS\system32\ctfmon.exe
                          C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                          C:\WINDOWS\system32\fsbwfwvk.exe
                          C:\Program Files\AOL 9.0\aoltray.exe
                          C:\Program Files\Palm\Hotsync.exe
                          C:\Program Files\HOTALBUMMyBOX\MediaChecker.exe
                          C:\Program Files\Nikon\NkView6\NkvMon.exe
                          C:\Program Files\InterMute\SpySubtract\SpySub.exe
                          c:\program files\fichiers communs\aol\1132475792\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
                          C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearch.exe
                          c:\program files\fichiers communs\aol\1132475792\ee\aolsoftware.exe
                          C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearchIndexer.exe
                          C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
                          C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
                          C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
                          C:\PROGRA~1\AOL9~1.0\waol.exe
                          C:\Program Files\Fichiers communs\Aol\aoltpspd.exe
                          C:\WINDOWS\system32\LVComsX.exe
                          C:\WINDOWS\system32\wuauclt.exe
                          C:\WINDOWS\explorer.exe
                          C:\WINDOWS\notepad.exe
                          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                          C:\WINDOWS\system32\fsbwfwvk.exe
                          C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearchFilter.exe

                          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                          O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                          O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
                          O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                          O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
                          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
                          O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
                          O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
                          O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
                          O2 - BHO: Barre d'outils MSN Search Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
                          O3 - Toolbar: Barre d'outils MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
                          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                          O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
                          O4 - HKLM\..\Run: [AOLSAV] C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
                          O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
                          O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
                          O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
                          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                          O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
                          O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
                          O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                          O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                          O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
                          O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
                          O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
                          O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
                          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                          O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                          O4 - HKLM\..\Run: [MBBalloon] C:\Program Files\HOTALBUMMyBOX\MBBalloon.exe
                          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                          O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
                          O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
                          O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                          O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
                          O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
                          O4 - HKLM\..\Run: [HostManager] "C:\Program Files\Fichiers communs\AOL\1132475792\ee\AOLSoftware.exe"
                          O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
                          O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
                          O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                          O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                          O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                          O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                          O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
                          O4 - HKCU\..\Run: [sysui] C:\WINDOWS\system32\fsbwfwvk.exe
                          O4 - HKCU\..\Run: [SrvCom] C:\WINDOWS\system32\fubwvyji.exe
                          O4 - HKCU\..\Run: [shen] C:\WINDOWS\system32\uhcholwl.exe
                          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                          O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                          O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                          O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
                          O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
                          O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
                          O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
                          O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                          O4 - Global Startup: MediaChecker.lnk = C:\Program Files\HOTALBUMMyBOX\MediaChecker.exe
                          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                          O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
                          O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
                          O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearch.exe
                          O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
                          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
                          O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/229?c05944136ba24bc284a992f0e272c246
                          O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/230?c05944136ba24bc284a992f0e272c246
                          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
                          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
                          O16 - DPF: Dice Derby by pogo - http://game1.pogo.com/applet-6.5.2.26/checkeredflag/checkeredflag-fr_FR.cab
                          O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cab
                          O16 - DPF: Mah Jong Garden by pogo - http://game1.pogo.com/applet-6.5.2.33/mahjong/mahjong-fr_FR.cab
                          O16 - DPF: Phlinx by pogo - http://game1.pogo.com/applet-6.5.2.33/flinger/flinger-fr_FR.cab
                          O16 - DPF: Squelchies by pogo - http://game1.pogo.com/applet-6.4.4.34/squelchies/squelchies-ob-assets.cab
                          O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
                          O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.com/applet-6.6.3.34/holdem/holdem-fr_FR.cab
                          O16 - DPF: Word Whomp Whackdown by pogo - http://game1.pogo.com/applet-6.8.1.30/whackdown/whackdown-fr_FR.cab
                          O16 - DPF: World Class Solitaire by pogo - http://game1.pogo.com/applet-6.8.1.30/worldclass/worldclass-fr_FR.cab
                          O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
                          O16 - DPF: {26FCCDF9-A7E1-452A-A73D-7BF7B4D0BA6C} (AOL Pictures Uploader Class) - http://o.aolcdn.com/pictures/ap/Resources/2.0.6.9/cab/aolpPlugins.10.6.0.4.cab
                          O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
                          O16 - DPF: {45E83043-1F6F-4D22-A5E7-0138EA171B49} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fr/filesharingctrl.cab
                          O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.fr/s/v/27.38/uploader2.cab
                          O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} - http://aolcc.aol.fr/computercheckup/qdiagcc.cab
                          O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-12.cab
                          O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by20fd.bay20.hotmail.msn.com/resources/MsnPUpld.cab
                          O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
                          O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
                          O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://aol.metaboli.fr/components/Metaboli.ocx
                          O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://housecall.trendmicro-europe.com/housecall/Xscan53.cab
                          O16 - DPF: {A031D222-B496-11D2-9CC8-00105A10AAF6} - http://62.39.141.133/tools/FlipsideWebLauncherControl.cab
                          O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
                          O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
                          O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
                          O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                          O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
                          O16 - DPF: {E991BDE0-9816-4094-853E-6BDB60F0342D} (Get_ActiveX Control) - https://www.corel.com/fr/?red=apps.corel.com/nos_dl_manager/plugin/IENetOpPlugin.ocx
                          O17 - HKLM\System\CCS\Services\Tcpip\..\{DB4624A1-E489-4033-82E7-0E04FFA6D20E}: NameServer = 205.188.146.145
                          O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                          O20 - AppInit_DLLs: sockspy.dll sockspy.dll
                          O23 - Service: McAfee Application Installer Cleanup (0288891220538305) (0288891220538305mcinstcleanup) - Unknown owner - C:\WINDOWS\TEMP\028889~1.EXE (file missing)
                          O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                          O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                          O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Fichiers communs\AOL\AOL Spyware Protection\\aolserv.exe (file missing)
                          O23 - Service: Aluria Spyware Eliminator Service (ASEService) - Unknown owner - C:\PROGRA~1\ALURIA~1\ASE\ASEServ.exe (file missing)
                          O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                          O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                          O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
                          O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
                          O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mna\mcnasvc.exe
                          O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
                          O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
                          O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
                          O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
                          O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
                          O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
                          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                          O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                          O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
                          0
                          2. letoubib
                            voici htjackthis

                            Logfile of Trend Micro HijackThis v2.0.2
                            Scan saved at 00:38:30, on 05/09/2008
                            Platform: Windows XP SP2 (WinNT 5.01.2600)
                            MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                            Boot mode: Normal

                            Running processes:
                            C:\WINDOWS\System32\smss.exe
                            C:\WINDOWS\system32\winlogon.exe
                            C:\WINDOWS\system32\services.exe
                            C:\WINDOWS\system32\lsass.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\system32\spoolsv.exe
                            C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                            C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                            C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
                            c:\PROGRA~1\FICHIE~1\mcafee\mna\mcnasvc.exe
                            c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
                            C:\Program Files\McAfee\VirusScan\McShield.exe
                            C:\Program Files\McAfee\MPF\MPFSrv.exe
                            c:\PROGRA~1\mcafee.com\agent\mcagent.exe
                            C:\Program Files\McAfee\MSK\MskSrver.exe
                            C:\WINDOWS\system32\nvsvc32.exe
                            C:\WINDOWS\system32\HPZipm12.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\wanmpsvc.exe
                            C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
                            C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
                            C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
                            C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
                            C:\windows\system\hpsysdrv.exe
                            C:\WINDOWS\system32\ps2.exe
                            C:\WINDOWS\system32\RUNDLL32.EXE
                            C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
                            C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                            C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
                            C:\Program Files\Winamp\winampa.exe
                            C:\Program Files\Fichiers communs\AOL\1132475792\ee\aolsoftware.exe
                            C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                            C:\WINDOWS\system32\ctfmon.exe
                            C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                            C:\WINDOWS\system32\fsbwfwvk.exe
                            C:\Program Files\AOL 9.0\aoltray.exe
                            C:\Program Files\Palm\Hotsync.exe
                            C:\Program Files\HOTALBUMMyBOX\MediaChecker.exe
                            C:\Program Files\Nikon\NkView6\NkvMon.exe
                            C:\Program Files\InterMute\SpySubtract\SpySub.exe
                            c:\program files\fichiers communs\aol\1132475792\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
                            C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearch.exe
                            c:\program files\fichiers communs\aol\1132475792\ee\aolsoftware.exe
                            C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearchIndexer.exe
                            C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
                            C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
                            C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
                            C:\PROGRA~1\AOL9~1.0\waol.exe
                            C:\Program Files\Fichiers communs\Aol\aoltpspd.exe
                            C:\WINDOWS\system32\LVComsX.exe
                            C:\WINDOWS\system32\wuauclt.exe
                            C:\WINDOWS\explorer.exe
                            C:\WINDOWS\notepad.exe
                            C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                            C:\WINDOWS\system32\fsbwfwvk.exe
                            C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearchFilter.exe

                            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                            O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                            O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
                            O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                            O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
                            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
                            O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
                            O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
                            O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
                            O2 - BHO: Barre d'outils MSN Search Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
                            O3 - Toolbar: Barre d'outils MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
                            O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                            O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
                            O4 - HKLM\..\Run: [AOLSAV] C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
                            O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
                            O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
                            O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
                            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                            O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
                            O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
                            O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                            O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                            O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
                            O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
                            O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
                            O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
                            O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                            O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                            O4 - HKLM\..\Run: [MBBalloon] C:\Program Files\HOTALBUMMyBOX\MBBalloon.exe
                            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                            O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                            O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
                            O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
                            O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                            O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
                            O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
                            O4 - HKLM\..\Run: [HostManager] "C:\Program Files\Fichiers communs\AOL\1132475792\ee\AOLSoftware.exe"
                            O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
                            O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
                            O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                            O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                            O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                            O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                            O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                            O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
                            O4 - HKCU\..\Run: [sysui] C:\WINDOWS\system32\fsbwfwvk.exe
                            O4 - HKCU\..\Run: [SrvCom] C:\WINDOWS\system32\fubwvyji.exe
                            O4 - HKCU\..\Run: [shen] C:\WINDOWS\system32\uhcholwl.exe
                            O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                            O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                            O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                            O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
                            O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
                            O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
                            O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
                            O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                            O4 - Global Startup: MediaChecker.lnk = C:\Program Files\HOTALBUMMyBOX\MediaChecker.exe
                            O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                            O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
                            O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
                            O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearch.exe
                            O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
                            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
                            O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/229?c05944136ba24bc284a992f0e272c246
                            O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/230?c05944136ba24bc284a992f0e272c246
                            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
                            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
                            O16 - DPF: Dice Derby by pogo - http://game1.pogo.com/applet-6.5.2.26/checkeredflag/checkeredflag-fr_FR.cab
                            O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cab
                            O16 - DPF: Mah Jong Garden by pogo - http://game1.pogo.com/applet-6.5.2.33/mahjong/mahjong-fr_FR.cab
                            O16 - DPF: Phlinx by pogo - http://game1.pogo.com/applet-6.5.2.33/flinger/flinger-fr_FR.cab
                            O16 - DPF: Squelchies by pogo - http://game1.pogo.com/applet-6.4.4.34/squelchies/squelchies-ob-assets.cab
                            O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
                            O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.com/applet-6.6.3.34/holdem/holdem-fr_FR.cab
                            O16 - DPF: Word Whomp Whackdown by pogo - http://game1.pogo.com/applet-6.8.1.30/whackdown/whackdown-fr_FR.cab
                            O16 - DPF: World Class Solitaire by pogo - http://game1.pogo.com/applet-6.8.1.30/worldclass/worldclass-fr_FR.cab
                            O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
                            O16 - DPF: {26FCCDF9-A7E1-452A-A73D-7BF7B4D0BA6C} (AOL Pictures Uploader Class) - http://o.aolcdn.com/pictures/ap/Resources/2.0.6.9/cab/aolpPlugins.10.6.0.4.cab
                            O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
                            O16 - DPF: {45E83043-1F6F-4D22-A5E7-0138EA171B49} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fr/filesharingctrl.cab
                            O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.fr/s/v/27.38/uploader2.cab
                            O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} - http://aolcc.aol.fr/computercheckup/qdiagcc.cab
                            O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-12.cab
                            O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by20fd.bay20.hotmail.msn.com/resources/MsnPUpld.cab
                            O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
                            O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
                            O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://aol.metaboli.fr/components/Metaboli.ocx
                            O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://housecall.trendmicro-europe.com/housecall/Xscan53.cab
                            O16 - DPF: {A031D222-B496-11D2-9CC8-00105A10AAF6} - http://62.39.141.133/tools/FlipsideWebLauncherControl.cab
                            O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
                            O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
                            O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
                            O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                            O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
                            O16 - DPF: {E991BDE0-9816-4094-853E-6BDB60F0342D} (Get_ActiveX Control) - https://www.corel.com/fr/?red=apps.corel.com/nos_dl_manager/plugin/IENetOpPlugin.ocx
                            O17 - HKLM\System\CCS\Services\Tcpip\..\{DB4624A1-E489-4033-82E7-0E04FFA6D20E}: NameServer = 205.188.146.145
                            O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                            O20 - AppInit_DLLs: sockspy.dll sockspy.dll
                            O23 - Service: McAfee Application Installer Cleanup (0288891220538305) (0288891220538305mcinstcleanup) - Unknown owner - C:\WINDOWS\TEMP\028889~1.EXE (file missing)
                            O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                            O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                            O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Fichiers communs\AOL\AOL Spyware Protection\\aolserv.exe (file missing)
                            O23 - Service: Aluria Spyware Eliminator Service (ASEService) - Unknown owner - C:\PROGRA~1\ALURIA~1\ASE\ASEServ.exe (file missing)
                            O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                            O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                            O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
                            O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
                            O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mna\mcnasvc.exe
                            O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
                            O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
                            O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
                            O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
                            O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
                            O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
                            O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                            O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                            O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
                            0
                            1. Utilisateur anonyme
                              télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau.
                              double-clique sur OTMoveIt.exe pour le lancer.
                              Assure toi que la case Unregister Dll's and Ocx's soit bien cochée
                              copie la liste qui se trouve en gras ci-dessous,
                              et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

                              C:\WINDOWS\system32\VCCLSID.exe
                              C:\WINDOWS\system32\SrchSTS.exe
                              C:\WINDOWS\system32\AntiXPVSTFix.exe
                              C:\WINDOWS\system32\VACFix.exe
                              C:\WINDOWS\system32\IEDFix.exe
                              C:\WINDOWS\system32\IEDFix.C.exe
                              C:\WINDOWS\system32\404Fix.exe
                              C:\WINDOWS\system32\Process.exe
                              C:\WINDOWS\system32\dumphive.exe
                              C:\WINDOWS\system32\WS2Fix.exe
                              C:\WINDOWS\system32\uhcholwl.exe
                              C:\WINDOWS\system32\fubwvyji.exe
                              C:\WINDOWS\system32\fsbwfwvk.exe
                              C:\WINDOWS\system32\uhcholwl.exe
                              C:\SDFix
                              C:\Program Files\Fichiers communs\BOONTY Shared

                              clique sur MoveIt! pour lancer la suppression.
                              le résultat apparaitra dans le cadre "Results".
                              clique sur Exit pour fermer.
                              poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

                              il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.
                              0
                              1. letoubib
                                voila le rapport de combofix :

                                ComboFix 08-09-03.06 - Propriétaire 2008-09-04 22:30:11.4 - NTFSx86
                                Endroit: C:\Documents and Settings\Propriétaire\Bureau\ComboFix.exe
                                Command switches used :: C:\Documents and Settings\Propriétaire\Bureau\CFScript.txt.lnk
                                * Création d'un nouveau point de restauration
                                * Resident AV is active

                                [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
                                .

                                ((((((((((((((((((((((((((((( Fichiers créés 2008-08-04 to 2008-09-04 ))))))))))))))))))))))))))))))))))))
                                .

                                2008-09-04 16:24 . 2008-09-04 16:24 <REP> d-------- C:\WINDOWS\LastGood
                                2008-09-03 22:13 . 2008-09-04 20:02 <REP> d-------- C:\WINDOWS\ERUNT
                                2008-09-03 22:13 . 2008-09-03 23:08 <REP> d-------- C:\Backups
                                2008-09-03 22:10 . 2008-09-04 20:02 <REP> d-------- C:\SDFix
                                2008-09-03 21:50 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
                                2008-09-03 21:50 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
                                2008-09-03 21:50 . 2008-08-31 00:53 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe
                                2008-09-03 21:50 . 2008-08-27 15:17 87,040 --a------ C:\WINDOWS\system32\VACFix.exe
                                2008-09-03 21:50 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
                                2008-09-03 21:50 . 2008-08-28 22:36 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
                                2008-09-03 21:50 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe
                                2008-09-03 21:50 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
                                2008-09-03 21:50 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
                                2008-09-03 21:50 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
                                2008-09-03 20:23 . 2008-09-03 20:23 98,304 --a------ C:\WINDOWS\system32\uhcholwl.exe
                                2008-09-03 07:28 . 2008-09-03 19:07 <REP> d-------- C:\Program Files\MSA
                                2008-09-03 07:27 . 2008-09-03 07:27 81,920 --a------ C:\WINDOWS\system32\fubwvyji.exe
                                2008-09-02 21:27 . 2008-09-03 19:05 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                                2008-09-02 21:27 . 2008-09-02 21:27 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\Malwarebytes
                                2008-09-02 21:27 . 2008-09-02 21:27 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                                2008-09-02 21:27 . 2008-09-02 00:16 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
                                2008-09-02 21:27 . 2008-09-02 00:16 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                                2008-09-01 23:18 . 2008-09-01 23:18 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\InterMute
                                2008-09-01 13:32 . 2008-09-01 13:32 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Teleca
                                2008-09-01 13:25 . 2008-09-01 13:25 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sony Ericsson
                                2008-08-31 22:03 . 2008-09-01 20:45 <REP> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\SiteAdvisor
                                2008-08-31 22:02 . 2008-09-03 07:22 <REP> d-------- C:\Program Files\SAV
                                2008-08-31 22:02 . 2008-08-31 22:02 <REP> d-------- C:\Documents and Settings\All Users\Application Data\rsjmpitq
                                2008-08-31 22:02 . 2008-08-31 22:02 90,112 --a------ C:\WINDOWS\system32\fsbwfwvk.exe
                                2008-08-24 10:34 . 2008-08-24 10:34 31 --a------ C:\WINDOWS\pixcache.ini
                                2008-08-20 21:10 . 2008-08-20 21:17 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\Winamp
                                2008-08-16 08:56 . 2008-05-01 16:31 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll

                                .
                                (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                                .
                                2008-09-04 14:35 --------- d-----w C:\Program Files\Everest Poker
                                2008-08-28 04:15 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\Canon
                                2008-08-23 11:29 --------- d-----w C:\Program Files\HOTALBUMMyBOX
                                2008-08-21 17:26 --------- d-----w C:\Program Files\WinDAC32
                                2008-08-20 19:11 --------- d-----w C:\Program Files\Winamp
                                2008-08-17 15:52 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\LimeWire
                                2008-08-16 06:45 --------- d-----w C:\Program Files\BoontyGames
                                2008-07-18 05:09 --------- d-----w C:\Program Files\Roguescanfix
                                2007-10-23 19:29 63,960 ----a-w C:\Documents and Settings\Propriétaire\Application Data\GDIPFONTCACHEV1.DAT
                                2006-09-09 13:49 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
                                2006-08-03 18:04 461 ----a-w C:\Program Files\INSTALL.LOG
                                2005-11-29 18:12 229,376 ----a-w C:\Documents and Settings\Propriétaire\cwshredder.dll
                                2005-11-29 18:12 229,376 ----a-w C:\Documents and Settings\Propriétaire\cwshredder.dll
                                2005-11-23 21:54 74 ----a-w C:\Documents and Settings\Propriétaire\getfile.dat
                                2005-11-23 21:54 74 ----a-w C:\Documents and Settings\Propriétaire\getfile.dat
                                2004-12-30 14:20 146,364 --sh--r C:\WINDOWS\MsxwCtrl.dll
                                2006-04-16 18:55 88 --sh--r C:\WINDOWS\system32\BD80C7A136.sys
                                2006-04-16 18:55 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
                                .

                                ((((((((((((((((((((((((((((( snapshot@2008-09-04_21.19.20.82 )))))))))))))))))))))))))))))))))))))))))
                                .
                                - 2008-09-04 14:25:08 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
                                + 2008-09-04 19:07:20 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
                                - 2008-09-04 14:25:08 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
                                + 2008-09-04 19:07:20 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
                                .
                                ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                                .
                                .
                                *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                                REGEDIT4

                                [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                "LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2006-09-15 20480]
                                "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 15360]
                                "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-20 68856]
                                "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 443968]
                                "sysui"="C:\WINDOWS\system32\fsbwfwvk.exe" [2008-08-31 90112]
                                "SrvCom"="C:\WINDOWS\system32\fubwvyji.exe" [2008-09-03 81920]
                                "shen"="C:\WINDOWS\system32\uhcholwl.exe" [2008-09-03 98304]

                                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                "AOLSAV"="C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe" [2004-11-10 80384]
                                "WCOLOREAL"="C:\Program Files\COMPAQ\Coloreal\coloreal.exe" [2002-02-20 143360]
                                "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816]
                                "PPMemCheck"="C:\PROGRA~1\PESTPA~1\PPMemCheck.exe" [2004-04-02 148480]
                                "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 7700480]
                                "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
                                "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2002-09-27 59392]
                                "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-06-14 278528]
                                "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
                                "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
                                "HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-03-28 188416]
                                "AOLDialer"="C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe" [2007-06-21 70952]
                                "PS2"="C:\WINDOWS\system32\ps2.exe" [2002-07-31 81920]
                                "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 86016]
                                "MBBalloon"="C:\Program Files\HOTALBUMMyBOX\MBBalloon.exe" [2006-12-15 787096]
                                "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 286720]
                                "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
                                "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992]
                                "SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-08-24 36640]
                                "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-04-18 185896]
                                "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe" [2007-03-16 63712]
                                "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-03-28 593920]
                                "HostManager"="C:\Program Files\Fichiers communs\AOL\1132475792\ee\AOLSoftware.exe" [2006-09-26 50736]
                                "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-08-04 36352]
                                "IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2002-09-27 44032]
                                "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-09-27 455168]
                                "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-09-27 455168]
                                "nwiz"="nwiz.exe" [2006-10-22 C:\WINDOWS\system32\nwiz.exe]

                                C:\Documents and Settings\Propri‚taire\Menu D‚marrer\Programmes\D‚marrage\
                                Adobe Gamma.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2003-06-15 110592]

                                C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                                Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2003-06-15 110592]
                                AOL 9.0 Ic“ne AOL.lnk - C:\Program Files\AOL 9.0\aoltray.exe [2007-08-17 156784]

                                [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
                                "{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= "c:\Program Files\interMute\SpySubtract\sshook.dll" [2008-09-01 77824]

                                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
                                "AppInit_DLLs"=sockspy.dll sockspy.dll

                                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                                "vidc.DIVF"= DivX412.dll
                                "VIDC.HFYU"= huffyuv.dll
                                "VIDC.VP40"= vp4vfw.dll

                                [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
                                path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
                                backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

                                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CookiePatrol]
                                --a------ 2004-04-02 15:10 69632 C:\PROGRA~1\PESTPA~1\CookiePatrol.exe

                                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PestPatrol Control Center]
                                --a------ 2004-04-02 15:11 53248 C:\PROGRA~1\PESTPA~1\PPControl.exe

                                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
                                --a------ 2008-08-04 01:02 36352 C:\Program Files\Winamp\winampa.exe

                                [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
                                "DisableMonitoring"=dword:00000001

                                [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
                                "DisableMonitoring"=dword:00000001

                                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                                "%windir%\\system32\\sessmgr.exe"=
                                "C:\\Program Files\\eMule\\emule.exe"=
                                "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
                                "C:\\Program Files\\iTunes\\iTunes.exe"=
                                "C:\\Program Files\\Soulseek-Test\\slsk.exe"=
                                "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
                                "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
                                "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
                                "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
                                "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
                                "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
                                "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
                                "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
                                "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
                                "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
                                "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
                                "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
                                "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
                                "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
                                "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
                                "C:\\Program Files\\Messenger\\msmsgs.exe"=
                                "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
                                "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
                                "C:\\Program Files\\MSN Messenger\\livecall.exe"=
                                "C:\\Program Files\\SecondLife\\SecondLife.exe"=
                                "C:\\Program Files\\Fichiers communs\\AOL\\1132475792\\ee\\aolsoftware.exe"=
                                "C:\\Program Files\\AOL 9.0\\waol.exe"=
                                "C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe"=
                                "C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLAcsd.exe"=

                                R0 PzWDM;PzWDM;C:\WINDOWS\system32\Drivers\PzWDM.sys [2007-11-17 15172]
                                R2 ScFBPNT2;CanoScan FBP2 Port Driver;C:\WINDOWS\System32\drivers\ScFBPNT2.SYS [1999-05-21 15488]
                                R2 X4HS16;X4HS16;C:\Program Files\EXEtender\X4HS16.Sys [2003-11-10 21323]
                                R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 15104]
                                R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
                                S2 0288891220538305mcinstcleanup;McAfee Application Installer Cleanup (0288891220538305);C:\WINDOWS\TEMP\[u]0[/u]28889~1.EXE C:\PROGRA~1\FICHIE~1\McAfee\INSTAL~1\cleanup.ini [ ]
                                S2 ASEService;Aluria Spyware Eliminator Service;C:\PROGRA~1\ALURIA~1\ASE\ASEServ.exe [ ]
                                S3 alcan5ln;SpeedTouch(tm) USB ADSL RFC1483 Networking Driver (NDIS);C:\WINDOWS\system32\DRIVERS\alcan5ln.sys [2003-12-08 36256]
                                S3 ATWPKT;ATWPKT;C:\WINDOWS\system32\Drivers\ATWPKT.SYS [2001-12-12 19448]
                                S3 BENDER;Pinnacle DV/AV Capture;C:\WINDOWS\system32\drivers\bender.sys [2005-08-22 200320]
                                S3 Boonty Games;Boonty Games;C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe [2005-11-23 69120]
                                S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-03-04 52384]
                                S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-03-04 6096]
                                S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-03-04 87456]
                                S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-03-04 79248]
                                S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-03-04 77072]
                                S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\w300bus.sys [2006-03-13 60800]
                                S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w300mdfl.sys [2006-03-13 9264]
                                S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w300mdm.sys [2006-03-13 96352]
                                S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w300mgmt.sys [2006-03-13 87824]
                                S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w300obex.sys [2006-03-13 85696]
                                .
                                Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
                                .

                                **************************************************************************

                                catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                                Rootkit scan 2008-09-04 22:45:00
                                Windows 5.1.2600 Service Pack 2 NTFS

                                Balayage processus cachés ...

                                Balayage caché autostart entries ...

                                Balayage des fichiers cachés ...

                                **************************************************************************
                                .
                                --------------------- DLLs a chargé sous des processus courants ---------------------

                                PROCESS: C:\WINDOWS\explorer.exe
                                -> C:\Program Files\SiteAdvisor\6253\saHook.dll
                                .
                                Temps d'accomplissement: 2008-09-04 23:10:40
                                ComboFix-quarantined-files.txt 2008-09-04 21:08:32
                                ComboFix2.txt 2008-09-04 19:21:21

                                Pre-Run: 22,810,345,472 octets libres
                                Post-Run: 22,801,653,760 octets libres

                                210 --- E O F --- 2008-08-17 03:16:06
                                0
                                1. Utilisateur anonyme
                                  tu fais un clic de souris sur CFScript.txt et tu reste appuyé et tu le fais glisser sur combofix
                                  0
                                  1. letoubib
                                    désolé je ne comprends pas la manip
                                    j'ai bien enregistré le texte dans le bloc note sous le nom de CFScript.txt
                                    mais je ne vois pas comment le glisser vers combofix qui se trouve sur mon bureau...
                                    0
                                    • 1
                                    • 2

                                    Discussions similaires

                                    Google Chrome "  Échec de l'analyse antivirus "
                                    jmpower

                                    18 réponses
                                    " Échec de l'analyse antivirus " la solution.
                                    bazfile

                                    0 réponse
                                    Échec de l'analyse anti virus.
                                    alice1414

                                    3 réponses