Infection

doudou -  
Bonjour,
le pc de mon ami est infecte
je peu aller sur internet mais curieusement pas sur ce site car je suis redirigé sur n'importe quel site

donc j'ecris depuis un autre pc

je me suis debarrassé de plusieur saloperis avec MalwareBytes' Anti-Malware "sans echec"
puis j'ai essaye combofix mais il me dit qu'il y a un rootkit et il redemarre le pc
avec ou sans echec c'est pareil

en image de fond il y avait une image du style "vous etes infecté veuillez telecharger ...ect.."
ca c'est parti et le pc se comporte bien , "sauf sur internet"

voici un rapport
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 06:14:54, on 15/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\SYSTEM32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
H:\Windows.old\Windows\system32\ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Windows Defender\MsMpEng.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
D:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
D:\Program Files\UPHClean\uphclean.exe
D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
D:\WINDOWS\Explorer.EXE
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
D:\Program Files\Windows Defender\MSASCui.exe
D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\MSN Messenger\msnmsgr.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\Iexplore.exe
D:\WINDOWS\system32\Notepad.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail?u=http://webmail.orange.fr/webmail/fr_FR/inbox.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = H:\Windows.old\Windows\PCHEALTH\HELPCTR\System\panels\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = H:\Windows.old\Windows\PCHEALTH\HELPCTR\System\panels\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.club-internet.fr:80
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Octh Class - {000123B4-9B42-4900-B3F7-F4B073EFC214} - D:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Windows Defender] "D:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] D:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Download by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://D:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/229?4a05577529a849279da8f77e075acec
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://D:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/230?4a05577529a849279da8f77e075acec
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - D:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - D:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - D:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.bing.com/?cc=fr&toHttps=1&redig=8E4340E974D84321BBA663104F635D75
O15 - Trusted Zone: https://www.orange.fr/portail
O15 - Trusted IP range: 206.161.125.149 (HKLM)
O16 - DPF: {02CA9974-B6AC-497E-A371-73580432B0F6} - https://imlive.com/ChatSource/gVideoContol.cab
O16 - DPF: {10000001-1001-1001-1000-000000000000} -
O16 - DPF: {2472DCCC-68CE-49DA-AA81-E7E6D83C1DFA} - http://acces.blonde.com/package/PackageHtmlCab.CAB
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - D:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://sherred.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/01b7a9f9d8069c4b8b05/netzip/RdxIE601_fr.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - http://scan.safety.live.com/resource/download/scanner/wlscbase969.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040428/qtinstall.info.apple.com/saba/fr/win/QuickTimeInstaller.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8ED577E0-25F4-4477-866B-3C572B7FB603} - http://viout.com/downloader/ViOutActive.cab
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} - http://activex.microgaming.com/DLhelper/version7/dlhelper.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {EFD3EA56-234D-4240-90EA-CC9FA3AF5A01} (ConnectivityTester Class) - http://motive.club-internet.fr:2112/lwp/static/installers/WebflowActiveXInstaller_4-0-0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AD905C33-1463-4529-AE48-173685199FBF}: NameServer = 192.168.1.1
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - D:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - D:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - H:\Windows.old\Windows\system32\ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - D:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: ZeroSpyware FileDeleter (FileDeleter) - FBMSoftware - D:\Program Files\FBM Software\ZeroSpyware\FileDeleter.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: Norton Ghost - Symantec Corporation - D:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Créateur de rapports d'état Sophos Anti-Virus (SAVAdminService) - Sophos Plc - D:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Sophos AutoUpdate Service - Unknown owner - D:\Program Files\Sophos\AutoUpdate\ALsvc.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - D:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 11759 bytes

30 réponses

Résumé de la discussion

Une infection informatique complexe affecte un PC sous Windows XP, se manifestant par une redirection des sites Internet et un affichage d'un message d'infection à l'arrière-plan, malgré la présence d'antivirus. Des outils tels que Malwarebytes, ComboFix et HijackThis ont été employés pour diagnostiquer et nettoyer, révélant des redirections proxy, des barres d’outils et des services hostiles dans les éléments de démarrage. Des remèdes complémentaires comme FindyKill et OTMoveIt ont été préconisés, avec nettoyage des clés Run et des éléments potentiellement associés sur supports amovibles. En parallèle, des symptômes techniques et des paramètres Proxy restent mentionnés dans les rapports, indiquant qu’une vérification complète du système et des sauvegardes est nécessaire pour éviter une réinfection.

Bobot (l’IA à votre service)
  1. Destrio5 Modérateur
    Avast est moins bien qu'AVG ou Antivir.
    1. doudou
      oui je pense que antivir serai mieu
      je vais voir ca "apres avoir desinstallé avast"

      merci pour ton aide
      tu m'a rendu un grand service
  2. doudou
    bon j'ai desinstalle un max et meme un peu plus

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 06:36:25, on 25/09/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    D:\WINDOWS\System32\smss.exe
    D:\WINDOWS\system32\winlogon.exe
    D:\WINDOWS\system32\services.exe
    D:\WINDOWS\system32\lsass.exe
    H:\Windows.old\Windows\system32\ati2evxx.exe
    D:\WINDOWS\system32\svchost.exe
    D:\Program Files\Windows Defender\MsMpEng.exe
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\System32\svchost.exe
    D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    D:\Program Files\Alwil Software\Avast4\ashServ.exe
    D:\WINDOWS\system32\spoolsv.exe
    D:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
    D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    D:\Program Files\Spyware Terminator\sp_rsser.exe
    D:\Program Files\UPHClean\uphclean.exe
    D:\WINDOWS\Explorer.EXE
    D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    D:\WINDOWS\system32\wuauclt.exe
    D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    D:\WINDOWS\System32\svchost.exe
    D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    D:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
    D:\WINDOWS\system32\ctfmon.exe
    D:\Program Files\MSN Messenger\msnmsgr.exe
    D:\Program Files\MSN Messenger\usnsvc.exe
    D:\WINDOWS\System32\svchost.exe
    D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.club-internet.fr:80
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: Octh Class - {000123B4-9B42-4900-B3F7-F4B073EFC214} - D:\Program Files\Orbitdownloader\orbitcth.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [SpywareTerminator] "D:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: &Download by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/201
    O8 - Extra context menu item: &Grab video by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/204
    O8 - Extra context menu item: Crawler Search - tbr:iemenu
    O8 - Extra context menu item: Do&wnload selected by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/203
    O8 - Extra context menu item: Down&load all by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/202
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://D:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/229?4a05577529a849279da8f77e075acec
    O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://D:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/230?4a05577529a849279da8f77e075acec
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXE
    O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXE
    O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - D:\PROGRA~1\COPERN~1\COPERN~1.EXE
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - D:\WINDOWS\System32\shdocvw.dll
    O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - D:\WINDOWS\System32\shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: https://www.bing.com/?cc=fr&toHttps=1&redig=8E4340E974D84321BBA663104F635D75
    O15 - Trusted Zone: https://www.orange.fr/portail
    O15 - Trusted IP range: 206.161.125.149 (HKLM)
    O16 - DPF: {02CA9974-B6AC-497E-A371-73580432B0F6} - https://imlive.com/ChatSource/gVideoContol.cab
    O16 - DPF: {10000001-1001-1001-1000-000000000000} -
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - D:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://sherred.spaces.live.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - http://scan.safety.live.com/resource/download/scanner/wlscbase969.cab
    O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040428/qtinstall.info.apple.com/saba/fr/win/QuickTimeInstaller.exe
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
    O16 - DPF: {8ED577E0-25F4-4477-866B-3C572B7FB603} - http://viout.com/downloader/ViOutActive.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {EFD3EA56-234D-4240-90EA-CC9FA3AF5A01} (ConnectivityTester Class) - http://motive.club-internet.fr:2112/lwp/static/installers/WebflowActiveXInstaller_4-0-0.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{AD905C33-1463-4529-AE48-173685199FBF}: NameServer = 192.168.1.1
    O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - D:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - H:\Windows.old\Windows\system32\ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\System32\HPZipm12.exe
    O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\svcntaux.exe
    O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\swdsvc.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - D:\Program Files\Spyware Terminator\sp_rsser.exe
    O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
    1. doudou
      bon j'ai desinstalle un max et meme un peu plus

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 06:36:25, on 25/09/2008
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16705)
      Boot mode: Normal

      Running processes:
      D:\WINDOWS\System32\smss.exe
      D:\WINDOWS\system32\winlogon.exe
      D:\WINDOWS\system32\services.exe
      D:\WINDOWS\system32\lsass.exe
      H:\Windows.old\Windows\system32\ati2evxx.exe
      D:\WINDOWS\system32\svchost.exe
      D:\Program Files\Windows Defender\MsMpEng.exe
      D:\WINDOWS\System32\svchost.exe
      D:\WINDOWS\System32\svchost.exe
      D:\WINDOWS\System32\svchost.exe
      D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      D:\Program Files\Alwil Software\Avast4\ashServ.exe
      D:\WINDOWS\system32\spoolsv.exe
      D:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
      D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
      D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      D:\Program Files\Spyware Terminator\sp_rsser.exe
      D:\Program Files\UPHClean\uphclean.exe
      D:\WINDOWS\Explorer.EXE
      D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
      D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
      D:\WINDOWS\system32\wuauclt.exe
      D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      D:\WINDOWS\System32\svchost.exe
      D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
      D:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
      D:\WINDOWS\system32\ctfmon.exe
      D:\Program Files\MSN Messenger\msnmsgr.exe
      D:\Program Files\MSN Messenger\usnsvc.exe
      D:\WINDOWS\System32\svchost.exe
      D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.club-internet.fr:80
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: Octh Class - {000123B4-9B42-4900-B3F7-F4B073EFC214} - D:\Program Files\Orbitdownloader\orbitcth.dll
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
      O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
      O4 - HKLM\..\Run: [SpywareTerminator] "D:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
      O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
      O8 - Extra context menu item: &Download by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/201
      O8 - Extra context menu item: &Grab video by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/204
      O8 - Extra context menu item: Crawler Search - tbr:iemenu
      O8 - Extra context menu item: Do&wnload selected by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/203
      O8 - Extra context menu item: Down&load all by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/202
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://D:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/229?4a05577529a849279da8f77e075acec
      O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://D:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/230?4a05577529a849279da8f77e075acec
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
      O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXE
      O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXE
      O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - D:\PROGRA~1\COPERN~1\COPERN~1.EXE
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - D:\WINDOWS\System32\shdocvw.dll
      O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - D:\WINDOWS\System32\shdocvw.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
      O15 - Trusted Zone: https://www.bing.com/?cc=fr&toHttps=1&redig=8E4340E974D84321BBA663104F635D75
      O15 - Trusted Zone: https://www.orange.fr/portail
      O15 - Trusted IP range: 206.161.125.149 (HKLM)
      O16 - DPF: {02CA9974-B6AC-497E-A371-73580432B0F6} - https://imlive.com/ChatSource/gVideoContol.cab
      O16 - DPF: {10000001-1001-1001-1000-000000000000} -
      O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - D:\Program Files\Yahoo!\Common\Yinsthelper.dll
      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://sherred.spaces.live.com//PhotoUpload/MsnPUpld.cab
      O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
      O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - http://scan.safety.live.com/resource/download/scanner/wlscbase969.cab
      O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040428/qtinstall.info.apple.com/saba/fr/win/QuickTimeInstaller.exe
      O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
      O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
      O16 - DPF: {8ED577E0-25F4-4477-866B-3C572B7FB603} - http://viout.com/downloader/ViOutActive.cab
      O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
      O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
      O16 - DPF: {EFD3EA56-234D-4240-90EA-CC9FA3AF5A01} (ConnectivityTester Class) - http://motive.club-internet.fr:2112/lwp/static/installers/WebflowActiveXInstaller_4-0-0.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{AD905C33-1463-4529-AE48-173685199FBF}: NameServer = 192.168.1.1
      O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - D:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: Ati HotKey Poller - Unknown owner - H:\Windows.old\Windows\system32\ati2evxx.exe
      O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
      O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
      O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\System32\HPZipm12.exe
      O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\svcntaux.exe
      O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\swdsvc.exe
      O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
      O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - D:\Program Files\Spyware Terminator\sp_rsser.exe
      O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
      O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
      3. Destrio5 Modérateur
        Garde celui-là alors.
        1. doudou
          ok je desinstalle le reste
          et je considere comme resolu ?
      4. Destrio5 Modérateur
        ---> Désinstalle Sophos Anti-Virus, BitDefender, Spyware Terminator, ZeroSpyware, Avast, Spy Sweeper, a-squared Free, Spyware Doctor, Ad-Aware à partir de Ajout/Suppression des programmes dans Panneau de configuration.

        ---> Supprime les traces de BitDefender avec ceci :
        http://www.bitdefender.com/files/KnowledgeBase/file/BitDefender_Uninstall_Tool.exe

        ---> Installe AVG8 pour remplacer AVG7 que tu as actuellement :
        http://www.commentcamarche.net/telecharger/telecharger 118 avg antivirus free edition
        1. doudou
          pourquoi Spyware Terminator c'est gratuit et ca fontionne bien non ?
      5. doudou
        comme je le dit plus haut , ce pc n'est pas a moi, c'est un pote qui me la confié
        qui conait un copain qui conait un mec qui si connait super bien LOL
        donc , ya plein de n'importe quoi sur ce pc, et ca m'etonerais qu'il est paye bitedefender
        d'ailleur je ne l'avait pas vu, il n'apparait pas dans la barre des taches il y a juste avast
        et j'ai rajouté moi meme spyware terminator dernierement
        le mieu serai de le desinstallé ?
        1. Destrio5 Modérateur
          Sur un PC, un SEUL antivirus et un SEUL antispyware.

          Tu as payé BitDefender ?
          1. Destrio5 Modérateur
            ---> Supprime FindyKill

            ---> Poste un nouveau rapport HijackThis
            1. doudou
              je ne sait pas si c'est bon mais ca tourne nikel
              merci pour votre aide

              Logfile of Trend Micro HijackThis v2.0.2
              Scan saved at 12:38:20, on 23/09/2008
              Platform: Windows XP SP3 (WinNT 5.01.2600)
              MSIE: Internet Explorer v7.00 (7.00.6000.16705)
              Boot mode: Normal

              Running processes:
              D:\WINDOWS\System32\smss.exe
              D:\WINDOWS\system32\winlogon.exe
              D:\WINDOWS\system32\services.exe
              D:\WINDOWS\system32\lsass.exe
              H:\Windows.old\Windows\system32\ati2evxx.exe
              D:\WINDOWS\system32\svchost.exe
              D:\Program Files\Windows Defender\MsMpEng.exe
              D:\WINDOWS\System32\svchost.exe
              D:\WINDOWS\System32\svchost.exe
              D:\WINDOWS\System32\svchost.exe
              D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              D:\Program Files\Alwil Software\Avast4\ashServ.exe
              D:\WINDOWS\system32\spoolsv.exe
              D:\WINDOWS\Explorer.EXE
              D:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
              D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
              D:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
              D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
              D:\Program Files\Spyware Terminator\sp_rsser.exe
              D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
              D:\Program Files\UPHClean\uphclean.exe
              D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
              D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
              D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
              D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
              D:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
              D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
              D:\WINDOWS\system32\ctfmon.exe
              D:\Program Files\MSN Messenger\msnmsgr.exe
              D:\WINDOWS\System32\svchost.exe
              D:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
              D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
              R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.club-internet.fr:80
              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
              O2 - BHO: Octh Class - {000123B4-9B42-4900-B3F7-F4B073EFC214} - D:\Program Files\Orbitdownloader\orbitcth.dll
              O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
              O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
              O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
              O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
              O4 - HKLM\..\Run: [SpywareTerminator] "D:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
              O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
              O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background
              O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
              O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] D:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
              O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
              O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
              O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
              O8 - Extra context menu item: &Download by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/201
              O8 - Extra context menu item: &Grab video by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/204
              O8 - Extra context menu item: Crawler Search - tbr:iemenu
              O8 - Extra context menu item: Do&wnload selected by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/203
              O8 - Extra context menu item: Down&load all by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/202
              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
              O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://D:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/229?4a05577529a849279da8f77e075acec
              O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://D:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/230?4a05577529a849279da8f77e075acec
              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
              O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXE
              O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXE
              O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - D:\PROGRA~1\COPERN~1\COPERN~1.EXE
              O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
              O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
              O9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - D:\WINDOWS\System32\shdocvw.dll
              O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - D:\WINDOWS\System32\shdocvw.dll
              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
              O15 - Trusted Zone: https://www.bing.com/?cc=fr&toHttps=1&redig=8E4340E974D84321BBA663104F635D75
              O15 - Trusted Zone: https://www.orange.fr/portail
              O15 - Trusted IP range: 206.161.125.149 (HKLM)
              O16 - DPF: {02CA9974-B6AC-497E-A371-73580432B0F6} - https://imlive.com/ChatSource/gVideoContol.cab
              O16 - DPF: {10000001-1001-1001-1000-000000000000} -
              O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - D:\Program Files\Yahoo!\Common\Yinsthelper.dll
              O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://sherred.spaces.live.com//PhotoUpload/MsnPUpld.cab
              O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
              O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - http://scan.safety.live.com/resource/download/scanner/wlscbase969.cab
              O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040428/qtinstall.info.apple.com/saba/fr/win/QuickTimeInstaller.exe
              O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
              O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
              O16 - DPF: {8ED577E0-25F4-4477-866B-3C572B7FB603} - http://viout.com/downloader/ViOutActive.cab
              O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
              O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
              O16 - DPF: {EFD3EA56-234D-4240-90EA-CC9FA3AF5A01} (ConnectivityTester Class) - http://motive.club-internet.fr:2112/lwp/static/installers/WebflowActiveXInstaller_4-0-0.cab
              O17 - HKLM\System\CCS\Services\Tcpip\..\{AD905C33-1463-4529-AE48-173685199FBF}: NameServer = 192.168.1.1
              O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - D:\Program Files\a-squared Free\a2service.exe
              O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
              O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - D:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
              O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              O23 - Service: Ati HotKey Poller - Unknown owner - H:\Windows.old\Windows\system32\ati2evxx.exe
              O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
              O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
              O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
              O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
              O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
              O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
              O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - D:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
              O23 - Service: ZeroSpyware FileDeleter (FileDeleter) - FBMSoftware - D:\Program Files\FBM Software\ZeroSpyware\FileDeleter.exe
              O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
              O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
              O23 - Service: Norton Ghost - Symantec Corporation - D:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
              O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\System32\HPZipm12.exe
              O23 - Service: Créateur de rapports d'état Sophos Anti-Virus (SAVAdminService) - Sophos Plc - D:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
              O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\svcntaux.exe
              O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\swdsvc.exe
              O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
              O23 - Service: Sophos AutoUpdate Service - Unknown owner - D:\Program Files\Sophos\AutoUpdate\ALsvc.exe (file missing)
              O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
              O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - D:\Program Files\Spyware Terminator\sp_rsser.exe
              O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
              O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
              O23 - Service: BitDefender Communicator (XCOMM) - Softwin - D:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
          2. doudou
            ----------------- FindyKill V3.O95 -----------------

            * User : admin Platform : Windows XP
            * Suppression effectuée à 17:53:42 le 22/09/2008
            * Emplacement : D:\Program Files\FindyKill\FindyKill.exe
            * Outils Mis a jours le 20/09/08 par Chiquitine29

            »»»» Suppression des fichiers dans D:

            »»»» Suppression des fichiers dans D:\WINDOWS

            Supprimé ! - "D:\WINDOWS\exefnd"

            »»»» Suppression des fichiers dans D:\WINDOWS\system32

            »»»» Suppression des fichiers dans D:\WINDOWS\system32\drivers

            »»»» Suppression des fichiers dans D:\Documents and Settings\admin\Application Data

            »»»» Suppression des fichiers dans D:\WINDOWS\Prefetch

            »»»» Suppression des fichiers dans D:\DOCUME~1\admin\LOCALS~1\Temp

            Supprimé ! - "D:\DOCUME~1\admin\LOCALS~1\Temp\jusched.log"
            Supprimé ! - "D:\DOCUME~1\admin\LOCALS~1\Temp\swt-gdip-win32-3430.dll"
            Supprimé ! - "D:\DOCUME~1\admin\LOCALS~1\Temp\swt-win32-3430.dll"

            -----------------*** Verification ***----------------

            »»»» Suppression des fichiers dans D:

            »»»» Presence des fichiers dans D:

            »»»» Presence des fichiers dans D:\WINDOWS

            »»»» Presence des fichiers dans D:\WINDOWS\Prefetch

            »»»» Presence des fichiers dans D:\WINDOWS\system32

            »»»» Presence des fichiers dans D:\WINDOWS\system32\drivers

            »»»» Presence des fichiers dans D:\Documents and Settings\admin\Application Data

            »»»» Suppression des clefs du registre..

            "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Hardware Profiles\0001\System\CurrentControlSet\Enum\ROOT\LEGACY_SROSA " - Supprimé !
            "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Enum\ROOT\LEGACY_SROSA " - Supprimé !

            »»»» Suppression des clefs du registre effectuée !

            »»»» Affichage des fichiers cachés réparé !

            »»»» Services de securité Windows redemarré !

            »»»» Suppression des fichiers temporaires :

            »»»»»»»»»»»»»»»»»»»» OK!

            »»»» Suppression des fichiers dans Support amovible :

            ----------- ! Nettoyage realisé avec succès ! -----------

            »»»» Recherche d autres infections :

            D:\Documents and Settings\admin\Bureau\JEUX ODILE\belwed-deluxe edition\sounds\cached_firecrackle.wav
            D:\Documents and Settings\admin\Bureau\JEUX ODILE\belwed-deluxe edition\sounds\firecrackle.ogg
            D:\Documents and Settings\admin\Bureau\UTILITAIRES de copies nettoyages securit‚\COPIER\isobuster keygen.exe
            D:\Documents and Settings\admin\Bureau\video\RealPlayer10GOLD KeyGen.exe
            D:\Documents and Settings\admin\Favoris\Gaetan\Crack-hack
            D:\Documents and Settings\admin\Favoris\Gaetan\Crack-hack\Cocoenforce hacking.url
            D:\Documents and Settings\admin\Favoris\Gaetan\Crack-hack\TorrentResource.com Votre r‚f‚rence en matiŠre de Torrent!.url
            D:\Documents and Settings\admin\Favoris\pirate\CRACKMANWORLD PARCHES - DESCARGAR PARCHE Singles v1.2 Alex_DjRoman.url
            D:\Documents and Settings\admin\Favoris\pirate\CRACKMANWORLD PARCHES - PC.url
            D:\Documents and Settings\admin\Favoris\pirate\partition magic 8 - CrackYard.com - Crack, Serials, Keygens, Patches.url
            D:\Documents and Settings\admin\Favoris\pirate\ AstaLaVista.US - kapere - unlock software with cracks - serials - keygens - loaders.url
            D:\Documents and Settings\admin\Favoris\pirate\ code crack La liste des sites pour code crack.url
            D:\Documents and Settings\admin\Favoris\TELEcharger\crack no cd jeu pc, tout sur crack no cd jeu pc.url
            D:\Documents and Settings\admin\Favoris\video upskirt\Crackle - Stream On.url
            D:\Documents and Settings\admin\Menu D‚marrer\Programmes\Ultimate ZIP Cracker
            D:\Documents and Settings\admin\Menu D‚marrer\Programmes\Ultimate ZIP Cracker\Ultimate ZIP Cracker release notes.html
            D:\Documents and Settings\admin\Menu D‚marrer\Programmes\Ultimate ZIP Cracker\Ultimate ZIP Cracker.lnk

            ------------------ ! Fin du rapport ! --------------------
            1. Destrio5 Modérateur
              --> Branche tes disques amovibles à ton PC (clefs USB, disque dur externe, etc...) sans les ouvrir

              --> Double-clique sur le raccourci FindyKill sur ton bureau

              --> Au menu principal, choisis l'option 2 (Suppression)

              /!\ Il y aura 2 redémarrages, laisse travailler l'outil jusqu'à l'apparition du message "nettoyage effectué" /!\

              --> Ensuite, poste le rapport FindyKill.txt

              Note : le rapport FindyKill.txt est sauvegardé à la racine du disque.
              1. Destrio5 Modérateur
                Ok.
                1. doudou
                  il y a un message tres cours qui apparait avant le raport qui dit qu'il na pas pu trouve la clé registre d'une valeur spécifié ?

                  ---------------- FindyKill V3.095 ------------------

                  * User : admin Platform : Windows XP
                  * Emplacement : D:\Program Files\FindyKill\FindyKill.exe
                  * Outils Mis a jours le 20/09/08 par Chiquitine29
                  * Recherche effectuée à 11:35:18 le 21/09/2008

                  ----------------- *** Recherche *** ------------------

                  »»»» Presence des fichiers dans D:

                  »»»» Presence des fichiers dans D:\WINDOWS

                  Présent ! - "D:\WINDOWS\exefnd"

                  »»»» Presence des fichiers dans D:\WINDOWS\Prefetch

                  »»»» Presence des fichiers dans D:\WINDOWS\system32

                  »»»» Presence des fichiers dans D:\WINDOWS\system32\drivers

                  »»»» Presence des fichiers dans D:\Documents and Settings\admin\Application Data

                  »»»» Presence des fichiers dans D:\DOCUME~1\admin\LOCALS~1\Temp

                  »»»» Registre :

                  ! REG.EXE VERSION 3.0

                  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
                  avast! REG_SZ D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                  SunJavaUpdateSched REG_SZ "D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                  SpywareTerminator REG_SZ "D:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"

                  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

                  ! REG.EXE VERSION 3.0

                  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
                  ctfmon.exe REG_SZ D:\WINDOWS\system32\ctfmon.exe
                  msnmsgr REG_SZ "D:\Program Files\MSN Messenger\msnmsgr.exe" /background

                  »»»» Presence d infections dans Support amovible :

                  ----------- ! Recherche realisée avec success ! -----------
              2. Destrio5 Modérateur
                --> Télécharge FindyKill sur ton bureau :
                http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe

                --> Lance l'installation avec les paramètres par defaut

                --> Double-clique sur le raccourci FindyKill sur ton bureau

                --> Au menu principal, choisis l'option 1 (Recherche)

                --> Poste le rapport FindyKill.txt

                Note : le rapport FindyKill.txt est sauvegardé à la racine du disque.
                1. doudou
                  desole je doit partir
              3. Destrio5 Modérateur
                ---> Télécharge OTMoveIt2 à partir du lien ci-dessous :
                http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe

                ---> Enregistre le fichier sur le Bureau.

                ---> Double-clique sur le fichier OTMoveIt2.exe pour lancer l'outil.
                Assure-toi que la case Unregister Dll's and Ocx's soit bien cochée.

                ---> Copie l'intégralité du texte ci-dessous et colle-le dans la fenêtre intitulée Paste List Of Files/Folders to Move.

                D:\PROGRA~1\Privacy Guardian\

                ---> Clique sur MoveIt! pour lancer la suppression.
                Lorsqu'un résultat apparaît dans le cadre Results, clique sur Exit.

                Note : Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. Accepte en cliquant sur YES.

                ---> Poste le rapport de OTMoveIt qui se trouve dans C:\_OTMoveIt\MovedFiles.
                1. doudou
                  D:\PROGRA~1\Privacy Guardian\ref moved successfully.
                  D:\PROGRA~1\Privacy Guardian\data moved successfully.
                  D:\PROGRA~1\Privacy Guardian moved successfully.

                  OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 09212008_093928
              4. doudou
                je pensais que tu voulais comparer apres
                voici le rapport
                -----------\\ ToolBar S&D 1.2.0 XP/Vista

                Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
                X86-based PC ( Uniprocessor Free : Intel(R) Celeron(R) CPU 2.60GHz )
                BIOS : Award Modular BIOS v6.0
                USER : admin ( Administrator )
                BOOT : Normal boot
                Antivirus : avast! antivirus 4.8.1201 [VPS 080920-0] 4.8.1201 (Activated)
                Firewall : Sunbelt Kerio Personal Firewall 4.3.268 T (Activated)
                A:\ (USB)
                C:\ (Local Disk) - FAT32 - Total : 6 Go Free : 5 Go
                D:\ (Local Disk) - NTFS - Total : 40 Go Free : 1 Go
                E:\ (Local Disk) - FAT32 - Total : 3 Go Free : 2 Go
                F:\ (Local Disk) - NTFS - Total : 92 Go Free : 22 Go
                G:\ (Local Disk) - NTFS - Total : 48 Go Free : 7 Go
                H:\ (Local Disk) - NTFS - Total : 34 Go Free : 9 Go
                I:\ (Local Disk) - NTFS - Total : 92 Go Free : 1 Go
                K:\ (CD or DVD)
                L:\ (CD or DVD)
                M:\ (CD or DVD)

                "D:\ToolBar SD" ( MAJ : 14-09-2008|23:30 )
                Option : [2] ( 21/09/2008| 8:36 )

                -----------\\ SUPPRESSION

                Supprime! - D:\Program Files\Crawler\Download
                Supprime! - D:\Program Files\Crawler\Toolbar
                Supprime! - D:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\Barre d'outils Crawler
                Supprime! - D:\DOCUME~1\admin\Cookies\admin@dnl.crawler[1].txt
                Supprime! - D:\WINDOWS\iun6002.exe
                Supprime! - D:\Program Files\Crawler

                -----------\\ Recherche de Fichiers / Dossiers ...

                -----------\\ Extensions

                (admin) - {84b24861-62f6-364b-eba5-2e5e2061d7e6} => mediaplayerconnectivity
                (admin) - {25A1388B-6B18-46c3-BEBA-A81915D0DE8F} => qls
                (admin) - {34274bf4-1d97-a289-e984-17e546307e4f} => adblock
                (admin) - {55041010-54F1-412e-8177-2E411719162D} => Torpark%20Theme
                (admin) - {65f3d609-18c1-4f62-bcef-1973b6abeab4} => restartfirefox
                (admin) - {73a6fe31-595d-460b-a920-fcc0f8843232} => noscript
                (admin) - {e0204bd5-9d31-402b-a99d-a6aa8ffebdca} => torbutton
                (admin) - {e411bb40-b04c-11d8-92e7-00d09e0179f2} => firesomething

                -----------\\ [..\Internet Explorer\Main]

                [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                "Local Page"="D:\\windows\\system32\\blank.htm"
                "Start Page"="https://www.google.com/search?q=reglage+bios++DD+hitachi+HDT+sata&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8&gws_rd=ssl"
                "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                "Url"="http://www.microsoft.com/athome/community/rss.xml"
                "Url"="http://www.microsoft.com/atwork/community/rss.xml"

                [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
                "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
                "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
                "Start Page"="https://www.msn.com/fr-fr/"
                "Local Page"="D:\\windows\\system32\\blank.htm"

                --------------------\\ Recherche d'autres infections

                D:\WINDOWS\exefnd
                [b]==> BAGLE <==/b

                --------------------\\ ROGUES ..

                D:\PROGRA~1\Privacy Guardian

                --------------------\\ Cracks & Keygens ..

                D:\DOCUME~1\admin\Bureau\UTILITAIRES de copies nettoyages securit‚\COPIER\isobuster keygen.exe
                D:\DOCUME~1\admin\Bureau\video\RealPlayer10GOLD KeyGen.exe
                D:\DOCUME~1\admin\Favoris\Gaetan\Crack-hack
                D:\DOCUME~1\admin\Favoris\Gaetan\Crack-hack\Cocoenforce hacking.url
                D:\DOCUME~1\admin\Favoris\Gaetan\Crack-hack\TorrentResource.com Votre r‚f‚rence en matiŠre de Torrent!.url
                D:\DOCUME~1\admin\Favoris\pirate\CRACKMANWORLD PARCHES - DESCARGAR PARCHE Singles v1.2 Alex_DjRoman.url
                D:\DOCUME~1\admin\Favoris\pirate\CRACKMANWORLD PARCHES - PC.url
                D:\DOCUME~1\admin\Favoris\pirate\partition magic 8 - CrackYard.com - Crack, Serials, Keygens, Patches.url
                D:\DOCUME~1\admin\Favoris\pirate\ AstaLaVista.US - kapere - unlock software with cracks - serials - keygens - loaders.url
                D:\DOCUME~1\admin\Favoris\pirate\ code crack La liste des sites pour code crack.url
                D:\DOCUME~1\admin\Favoris\TELEcharger\crack no cd jeu pc, tout sur crack no cd jeu pc.url

                1 - "D:\ToolBar SD\TB_1.txt" - 21/09/2008| 6:57 - Option : [1]
                2 - "D:\ToolBar SD\TB_2.txt" - 21/09/2008| 8:46 - Option : [2]

                -----------\\ Fin du rapport a 8:46:21,29
                2. Destrio5 Modérateur
                  Fais l'option 2 de ToolBar S&D.
                  1. doudou
                    ok

                    ogfile of Trend Micro HijackThis v2.0.2
                    Scan saved at 08:48:57, on 21/09/2008
                    Platform: Windows XP SP3 (WinNT 5.01.2600)
                    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                    Boot mode: Normal

                    Running processes:
                    D:\WINDOWS\System32\smss.exe
                    D:\WINDOWS\system32\winlogon.exe
                    D:\WINDOWS\system32\services.exe
                    D:\WINDOWS\system32\lsass.exe
                    H:\Windows.old\Windows\system32\ati2evxx.exe
                    D:\WINDOWS\system32\svchost.exe
                    D:\Program Files\Windows Defender\MsMpEng.exe
                    D:\WINDOWS\System32\svchost.exe
                    D:\WINDOWS\System32\svchost.exe
                    D:\WINDOWS\System32\svchost.exe
                    D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                    D:\Program Files\Alwil Software\Avast4\ashServ.exe
                    D:\WINDOWS\system32\spoolsv.exe
                    D:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
                    D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
                    D:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
                    D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                    D:\Program Files\Spyware Terminator\sp_rsser.exe
                    D:\Program Files\UPHClean\uphclean.exe
                    D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
                    D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                    D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                    D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
                    D:\WINDOWS\Explorer.EXE
                    D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                    D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
                    D:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
                    D:\WINDOWS\system32\ctfmon.exe
                    D:\Program Files\MSN Messenger\msnmsgr.exe
                    D:\WINDOWS\System32\svchost.exe
                    D:\Program Files\MSN Messenger\usnsvc.exe
                    D:\WINDOWS\System32\svchost.exe
                    D:\Program Files\PokerStars\PokerStars.exe
                    D:\Program Files\PokerStars\PokerStarsCommunicate.exe
                    D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.club-internet.fr:80
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                    O2 - BHO: Octh Class - {000123B4-9B42-4900-B3F7-F4B073EFC214} - D:\Program Files\Orbitdownloader\orbitcth.dll
                    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                    O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                    O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                    O4 - HKLM\..\Run: [SpywareTerminator] "D:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
                    O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
                    O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background
                    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] D:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
                    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                    O8 - Extra context menu item: &Download by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/201
                    O8 - Extra context menu item: &Grab video by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/204
                    O8 - Extra context menu item: Crawler Search - tbr:iemenu
                    O8 - Extra context menu item: Do&wnload selected by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/203
                    O8 - Extra context menu item: Down&load all by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/202
                    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
                    O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://D:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/229?4a05577529a849279da8f77e075acec
                    O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://D:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/230?4a05577529a849279da8f77e075acec
                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                    O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXE
                    O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXE
                    O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - D:\PROGRA~1\COPERN~1\COPERN~1.EXE
                    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - D:\WINDOWS\System32\shdocvw.dll
                    O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - D:\WINDOWS\System32\shdocvw.dll
                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
                    O15 - Trusted Zone: https://www.bing.com/?cc=fr&toHttps=1&redig=8E4340E974D84321BBA663104F635D75
                    O15 - Trusted Zone: https://www.orange.fr/portail
                    O15 - Trusted IP range: 206.161.125.149 (HKLM)
                    O16 - DPF: {02CA9974-B6AC-497E-A371-73580432B0F6} - https://imlive.com/ChatSource/gVideoContol.cab
                    O16 - DPF: {10000001-1001-1001-1000-000000000000} -
                    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - D:\Program Files\Yahoo!\Common\Yinsthelper.dll
                    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://sherred.spaces.live.com//PhotoUpload/MsnPUpld.cab
                    O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
                    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - http://scan.safety.live.com/resource/download/scanner/wlscbase969.cab
                    O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040428/qtinstall.info.apple.com/saba/fr/win/QuickTimeInstaller.exe
                    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
                    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
                    O16 - DPF: {8ED577E0-25F4-4477-866B-3C572B7FB603} - http://viout.com/downloader/ViOutActive.cab
                    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
                    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                    O16 - DPF: {EFD3EA56-234D-4240-90EA-CC9FA3AF5A01} (ConnectivityTester Class) - http://motive.club-internet.fr:2112/lwp/static/installers/WebflowActiveXInstaller_4-0-0.cab
                    O17 - HKLM\System\CCS\Services\Tcpip\..\{AD905C33-1463-4529-AE48-173685199FBF}: NameServer = 192.168.1.1
                    O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - D:\Program Files\a-squared Free\a2service.exe
                    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                    O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - D:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
                    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                    O23 - Service: Ati HotKey Poller - Unknown owner - H:\Windows.old\Windows\system32\ati2evxx.exe
                    O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
                    O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
                    O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                    O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
                    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
                    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - D:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
                    O23 - Service: ZeroSpyware FileDeleter (FileDeleter) - FBMSoftware - D:\Program Files\FBM Software\ZeroSpyware\FileDeleter.exe
                    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                    O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
                    O23 - Service: Norton Ghost - Symantec Corporation - D:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
                    O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\System32\HPZipm12.exe
                    O23 - Service: Créateur de rapports d'état Sophos Anti-Virus (SAVAdminService) - Sophos Plc - D:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
                    O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\svcntaux.exe
                    O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\swdsvc.exe
                    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
                    O23 - Service: Sophos AutoUpdate Service - Unknown owner - D:\Program Files\Sophos\AutoUpdate\ALsvc.exe (file missing)
                    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                    O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - D:\Program Files\Spyware Terminator\sp_rsser.exe
                    O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
                    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
                    O23 - Service: BitDefender Communicator (XCOMM) - Softwin - D:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
                3. doudou
                  pour info il n'y a pas (ou plus) d'installation et donc de raccourci pour toolbar
                  voici le rapport merci
                  -----------\\ ToolBar S&D 1.2.0 XP/Vista

                  Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
                  X86-based PC ( Uniprocessor Free : Intel(R) Celeron(R) CPU 2.60GHz )
                  BIOS : Award Modular BIOS v6.0
                  USER : admin ( Administrator )
                  BOOT : Normal boot
                  Antivirus : avast! antivirus 4.8.1201 [VPS 080920-0] 4.8.1201 (Activated)
                  Firewall : Sunbelt Kerio Personal Firewall 4.3.268 T (Activated)
                  A:\ (USB)
                  C:\ (Local Disk) - FAT32 - Total : 6 Go Free : 5 Go
                  D:\ (Local Disk) - NTFS - Total : 40 Go Free : 1 Go
                  E:\ (Local Disk) - FAT32 - Total : 3 Go Free : 2 Go
                  F:\ (Local Disk) - NTFS - Total : 92 Go Free : 22 Go
                  G:\ (Local Disk) - NTFS - Total : 48 Go Free : 7 Go
                  H:\ (Local Disk) - NTFS - Total : 34 Go Free : 9 Go
                  I:\ (Local Disk) - NTFS - Total : 92 Go Free : 1 Go
                  K:\ (CD or DVD)
                  L:\ (CD or DVD)
                  M:\ (CD or DVD)

                  "D:\ToolBar SD" ( MAJ : 14-09-2008|23:30 )
                  Option : [1] ( 21/09/2008| 6:51 )

                  -----------\\ Recherche de Fichiers / Dossiers ...

                  D:\Program Files\Crawler
                  D:\Program Files\Crawler\Download
                  D:\Program Files\Crawler\Toolbar
                  D:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\Barre d'outils Crawler
                  D:\DOCUME~1\admin\Cookies\admin@dnl.crawler[1].txt
                  D:\WINDOWS\iun6002.exe

                  -----------\\ Extensions

                  (admin) - {84b24861-62f6-364b-eba5-2e5e2061d7e6} => mediaplayerconnectivity
                  (admin) - {25A1388B-6B18-46c3-BEBA-A81915D0DE8F} => qls
                  (admin) - {34274bf4-1d97-a289-e984-17e546307e4f} => adblock
                  (admin) - {55041010-54F1-412e-8177-2E411719162D} => Torpark%20Theme
                  (admin) - {65f3d609-18c1-4f62-bcef-1973b6abeab4} => restartfirefox
                  (admin) - {73a6fe31-595d-460b-a920-fcc0f8843232} => noscript
                  (admin) - {e0204bd5-9d31-402b-a99d-a6aa8ffebdca} => torbutton
                  (admin) - {e411bb40-b04c-11d8-92e7-00d09e0179f2} => firesomething

                  -----------\\ [..\Internet Explorer\Main]

                  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                  "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                  "Local Page"="D:\\windows\\system32\\blank.htm"
                  "Start Page"="https://www.google.com/search?q=reglage+bios++DD+hitachi+HDT+sata&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8&gws_rd=ssl"
                  "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                  "Url"="http://www.microsoft.com/athome/community/rss.xml"
                  "Url"="http://www.microsoft.com/atwork/community/rss.xml"

                  [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                  "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
                  "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
                  "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
                  "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"
                  "Local Page"="D:\\windows\\system32\\blank.htm"

                  --------------------\\ Recherche d'autres infections

                  D:\WINDOWS\exefnd
                  [b]==> BAGLE <==/b

                  --------------------\\ ROGUES ..

                  D:\PROGRA~1\Privacy Guardian

                  --------------------\\ Cracks & Keygens ..

                  D:\DOCUME~1\admin\Bureau\UTILITAIRES de copies nettoyages securit‚\COPIER\isobuster keygen.exe
                  D:\DOCUME~1\admin\Bureau\video\RealPlayer10GOLD KeyGen.exe
                  D:\DOCUME~1\admin\Favoris\Gaetan\Crack-hack
                  D:\DOCUME~1\admin\Favoris\Gaetan\Crack-hack\Cocoenforce hacking.url
                  D:\DOCUME~1\admin\Favoris\Gaetan\Crack-hack\TorrentResource.com Votre r‚f‚rence en matiŠre de Torrent!.url
                  D:\DOCUME~1\admin\Favoris\pirate\CRACKMANWORLD PARCHES - DESCARGAR PARCHE Singles v1.2 Alex_DjRoman.url
                  D:\DOCUME~1\admin\Favoris\pirate\CRACKMANWORLD PARCHES - PC.url
                  D:\DOCUME~1\admin\Favoris\pirate\partition magic 8 - CrackYard.com - Crack, Serials, Keygens, Patches.url
                  D:\DOCUME~1\admin\Favoris\pirate\ AstaLaVista.US - kapere - unlock software with cracks - serials - keygens - loaders.url
                  D:\DOCUME~1\admin\Favoris\pirate\ code crack La liste des sites pour code crack.url
                  D:\DOCUME~1\admin\Favoris\TELEcharger\crack no cd jeu pc, tout sur crack no cd jeu pc.url

                  1 - "D:\ToolBar SD\TB_1.txt" - 21/09/2008| 6:57 - Option : [1]

                  -----------\\ Fin du rapport a 6:57:24,12
                  1. Destrio5 Modérateur
                    ---> Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
                    https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

                    * Lance l'installation du programme en exécutant le fichier téléchargé.
                    * Double-clique maintenant sur le raccourci de Toolbar-S&D.
                    * Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
                    * Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
                    * Poste le rapport généré. (C:\TB.txt)
                    1. doudou
                      Logfile of Trend Micro HijackThis v2.0.2
                      Scan saved at 08:19:36, on 20/09/2008
                      Platform: Windows XP SP3 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                      Boot mode: Normal

                      Running processes:
                      D:\WINDOWS\System32\smss.exe
                      D:\WINDOWS\system32\winlogon.exe
                      D:\WINDOWS\system32\services.exe
                      D:\WINDOWS\system32\lsass.exe
                      H:\Windows.old\Windows\system32\ati2evxx.exe
                      D:\WINDOWS\system32\svchost.exe
                      D:\Program Files\Windows Defender\MsMpEng.exe
                      D:\WINDOWS\System32\svchost.exe
                      D:\WINDOWS\System32\svchost.exe
                      D:\WINDOWS\System32\svchost.exe
                      D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                      D:\Program Files\Alwil Software\Avast4\ashServ.exe
                      D:\WINDOWS\system32\spoolsv.exe
                      D:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
                      D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
                      D:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
                      D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                      D:\Program Files\Spyware Terminator\sp_rsser.exe
                      D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
                      D:\Program Files\UPHClean\uphclean.exe
                      D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                      D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                      D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
                      D:\WINDOWS\Explorer.EXE
                      D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                      D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
                      D:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
                      D:\WINDOWS\system32\ctfmon.exe
                      D:\Program Files\MSN Messenger\msnmsgr.exe
                      D:\WINDOWS\System32\svchost.exe
                      D:\Program Files\MSN Messenger\usnsvc.exe
                      D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.club-internet.fr:80
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      O2 - BHO: Octh Class - {000123B4-9B42-4900-B3F7-F4B073EFC214} - D:\Program Files\Orbitdownloader\orbitcth.dll
                      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                      O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - D:\PROGRA~1\Crawler\Toolbar\ctbr.dll
                      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                      O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                      O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - D:\PROGRA~1\Crawler\Toolbar\ctbr.dll
                      O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                      O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                      O4 - HKLM\..\Run: [SpywareTerminator] "D:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
                      O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
                      O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background
                      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                      O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] D:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
                      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                      O8 - Extra context menu item: &Download by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/201
                      O8 - Extra context menu item: &Grab video by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/204
                      O8 - Extra context menu item: Crawler Search - tbr:iemenu
                      O8 - Extra context menu item: Do&wnload selected by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/203
                      O8 - Extra context menu item: Down&load all by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/202
                      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
                      O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://D:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/229?4a05577529a849279da8f77e075acec
                      O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://D:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/230?4a05577529a849279da8f77e075acec
                      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                      O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXE
                      O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXE
                      O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - D:\PROGRA~1\COPERN~1\COPERN~1.EXE
                      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                      O9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - D:\WINDOWS\System32\shdocvw.dll
                      O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - D:\WINDOWS\System32\shdocvw.dll
                      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
                      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
                      O15 - Trusted Zone: https://www.bing.com/?cc=fr&toHttps=1&redig=8E4340E974D84321BBA663104F635D75
                      O15 - Trusted Zone: https://www.orange.fr/portail
                      O15 - Trusted IP range: 206.161.125.149 (HKLM)
                      O16 - DPF: {02CA9974-B6AC-497E-A371-73580432B0F6} - https://imlive.com/ChatSource/gVideoContol.cab
                      O16 - DPF: {10000001-1001-1001-1000-000000000000} -
                      O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - D:\Program Files\Yahoo!\Common\Yinsthelper.dll
                      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://sherred.spaces.live.com//PhotoUpload/MsnPUpld.cab
                      O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
                      O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - http://scan.safety.live.com/resource/download/scanner/wlscbase969.cab
                      O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040428/qtinstall.info.apple.com/saba/fr/win/QuickTimeInstaller.exe
                      O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
                      O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
                      O16 - DPF: {8ED577E0-25F4-4477-866B-3C572B7FB603} - http://viout.com/downloader/ViOutActive.cab
                      O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
                      O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                      O16 - DPF: {EFD3EA56-234D-4240-90EA-CC9FA3AF5A01} (ConnectivityTester Class) - http://motive.club-internet.fr:2112/lwp/static/installers/WebflowActiveXInstaller_4-0-0.cab
                      O17 - HKLM\System\CCS\Services\Tcpip\..\{AD905C33-1463-4529-AE48-173685199FBF}: NameServer = 192.168.1.1
                      O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - D:\PROGRA~1\Crawler\Toolbar\ctbr.dll
                      O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - D:\Program Files\a-squared Free\a2service.exe
                      O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                      O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - D:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
                      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                      O23 - Service: Ati HotKey Poller - Unknown owner - H:\Windows.old\Windows\system32\ati2evxx.exe
                      O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
                      O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
                      O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                      O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                      O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
                      O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
                      O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - D:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
                      O23 - Service: ZeroSpyware FileDeleter (FileDeleter) - FBMSoftware - D:\Program Files\FBM Software\ZeroSpyware\FileDeleter.exe
                      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                      O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
                      O23 - Service: Norton Ghost - Symantec Corporation - D:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
                      O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\System32\HPZipm12.exe
                      O23 - Service: Créateur de rapports d'état Sophos Anti-Virus (SAVAdminService) - Sophos Plc - D:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
                      O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\svcntaux.exe
                      O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\swdsvc.exe
                      O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
                      O23 - Service: Sophos AutoUpdate Service - Unknown owner - D:\Program Files\Sophos\AutoUpdate\ALsvc.exe (file missing)
                      O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                      O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - D:\Program Files\Spyware Terminator\sp_rsser.exe
                      O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
                      O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
                      O23 - Service: BitDefender Communicator (XCOMM) - Softwin - D:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
                      • 1
                      • 2

                      Discussions similaires

                      infection
                      céline0034

                      12 réponses
                      Infection
                      toast3r

                      44 réponses
                      problème infection ?
                      emma

                      76 réponses
                      Infection FileRepMetagen
                      Fab8769

                      9 réponses
                      Infection Luckystarting
                      @ssomw@r

                      20 réponses