Virus You have a security problem

Toprek -  
Bonjour,

J'ai lancé le logiciel ToolBar suite à l'apparition d'un virus sur mon PC. Je suis en pleine rédaction de mon mémoire et je voudais bien réparer au plus vite mes bétises. Qqn peut-il me venir en aide avant qu'il ne soit trop tard?

Merci

-----------\\ ToolBar S&D 1.2.0 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) M processor 1.86GHz )
BIOS : KBC Version 38.59
USER : cav ( Not Administrator ! )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total : 55 Go Free : 37 Go

"C:\ToolBar SD" ( MAJ : 14-09-2008|23:30 )
Option : [1] ( jeu. 18/09/2008|10:08 )

-----------\\ Recherche de Fichiers / Dossiers ...

C:\DOCUME~1\cav\Cookies\cav@myway[1].txt

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.google.be/webhp?sourceid=navclient&ie=UTF-8&gws_rd=ssl"
"Search Page"="https://www.google.com/?gws_rd=ssl"
"SearchMigratedDefaultURL"="https://www.google.com/webhp?gws_rd=ssl{searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.01net.com/telecharger/"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.01net.com/telecharger/"

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\cav\Cookies\cav@downloadserialnumbercrack[1].txt
C:\DOCUME~1\cav\Local Settings\Temporary Internet Files\Content.IE5\5H8T1GK6\mindjet-mindmanager-pro-72-crackkeygen[1].htm
C:\DOCUME~1\cav\Local Settings\Temporary Internet Files\Content.IE5\UP5UR2DS\serial-crack-free-video1[1].htm

1 - "C:\ToolBar SD\TB_1.txt" - jeu. 18/09/2008|10:10 - Option : [1]

-----------\\ Fin du rapport a 10:10:51,51
Configuration: Windows XP
Internet Explorer 7.0

16 réponses

  2. toprek
    Bon ben voilà, tout à l'air d'aller super bien. Juste quelques petits messages d'erreurs à chaque démarrage mais je suis déjà hyper heureux de pas devoir jetter mon ordi. Un tout grand merci à toi pour cette aide précieuse.
    1. Toprek
      [ Rapport ToolsCleaner version 2.2.3 (par A.Rothstein & dj QUIOU) ]

      -->- Recherche:

      C:\Combofix.txt: trouvé !
      C:\TB.txt: trouvé !
      C:\Qoobox: trouvé !
      C:\Toolbar SD: trouvé !
      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
      C:\Documents and Settings\cav\Bureau\HijackThis.lnk: trouvé !
      C:\Documents and Settings\cav\Bureau\ComboFix.exe: trouvé !
      C:\Documents and Settings\cav\Bureau\HJTInstall.exe: trouvé !
      C:\Documents and Settings\cav\Bureau\ToolBarSD.exe: trouvé !
      C:\Documents and Settings\cav\Bureau\TB.txt: trouvé !
      C:\Program Files\Trend Micro\HijackThis: trouvé !
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
      C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !

      ---------------------------------
      -->- Suppression:

      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
      C:\Documents and Settings\cav\Bureau\HijackThis.lnk: supprimé !
      C:\Documents and Settings\cav\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
      C:\Documents and Settings\cav\Bureau\HJTInstall.exe: supprimé !
      C:\Documents and Settings\cav\Bureau\ToolBarSD.exe: supprimé !
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
      C:\Combofix.txt: supprimé !
      C:\TB.txt: supprimé !
      C:\Documents and Settings\cav\Bureau\TB.txt: supprimé !
      C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
      C:\Qoobox: supprimé !
      C:\Toolbar SD: supprimé !
      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
      C:\Program Files\Trend Micro\HijackThis: supprimé !
      3. Toprek
        Ok pour le nettoyage mais pour le registre, je peux sans craintes faire "réparer" pour toutes les erreurs ou il faut faire attention?
        2. Toprek
          Et pour Ccleaner, je fais tout ce qui est proposé dans le tuto que tu m'as mis en lien?
          1. Utilisateur anonyme
            réouvre hijackthis
            fais scan only
            coches ces lignes :

            O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)

            O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

            O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
            O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
            O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
            O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

            tu les coches et tu clic sur fix checked

            ensuite :

            -> Télécharge Ccleaner (n'installe pas la barre d'outil Yahoo):

            http://download.piriform.com/ccsetup210.exe

            https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

            -> Tuto : https://www.malekal.com/tutoriel-ccleaner/

            ensuiet :

            * pour supprimer les outils/fix utilisés :

            Télécharge ToolsCleaner sur ton bureau.
            -->
            ftp://ftp.commentcamarche.com/download/ToolsCleaner2.exe
            http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
            http://pc-system.fr/

            # Clique sur Recherche et laisse le scan agir ...
            # Clique sur Suppression pour finaliser.
            # Tu peux, si tu le souhaites, te servir des Options facultatives.
            # Clique sur Quitter pour obtenir le rapport.
            # Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

            Désactive et réactive ta restauration system :

            (1) Désactiver la Restauration du système

            cliques sur Démarrer
            Cliques droit sur Poste de travail
            cliques sur Propriétés
            Cliques sur l'onglet Restauration du système
            Coches Désactiver la Restauration du système sur tous les lecteurs
            Cliques sur Appliquer, Lorsque le message de confirmation apparaît,
            cliques sur Oui.
            Cliques sur OK.

            (2) Activer la Restauration du système

            cliques sur Démarrer
            Cliques droit sur Poste de travail
            cliques sur Propriétés
            Cliques sur l'onglet Restauration du système
            Décoches Désactiver la Restauration du système sur tous les lecteurs
            Cliques sur Appliquer, Lorsque le message de confirmation apparaît,
            cliques sur Oui.
            Cliques sur OK.

            Tuto xp : http://service1.symantec.com/support/inter/tsgeninfointl.Nsf/fr_docid/20020830101856924

            1. Toprek
              Logfile of Trend Micro HijackThis v2.0.2
              Scan saved at 12:07, on 2008-09-18
              Platform: Windows XP SP2 (WinNT 5.01.2600)
              MSIE: Internet Explorer v7.00 (7.00.6000.16705)
              Boot mode: Normal

              Running processes:
              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\Program Files\WatchGuard\Mobile User VPN\IreIKE.exe
              C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
              C:\WINDOWS\system32\spoolsv.exe
              C:\Program Files\HPQ\IAM\bin\asghost.exe
              C:\WINDOWS\system32\igfxtray.exe
              C:\WINDOWS\system32\hkcmd.exe
              C:\WINDOWS\AGRSMMSG.exe
              C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
              C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
              C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE
              C:\WINDOWS\system32\dla\tfswctrl.exe
              C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
              C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
              C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
              C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
              C:\Program Files\QuickTime\qttask.exe
              C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
              C:\Program Files\Microsoft ActiveSync\wcescomm.exe
              C:\WINDOWS\system32\ctfmon.exe
              C:\PROGRA~1\MICROS~3\rapimgr.exe
              C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
              C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
              C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
              C:\Program Files\WatchGuard\Mobile User VPN\SafeCfg.exe
              C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
              C:\Program Files\WinZip\WZQKPICK.EXE
              C:\PROGRA~1\WIDCOMM\LOGICI~1\BTSTAC~1.EXE
              C:\WINDOWS\System32\svchost.exe
              C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
              C:\Program Files\WatchGuard\Mobile User VPN\IPSecMon.exe
              C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
              C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
              C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
              C:\WINDOWS\system32\svchost.exe
              C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
              C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
              C:\Program Files\Trend Micro\OfficeScan Client\ofcdog.exe
              C:\Program Files\Trend Micro\OfficeScan Client\pccntupd.exe
              C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
              C:\Program Files\Windows Live\Messenger\usnsvc.exe
              C:\WINDOWS\explorer.exe
              C:\Program Files\Internet Explorer\iexplore.exe
              C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
              C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/webhp?sourceid=navclient&ie=UTF-8&gws_rd=ssl
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
              R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
              R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www8.hp.com/fr/fr/home.html
              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
              O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
              O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
              O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
              O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
              O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
              O2 - BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll
              O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
              O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
              O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
              O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
              O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
              O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
              O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
              O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
              O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
              O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
              O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
              O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
              O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
              O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
              O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll,RegisterModule
              O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
              O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
              O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
              O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
              O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
              O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
              O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
              O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
              O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
              O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
              O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
              O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
              O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
              O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
              O4 - Global Startup: BTTray.lnk = ?
              O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
              O4 - Global Startup: Google Calendar Sync.lnk = C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
              O4 - Global Startup: Mobile User VPN.lnk = C:\Program Files\WatchGuard\Mobile User VPN\SafeCfg.exe
              O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
              O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
              O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
              O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
              O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
              O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O14 - IERESET.INF: START_PAGE_URL=https://www8.hp.com/fr/fr/home.html
              O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = intraco-consulting.be
              O17 - HKLM\Software\..\Telephony: DomainName = intraco-consulting.be
              O17 - HKLM\System\CCS\Services\Tcpip\..\{F909F182-9F45-4220-A750-067A1090B76B}: NameServer = 192.168.70.9,195.238.2.21
              O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = intraco-consulting.be
              O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = intraco-consulting.be
              O20 - Winlogon Notify: OneCard - C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll
              O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
              O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
              O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
              O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
              O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
              O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\WatchGuard\Mobile User VPN\IPSecMon.exe
              O23 - Service: SafeNet IKE Service (IreIKE) - SafeNet - C:\Program Files\WatchGuard\Mobile User VPN\IreIKE.exe
              O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
              O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
              O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
              2. Toprek
                ComboFix 08-09-16.05 - cav 2008-09-18 11:46:55.1 - NTFSx86
                Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.135 [GMT 2:00]
                Lancé depuis: C:\Documents and Settings\cav\Bureau\ComboFix.exe
                * Un nouveau point de restauration a été créé

                [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
                .

                (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                .

                C:\Documents and Settings\cav\Cookies\cav@ads.rtl[3].txt

                .
                ((((((((((((((((((((((((((((( Fichiers cr‚‚s du 2008-08-18 au 2008-09-18 ))))))))))))))))))))))))))))))))))))
                .

                2008-09-18 10:27 . 2008-09-18 10:27 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                2008-09-18 10:27 . 2008-09-18 10:27 <REP> d-------- C:\Documents and Settings\cav\Application Data\Malwarebytes
                2008-09-18 10:27 . 2008-09-18 10:27 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                2008-09-18 10:27 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
                2008-09-18 10:27 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                2008-09-18 10:10 . 2008-09-18 10:10 4,076 --a------ C:\Documents and Settings\Orph.egd
                2008-09-18 10:07 . 2008-09-18 10:10 <REP> d-------- C:\ToolBar SD
                2008-09-18 09:52 . 2008-09-18 11:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\tolqjgvm
                2008-09-11 11:05 . 2008-09-11 11:05 <REP> d--h----- C:\WINDOWS\$hf_mig$
                2008-09-09 22:10 . 2004-08-04 00:55 91,648 --a------ C:\WINDOWS\system32\kswdmcap.ax
                2008-09-09 22:10 . 2004-08-04 00:55 91,648 --a------ C:\WINDOWS\system32\dllcache\kswdmcap.ax
                2008-09-09 22:10 . 2004-08-04 00:55 61,952 --a------ C:\WINDOWS\system32\kstvtune.ax
                2008-09-09 22:10 . 2004-08-04 00:55 61,952 --a------ C:\WINDOWS\system32\dllcache\kstvtune.ax
                2008-09-09 22:10 . 2004-08-04 00:54 54,784 --a------ C:\WINDOWS\system32\vfwwdm32.dll
                2008-09-09 22:10 . 2004-08-04 00:54 54,784 --a------ C:\WINDOWS\system32\dllcache\vfwwdm32.dll
                2008-09-09 22:10 . 2004-08-04 00:55 43,008 --a------ C:\WINDOWS\system32\ksxbar.ax
                2008-09-09 22:10 . 2004-08-04 00:55 43,008 --a------ C:\WINDOWS\system32\dllcache\ksxbar.ax
                2008-09-09 22:10 . 2004-08-04 00:55 28,672 --a------ C:\WINDOWS\system32\vidcap.ax
                2008-09-09 22:10 . 2004-08-04 00:55 28,672 --a------ C:\WINDOWS\system32\dllcache\vidcap.ax
                2008-09-09 21:42 . 2008-09-09 21:42 <REP> d-------- C:\WINDOWS\OvtCam
                2008-09-09 21:42 . 2005-03-15 17:04 161,792 --------- C:\WINDOWS\system32\drivers\ov530vid.sys
                2008-09-09 21:42 . 2004-08-05 17:34 61,440 --------- C:\WINDOWS\ov530dib.dll
                2008-09-09 21:42 . 2005-09-30 09:42 40,960 --------- C:\WINDOWS\system32\ov530ext.dll
                2008-09-09 21:42 . 2004-11-09 00:37 25,177 --------- C:\WINDOWS\system32\drivers\ov530cmd.sys
                2008-09-09 21:42 . 2005-09-30 09:56 18,972 --------- C:\WINDOWS\system32\ov530ext.ax
                2008-09-09 21:42 . 2004-07-20 01:50 16,440 --------- C:\WINDOWS\system32\ov530usd.dll
                2008-09-09 21:36 . 2004-08-03 23:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
                2008-09-09 21:36 . 2004-08-03 23:07 59,264 --a------ C:\WINDOWS\system32\dllcache\usbaudio.sys
                2008-09-09 21:28 . 2008-09-09 21:28 <REP> d-------- C:\Program Files\Nouveau dossier (2)
                2008-09-09 21:28 . 2008-09-09 21:28 <REP> d-------- C:\Program Files\Nouveau dossier
                2008-09-09 21:28 . 2008-09-14 21:58 <REP> d-------- C:\Documents and Settings\cav\Application Data\Skype
                2008-09-09 21:27 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
                2008-09-09 21:27 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys
                2008-09-02 17:09 . 2008-09-02 17:11 <REP> d-------- C:\c171a71e19d3c944009c
                2008-08-27 16:32 . 2008-08-27 16:32 <REP> d-------- C:\Program Files\Blue Label Soft
                2008-08-27 03:03 . 2008-08-27 03:03 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
                2008-08-26 08:58 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
                2008-08-26 08:44 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll
                2008-08-26 08:44 . 2008-07-18 22:07 210,976 --a------ C:\WINDOWS\system32\muweb.dll
                2008-08-26 08:44 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui
                2008-08-25 10:41 . 2008-08-26 08:48 <REP> d-------- C:\Documents and Settings\cav\Contacts
                2008-08-25 10:39 . 2008-08-25 10:39 <REP> d----c--- C:\WINDOWS\system32\DRVSTORE
                2008-08-25 10:28 . 2008-08-25 10:36 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
                2008-08-25 10:27 . 2008-08-25 10:39 <REP> d-------- C:\Program Files\Windows Live
                2008-08-25 10:27 . 2008-08-25 10:27 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
                2008-08-22 11:07 . 2008-08-22 14:39 <REP> d-------- C:\Documents and Settings\cav\Application Data\AdobeUM
                2008-08-22 10:25 . 2008-08-22 10:25 <REP> d-------- C:\Program Files\7-Zip

                .
                (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                .
                2008-09-18 09:34 --------- d-----w C:\Program Files\QuickTime
                2008-09-18 08:21 --------- d-----w C:\Program Files\Trend Micro
                2008-09-09 19:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
                2008-09-02 14:43 --------- d-----w C:\Program Files\Google
                2008-08-28 15:23 --------- d-----w C:\Program Files\Microsoft ActiveSync
                2008-08-27 14:33 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
                2008-08-26 06:58 --------- d-----w C:\Program Files\Java
                2008-08-22 12:43 --------- d-----w C:\Program Files\Fichiers communs\Adobe
                2008-08-07 19:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
                2005-01-23 14:44 217,540 ----a-w C:\Program Files\Intraco Consulting.scr
                .

                ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                .
                .
                *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
                REGEDIT4

                [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-09-18 171448]
                "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
                "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 15360]
                "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2008-09-18 5724184]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-19 94208]
                "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2008-09-18 77824]
                "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2008-09-18 114688]
                "SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2008-09-18 1388544]
                "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-09-18 144784]
                "PTHOSTTR"="C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2008-09-18 73728]
                "UpdateManager"="C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2008-09-18 110592]
                "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2008-09-18 122939]
                "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2008-09-18 98394]
                "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2008-09-18 688218]
                "hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2008-09-18 794624]
                "eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2008-09-18 409600]
                "CognizanceTS"="C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll" [2003-12-22 17920]
                "Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2008-09-18 233534]
                "OfficeScanNT Monitor"="C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" [2008-09-18 303104]
                "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
                "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2008-09-18 155648]
                "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-09-18 77824]
                "AGRSMMSG"="AGRSMMSG.exe" [2005-04-13 C:\WINDOWS\AGRSMMSG.exe]

                [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15360]

                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
                2005-05-16 21:09 39936 C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll

                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                "MSACM.CEGSM"= mobilev.acm

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2311471067-3381073674-77965063-1119\Scripts\Logon\[u]0[/u]\[u]0[/u]]
                "Script"=\\intraco-consulting.be\SysVol\intraco-consulting.be\scripts\login.bat

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2311471067-3381073674-77965063-1182\Scripts\Logon\[u]0[/u]\[u]0[/u]]
                "Script"=\\intraco-consulting.be\SysVol\intraco-consulting.be\scripts\login.bat

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2311471067-3381073674-77965063-1197\Scripts\Logon\[u]0[/u]\[u]0[/u]]
                "Script"=\\intraco-consulting.be\SysVol\intraco-consulting.be\scripts\login.bat

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2311471067-3381073674-77965063-1203\Scripts\Logon\[u]0[/u]\[u]0[/u]]
                "Script"=\\intraco-consulting.be\SysVol\intraco-consulting.be\scripts\login.bat

                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                "%windir%\\system32\\sessmgr.exe"=
                "C:\\WINDOWS\\system32\\mstsc.exe"=
                "C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"=
                "C:\\Program Files\\Microsoft ActiveSync\\WcesMgr.exe"=
                "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
                "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
                "C:\\Program Files\\WatchGuard\\Mobile User VPN\\IreIKE.exe"=
                "C:\Program Files\WatchGuard\Mobile User VPN\ViewLog.exe"= C:\Program Files\WatchGuard\Mobile User VPN\ViewLog.exe:127.0.0.1/255.255.255.255:Enabled:ViewLog
                "C:\Program Files\WatchGuard\Mobile User VPN\CmonApp.exe"= C:\Program Files\WatchGuard\Mobile User VPN\CmonApp.exe:127.0.0.1/255.255.255.255:Enabled:CMonApp
                "C:\Program Files\WatchGuard\Mobile User VPN\vpn.exe"= C:\Program Files\WatchGuard\Mobile User VPN\vpn.exe:127.0.0.1/255.255.255.255:Enabled:VPN Connection Manager

                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

                R2 ASChannel;Canal de communication local;C:\WINDOWS\System32\svchost.exe [2004-08-05 14336]
                R2 Crypto;Crypto;C:\WINDOWS\system32\drivers\Crypto.sys [2004-07-30 521786]
                R2 IPSECDRV;SafeNet IPSec Plugin;C:\WINDOWS\system32\Drivers\IPSECDRV.sys [2004-08-11 119864]
                R3 DniVap;SafeNet WAN Miniport (VA);C:\WINDOWS\system32\DRIVERS\vap.sys [2001-12-14 36188]
                R3 GTIPCI21;GTIPCI21;C:\WINDOWS\system32\DRIVERS\gtipci21.sys [2004-05-03 80384]
                R3 IFXTPM;IFXTPM;C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS [2004-09-02 32640]
                S3 ovt530;Webcam Deluxe;C:\WINDOWS\system32\Drivers\ov530vid.sys [2005-03-15 161792]

                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
                Cognizance REG_MULTI_SZ ASChannel
                .
                - - - - ORPHELINS SUPPRIMES - - - -

                HKLM-Run-adiras - adiras.exe

                .
                ------- Examen suppl‚mentaire -------
                .
                R0 -: HKCU-Main,Start Page = hxxp://www.google.be/webhp?sourceid=navclient&ie=UTF-8
                R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
                R0 -: HKLM-Main,Start Page = hxxp://www.01net.com/telecharger/
                R1 -: HKCU-Internet Connection Wizard,ShellNext = hxxp://www.hp.com/
                R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
                O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                O17 -: HKLM\CCS\Interface\{F909F182-9F45-4220-A750-067A1090B76B}: NameServer = 192.168.70.9,195.238.2.21
                O18 -: Handler: mctp - {d7b95390-b1c5-11d0-b111-0080c712fe82} -
                O18 -: WinCE Filter: image/bmp - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
                O18 -: WinCE Filter: image/gif - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
                O18 -: WinCE Filter: image/jpeg - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
                O18 -: WinCE Filter: image/xbm - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
                O18 -: WinCE Filter: text/asp - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} -
                O18 -: WinCE Filter: text/html - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} -
                .

                **************************************************************************

                catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                Rootkit scan 2008-09-18 11:55:11
                Windows 5.1.2600 Service Pack 2 NTFS

                Recherche de processus cach‚s ...

                Recherche d'‚l‚ments en d‚marrage automatique cach‚s ...

                Recherche de fichiers cach‚s ...

                Scan termin‚ avec succŠs
                Fichiers cach‚s: 0

                **************************************************************************
                .
                ------------------------ Autres processus actifs ------------------------
                .
                C:\Program Files\WatchGuard\Mobile User VPN\IreIKE.exe
                C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                C:\WINDOWS\system32\scardsvr.exe
                C:\Program Files\HPQ\IAM\Bin\asghost.exe
                C:\PROGRA~1\MICROS~3\rapimgr.exe
                C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
                C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
                C:\Program Files\WatchGuard\Mobile User VPN\SafeCfg.exe
                C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
                C:\Program Files\WinZip\WZQKPICK.EXE
                C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTStackServer.exe
                C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
                C:\Program Files\WatchGuard\Mobile User VPN\IPSecMon.exe
                C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
                C:\Program Files\Trend Micro\OfficeScan Client\NTRtScan.exe
                C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                C:\Program Files\Trend Micro\OfficeScan Client\TmListen.exe
                C:\WINDOWS\system32\wdfmgr.exe
                C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
                C:\Program Files\Trend Micro\OfficeScan Client\OfcDog.exe
                C:\Program Files\Trend Micro\OfficeScan Client\PccNTUpd.exe
                C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
                C:\Program Files\Windows Live\Messenger\usnsvc.exe
                .
                **************************************************************************
                .
                Heure de fin: 2008-09-18 12:00:39 - La machine a red‚marr‚
                ComboFix-quarantined-files.txt 2008-09-18 10:00:32

                Avant-CF: 40,154,570,752 octets libres
                AprŠs-CF: 41,022,459,904 octets libres

                207 --- E O F --- 2008-09-11 09:14:26
                1. Utilisateur anonyme
                  réouvre malewarebyte
                  va sur quarantaine
                  supprime tout

                  Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

                  -> Double clique sur combofix.exe.
                  -> Tape sur la touche 1 (Yes) pour démarrer le scan.
                  -> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

                  NOTE : Le rapport se trouve également ici : C:\Combofix.txt

                  Avant d'utiliser ComboFix :

                  -> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

                  -> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.

                  Une fois fait, sur ton bureau double-clic sur Combofix.exe.

                  - Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

                  /!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

                  - En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

                  - Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

                  -> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

                  -> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message
                  1. Toprek
                    Malwarebytes' Anti-Malware 1.28
                    Version de la base de données: 1166
                    Windows 5.1.2600 Service Pack 2

                    18/09/2008 11:29:51
                    mbam-log-2008-09-18 (11-29-51).txt

                    Type de recherche: Examen complet (C:\|)
                    Eléments examinés: 133582
                    Temps écoulé: 57 minute(s), 14 second(s)

                    Processus mémoire infecté(s): 1
                    Module(s) mémoire infecté(s): 2
                    Clé(s) du Registre infectée(s): 43
                    Valeur(s) du Registre infectée(s): 7
                    Elément(s) de données du Registre infecté(s): 2
                    Dossier(s) infecté(s): 4
                    Fichier(s) infecté(s): 73

                    Processus mémoire infecté(s):
                    C:\Documents and Settings\cav\Local Settings\Temp\c.exe (Rogue.Agent) -> Unloaded process successfully.

                    Module(s) mémoire infecté(s):
                    C:\WINDOWS\system32\msxml71.dll (Trojan.FakeAlert) -> Delete on reboot.
                    C:\WINDOWS\system32\pikavn.dll (Trojan.FakeAlert) -> Delete on reboot.

                    Clé(s) du Registre infectée(s):
                    HKEY_CLASSES_ROOT\ucjs0l.bho (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\TypeLib\{15c7d7ad-a87a-4c0d-9d8b-637fcd3488ef} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\Interface\{b038f224-f9f5-4b83-a0d0-43d68d8e3cfe} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\Interface\{e062203c-7759-4b2f-8ee7-df725eed1db7} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\CLSID\{d83e84da-d187-4300-b5d7-727727352096} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d83e84da-d187-4300-b5d7-727727352096} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\xml.xml (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\TypeLib\{9233c3c0-1472-4091-a505-5580a23bb4ac} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\CLSID\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\xml.xml.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\zooogoo (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\CLSID\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\CLSID\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\CLSID\{54645654-2225-4455-44a1-9f4543d34545} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\CLSID\{5c7f15e1-f31a-44fd-aa1a-2ec63aaffd3a} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\dpcproxy (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Classes\hol5_vxiewer.full.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Invictus (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Golden Palace Casino PT (Trojan.DNSChanger) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\rdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectShow\pr (Trojan.FakeAlert) -> Quarantined and deleted successfully.

                    Valeur(s) du Registre infectée(s):
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hlpwin (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\1ym08ebhzv (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectShow\10 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectShow\di (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectShow\lk1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Somefox (Trojan.FakeAlert) -> Quarantined and deleted successfully.

                    Elément(s) de données du Registre infecté(s):
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

                    Dossier(s) infecté(s):
                    C:\WINDOWS\mslagent (Adware.EGDAccess) -> Quarantined and deleted successfully.
                    C:\Program Files\akl (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    C:\Program Files\Inet Delivery (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\smp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

                    Fichier(s) infecté(s):
                    C:\WINDOWS\system32\pivgzwjc.exe (Trojan.FakeAlert.H) -> Delete on reboot.
                    C:\Documents and Settings\All Users\Application Data\tolqjgvm\hyxilulo.exe (Trojan.FakeAlert.H) -> Delete on reboot.
                    C:\Documents and Settings\cav\Local Settings\Temp\c.exe (Rogue.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\pikavn.dll (Trojan.FakeAlert) -> Delete on reboot.
                    C:\WINDOWS\system32\msxml71.dll (Trojan.FakeAlert) -> Delete on reboot.
                    C:\RECYCLER\S-1-5-21-2311471067-3381073674-77965063-1203\Dc97.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    C:\WINDOWS\mslagent\2_mslagent.dll (Adware.EGDAccess) -> Quarantined and deleted successfully.
                    C:\WINDOWS\mslagent\mslagent.exe (Adware.EGDAccess) -> Quarantined and deleted successfully.
                    C:\WINDOWS\mslagent\uninstall.exe (Adware.EGDAccess) -> Quarantined and deleted successfully.
                    C:\Program Files\akl\akl.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    C:\Program Files\akl\akl.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    C:\Program Files\akl\uninstall.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    C:\Program Files\akl\unsetup.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    C:\Program Files\Inet Delivery\inetdl.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    C:\Program Files\Inet Delivery\intdel.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\smp\msrc.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    C:\WINDOWS\a.bat (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    C:\WINDOWS\base64.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    C:\WINDOWS\FVProtect.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    C:\WINDOWS\userconfig9x.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    C:\WINDOWS\winsystem.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    C:\WINDOWS\zip1.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    C:\WINDOWS\zip2.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    C:\WINDOWS\zip3.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    C:\WINDOWS\zipped.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                    C:\WINDOWS\bdn.com (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\iTunesMusic.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\mssecu.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\akttzn.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\anticipator.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\awtoolb.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\bdn.com (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\bsva-egihsg52.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\dpcproxy.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\emesx.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\h@tkeysh@@k.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\hoproxy.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\hxiwlgpm.dat (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\hxiwlgpm.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\medup012.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\medup020.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\msgp.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\msnbho.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\mssecu.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\msvchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\mtr2.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\mwin32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\netode.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\newsd32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\ps1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\psof1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\psoft1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\regc64.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\regm64.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\Rundl1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\sncntr.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\ssurf022.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\ssvchost.com (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\ssvchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\sysreq.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\taack.dat (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\taack.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\temp#01.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\thun.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\thun32.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\VBIEWER.OCX (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\vcatchpi.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\winlogonpc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\winsystem.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\WINWGPX.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\vbsys2.dll (Trojan.Clicker) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\users64.dat (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    C:\Documents and Settings\cav\Local Settings\Temp\a.exe (Trojan.FakeAlert) -> Delete on reboot.
                    1. Utilisateur anonyme
                      Telecharge malwarebytes

                      Tu l´instale; le programme va se mettre automatiquement a jour.

                      Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

                      Click maintenant sur l´onglet recherche et coche la case : "executer un examen complet".

                      Puis click sur "rechercher".

                      Laisse le scanner le pc...

                      Si des elements on ete trouvés > click sur supprimer la selection.

                      si il t´es demandé de redemarrer > click sur "yes".

                      A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.
                      Copie et colle le rapport stp.

                      PS : les rapport sont aussi rangé dans l onglet rapport/log
                      1. Toprek
                        Logfile of Trend Micro HijackThis v2.0.2
                        Scan saved at 10:22:18, on 18/09/2008
                        Platform: Windows XP SP2 (WinNT 5.01.2600)
                        MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                        Boot mode: Normal

                        Running processes:
                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\Program Files\WatchGuard\Mobile User VPN\IreIKE.exe
                        C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                        C:\Program Files\HPQ\IAM\bin\asghost.exe
                        C:\WINDOWS\Explorer.EXE
                        C:\WINDOWS\system32\spoolsv.exe
                        C:\WINDOWS\system32\igfxtray.exe
                        C:\WINDOWS\system32\hkcmd.exe
                        C:\WINDOWS\system32\igfxpers.exe
                        C:\WINDOWS\system32\igfxsrvc.exe
                        C:\WINDOWS\AGRSMMSG.exe
                        C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
                        C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
                        C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE
                        C:\WINDOWS\system32\dla\tfswctrl.exe
                        C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
                        C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                        C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
                        C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
                        C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
                        C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
                        C:\Program Files\QuickTime\qttask.exe
                        C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                        C:\Program Files\Microsoft ActiveSync\wcescomm.exe
                        C:\WINDOWS\system32\ctfmon.exe
                        C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
                        C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
                        C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                        C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
                        C:\Program Files\WatchGuard\Mobile User VPN\SafeCfg.exe
                        C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
                        C:\PROGRA~1\MICROS~3\rapimgr.exe
                        C:\Program Files\WinZip\WZQKPICK.EXE
                        C:\PROGRA~1\WIDCOMM\LOGICI~1\BTSTAC~1.EXE
                        C:\WINDOWS\System32\svchost.exe
                        C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
                        C:\Program Files\WatchGuard\Mobile User VPN\IPSecMon.exe
                        C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
                        C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
                        C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
                        C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
                        C:\Program Files\Trend Micro\OfficeScan Client\ofcdog.exe
                        C:\Program Files\Trend Micro\OfficeScan Client\pccntupd.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\Program Files\HPQ\Shared\hpqwmi.exe
                        C:\Program Files\Windows Live\Messenger\usnsvc.exe
                        C:\WINDOWS\system32\drwtsn32.exe
                        C:\WINDOWS\system32\drwtsn32.exe
                        C:\WINDOWS\system32\drwtsn32.exe
                        C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                        C:\DOCUME~1\cav\LOCALS~1\Temp\a.exe
                        C:\DOCUME~1\cav\LOCALS~1\Temp\c.exe
                        C:\WINDOWS\system32\pivgzwjc.exe
                        C:\Documents and Settings\All Users\Application Data\tolqjgvm\hyxilulo.exe
                        C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                        C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
                        C:\Program Files\Internet Explorer\iexplore.exe
                        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/webhp?sourceid=navclient&ie=UTF-8&gws_rd=ssl
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
                        R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www8.hp.com/fr/fr/home.html
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
                        O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\WINDOWS\system32\msxml71.dll
                        O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
                        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                        O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
                        O2 - BHO: HACK.SPY - {D83E84DA-D187-4300-B5D7-727727352096} - C:\WINDOWS\system32\pikavn.dll
                        O2 - BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll
                        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                        O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
                        O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
                        O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
                        O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
                        O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
                        O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
                        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                        O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
                        O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
                        O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
                        O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
                        O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                        O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
                        O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
                        O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll,RegisterModule
                        O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
                        O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
                        O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
                        O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                        O4 - HKLM\..\Run: [adiras] adiras.exe
                        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                        O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
                        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                        O4 - HKCU\..\Run: [Somefox] C:\DOCUME~1\cav\LOCALS~1\Temp\a.exe
                        O4 - HKCU\..\Run: [hlpwin] C:\WINDOWS\system32\pivgzwjc.exe
                        O4 - HKLM\..\Policies\Explorer\Run: [1YM08EBhzV] C:\Documents and Settings\All Users\Application Data\tolqjgvm\hyxilulo.exe
                        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                        O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                        O4 - Global Startup: BTTray.lnk = ?
                        O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                        O4 - Global Startup: Google Calendar Sync.lnk = C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
                        O4 - Global Startup: Mobile User VPN.lnk = C:\Program Files\WatchGuard\Mobile User VPN\SafeCfg.exe
                        O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
                        O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
                        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                        O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
                        O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
                        O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
                        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O14 - IERESET.INF: START_PAGE_URL=https://www8.hp.com/fr/fr/home.html
                        O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = intraco-consulting.be
                        O17 - HKLM\Software\..\Telephony: DomainName = intraco-consulting.be
                        O17 - HKLM\System\CCS\Services\Tcpip\..\{F909F182-9F45-4220-A750-067A1090B76B}: NameServer = 192.168.70.9,195.238.2.21
                        O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = intraco-consulting.be
                        O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = intraco-consulting.be
                        O20 - Winlogon Notify: OneCard - C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll
                        O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                        O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
                        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                        O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
                        O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
                        O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\WatchGuard\Mobile User VPN\IPSecMon.exe
                        O23 - Service: SafeNet IKE Service (IreIKE) - SafeNet - C:\Program Files\WatchGuard\Mobile User VPN\IreIKE.exe
                        O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
                        O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                        O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
                        1. Utilisateur anonyme
                          Salut,

                          Télécharge HijackThis (outils de dignostic) ici :

                          -> Fais un clic droit sur un des liens et choisi enregistrer la cible sous .... le bureau
                          -> http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
                          -> ftp://ftp.commentcamarche.com/download/HJTInstall.exe

                          -> Fais un double-clic sur HJTInstall.exe afin de lancer l'installation

                          -> Clique sur Install ensuite sur I Accept

                          -> Clique sur Do a scan system and save log file

                          -> Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse

                          Discussions similaires

                          Security boot fail lors du démarrage
                          Steu

                          5 réponses
                          SecurityHealth est a désactiver ou pas au démarrage de W10 Pro 64 ?
                          Walti55

                          2 réponses
                          Comment retirer le SECURE BOOT ?
                          Elparigo60

                          10 réponses
                          Security Boot Fail Windows 10 Acer
                          benjamin5800

                          22 réponses
                          Fiabilitè de SECURIBOX
                          natatatanka

                          38 réponses