Xp antivirus 2008

Résolu
sergioleo -  
Bonjour,

je sollicite votre aide au sujet de la desinstallation de l'antivirus xp 2008 svp

merci d'avance
Configuration: Windows XP
Internet Explorer 7.0

9 réponses

  1.  Sacabouffe
    Salut
    Un souci...

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:43:12, on 16/10/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe­
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.e­xe
    C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Pinnacle\MediaServer\Microsoft­ SQL Server\MSSQL$PINNACLESYS\Binn\sqlser­vr.exe
    C:\Program Files\MySecurityCenter\Programs\serv­ice.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\CyberLink\Shared files\RichVideo.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.e­xe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.e­xe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
    C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
    C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
    C:\WINDOWS\CTHELPER.EXE
    C:\WINDOWS\system32\CTXFIHLP.EXE
    C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
    C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
    C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareS­E4.exe
    C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communicati­ons_Helper.exe
    C:\Program Files\Logitech\QuickCam\Quickcam.exe­
    C:\Program Files\MySecurityCenter\Programs\Regi­strationPopup.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Creative\MediaSource\Detector\­CTDetect.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
    C:\Program Files\Creative\ShareDLL\CADI\NotiMan­.exe
    C:\Program Files\Google\GoogleToolbarNotifier\G­oogleToolbarNotifier.exe­­
    D:\eMule\emule.exe
    C:\Program Files\ASUS WiFi-AP Solo\RtWLan.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
    C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.­exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
    C:\WINDOWS\system32\spider.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.free.fr/freebox/index.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.microsoft.com/fr-fr/?ref=go­Id=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.microsoft.com/fr-fr/?ref=go­Id=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.microsoft.com/fr-fr/?ref=go­Id=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.microsoft.com/fr-fr/?ref=go­Id=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - Default URLSearchHook is missing
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C­6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F­7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205­D} - C:\Program Files\Google\GoogleToolbarNotifier\3­.1.807.1746\swg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D­0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: (no name) - {D421B084-6EC9-4320-AC03-554FBB58751­D} - C:\WINDOWS\system32\rqRIcdEX.dll (file missing)
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D­0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46­C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.d­ll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: (no name) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - (no file)
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
    O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
    O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
    O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
    O4 - HKLM\..\Run: [RCSystem] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup
    O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
    O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Logitech\Video\InstallHelper.exe /inspect
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
    O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
    O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
    O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
    O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
    O4 - HKLM\..\Run: [setc] C:\Program Files\MySecurityCenter\Programs\setc.exe
    O4 - HKLM\..\Run: [regist] C:\Program Files\MySecurityCenter\Programs\RegistrationPopup.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [eMuleAutoStart] D:\eMule\emule.exe -AutoStart
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: ASUS WiFi-AP Solo.lnk = ?
    O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
    O4 - Global Startup: hpoddt01.exe.lnk = ?
    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
    O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
    O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?b5c66bf9c7fb41fa9524f77e75648db4
    O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?b5c66bf9c7fb41fa9524f77e75648db4
    O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
    O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} (CamfrogWEB Advanced Unicode Control) - https://www.bobtv.fr/download/cfweb_www.bobtv.fr-download_instmodule.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
    O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
    O23 - Service: MySecurityCenter License Service - Unknown owner - C:\Program Files\MySecurityCenter\Programs\service.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
    O24 - Desktop Component 0: (no name) - http://srx.fr.ebayrtm.com/

    Bonne continuation ;-)
    1
    1. totobetourne
      fait comme indique combofix et ensuite refais un hijack.
      1
      1. anthony5151 Contributeur sécurité
        Nouveau champion pour le nombre assez extraordinaire d'infections que MalwareBytes a détecté sur ton ordinateur... En même temps ce n'est pas étonnant, le rapport hijackthis montre que tu n'as même pas de logiciel de protection (ou alors je ne les ai pas vu ?)

        Pour ton fond d'écran, il a sûrement été supprimé par SmitFraudFix parce que c'était une image qui n'était pas enregistrée sur ton ordinateur mais qui était affichée à partir d'internet : enregistre la d'abord sur ton ordinateur et mets là en fond d'écran à partir de là ;)

        Peux-tu poster un nouveau rapport hijackthis stp ?

        Ensuite, on va sortir la grosse artillerie : Combofix. Attention, ce logiciel est très puissant, une mauvaise utilisation peut faire des dégâts...

        Fais exactement ce qui suit :

        Télécharge ComboFix (de sUBs) sur ton Bureau (et pas ailleurs !) :
        Fais un clic droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix, choisis le bureau comme destination et valide : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

        --------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
        !! déconnecte toi, ferme toutes tes applications en cours et DESACTIVE TOUTES TES DEFENCES (anti-virus, antispyware, pare-feu) le temps de la manipulation (si jamais tu en as et que je ne les ai pas vu sur le rapport hijackthis....)

        ---> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...

        Tuto ici : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
        ---------------------------------------------------------------------------------------------------------------------------------

        Ensuite :
        double-clique sur C-Fix.exe (= combofix.exe ) .

        Appuie sur une touche pour démarrer le scan .

        Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer

        Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp

        1
        1. totobetourne
          bravo tu es le nouveau champion du grand jeu:efficacite prouve de malwarebyte meme si il faut rappeler qu il ne reconnait pas tout.

          c est par contre la deglingue niveau securite et surtout tu devrais reflechir avant de telecharger n importe quoi sur le net.passe egalement a mozilla ou autres , ne reste pas avec internet explorer.

          cela ne doit pas etre evident avec ce vieux pc d avoir bcp de programme qui tourne en meme temps.
          -1
          1. sergioleo Auteur
            slt
            je ne comprends pas bien ce que tu dis le nouveau champion de quoi et mon pc n'est pas si vieux?????
            0
          2. totobetourne
            @sergioleoje te dis vieux pour cela.

            Eléments examinés: 204347
            Temps écoulé: 12 hour(s), 11 minute(s), 3 second(s)

            les pc neuf le font entre 30 mn et 1h pour la pluspart on va dire.
            -1
          3. sergioleo Auteur
            @totobetournebonjour totobetourne

            ah ok c'est vrai qu'il rame pas mal mais bon ce sera le probleme suivant à resoudre pour l'instant je veux juste terminer la desinstallation de xp antivirus 2008 correctement sans soucis ce sera deja pas mal
            0
        3. sergioleo Auteur
          voici les rapports et que faire ensuite et mon fond d'ecran est tout bleuest ce normal comment faire pour recuperer mon ancien fond d'ecran ??
          merci d'avance

          SmitFraudFix v2.362

          Rapport fait à 19:27:47,15, 16/10/2008
          Executé à partir de C:\Documents and Settings\Utilisateur\Bureau\SmitfraudFix
          OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
          Le type du système de fichiers est NTFS
          Fix executé en mode sans echec

          »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          SrchSTS.exe by S!Ri
          Search SharedTaskScheduler's .dll

          »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

          »»»»»»»»»»»»»»»»»»»»»»»» hosts

          127.0.0.1 localhost

          »»»»»»»»»»»»»»»»»»»»»»»» VACFix

          VACFix
          Credits: Malware Analysis & Diagnostic
          Code: S!Ri

          »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

          S!Ri's WS2Fix: LSP not Found.

          »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

          GenericRenosFix by S!Ri

          »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

          »»»»»»»»»»»»»»»»»»»»»»»» IEDFix

          IEDFix
          Credits: Malware Analysis & Diagnostic
          Code: S!Ri

          »»»»»»»»»»»»»»»»»»»»»»»» 404Fix

          404Fix
          Credits: Malware Analysis & Diagnostic
          Code: S!Ri

          »»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix

          AntiXPVSTFix
          Credits: Malware Analysis & Diagnostic
          Code: S!Ri

          »»»»»»»»»»»»»»»»»»»»»»»» RK

          »»»»»»»»»»»»»»»»»»»»»»»» DNS

          HKLM\SYSTEM\CCS\Services\Tcpip\..\{A7CF4D62-FD50-4E5D-B10D-0E7FE6A96774}: DhcpNameServer=212.27.40.240 212.27.40.241
          HKLM\SYSTEM\CS1\Services\Tcpip\..\{A7CF4D62-FD50-4E5D-B10D-0E7FE6A96774}: DhcpNameServer=212.27.40.240 212.27.40.241
          HKLM\SYSTEM\CS2\Services\Tcpip\..\{A7CF4D62-FD50-4E5D-B10D-0E7FE6A96774}: DhcpNameServer=212.27.40.240 212.27.40.241
          HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241
          HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241
          HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241

          »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

          »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
          "System"=""

          »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

          Nettoyage terminé.

          »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          SrchSTS.exe by S!Ri
          Search SharedTaskScheduler's .dll

          »»»»»»»»»»»»»»»»»»»»»»»» FinMalwarebytes' Anti-Malware 1.28
          Version de la base de données: 1272
          Windows 5.1.2600 Service Pack 2

          16/10/2008 07:29:12
          mbam-log-2008-10-16 (07-29-12).txt

          Type de recherche: Examen complet (C:\|D:\|H:\|)
          Eléments examinés: 204347
          Temps écoulé: 12 hour(s), 11 minute(s), 3 second(s)

          Processus mémoire infecté(s): 0
          Module(s) mémoire infecté(s): 0
          Clé(s) du Registre infectée(s): 148
          Valeur(s) du Registre infectée(s): 12
          Elément(s) de données du Registre infecté(s): 2
          Dossier(s) infecté(s): 63
          Fichier(s) infecté(s): 134

          Processus mémoire infecté(s):
          (Aucun élément nuisible détecté)

          Module(s) mémoire infecté(s):
          (Aucun élément nuisible détecté)

          Clé(s) du Registre infectée(s):
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{32341e7e-c319-46de-91d0-e30bb1a3caba} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\nnnonhec (Trojan.Vundo.H) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{32341e7e-c319-46de-91d0-e30bb1a3caba} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{440c29bd-644f-441e-b157-fb18e9f6458d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{440c29bd-644f-441e-b157-fb18e9f6458d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\coresrv.lfgax (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\TypeLib\{0729f461-8054-47dc-8d39-a31b61cc0119} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{40ca90f3-4098-4877-ae87-23eb612b18c7} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{4c3b62af-ca25-4fba-8405-32e44f83bb6f} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{5a635a91-c303-45c9-8db9-f759d98a3b9d} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{7e335d04-2e6e-4d0e-a921-c3d9192e7121} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{99ccfb8c-6380-4a14-8fdd-ef3e7e95335d} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{b20d7add-989c-4bc0-a797-f6fe7998efd7} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{bfc20a15-b0ac-44cc-a25a-a7039014ba9f} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{f019aec4-4c95-46de-a107-e302473e3b9a} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{2d00aa2a-69ef-487a-8a40-b3e27f07c91e} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{86c5840b-80c4-4c30-a655-37344a542009} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{b0cb585f-3271-4e42-88d9-ae5c9330d554} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\coresrv.lfgax.1 (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\shoppingreport.hbax (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\TypeLib\{e343edfc-1e6c-4cb5-aa29-e9c922641c80} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{d8560ac2-21b5-4c1a-bdd4-bd12bc83b082} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{20ea9658-6bc3-4599-a87d-6371fe9295fc} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{a16ad1e9-f69a-45af-9462-b1c286708842} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{c9ccbb35-d123-4a31-affc-9b2933132116} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\shoppingreport.hbax.1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\shoppingreport.hbinfoband (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\shoppingreport.hbinfoband.1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\shoppingreport.iebutton (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\shoppingreport.iebutton.1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\shoppingreport.iebuttona (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\shoppingreport.iebuttona.1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\shoppingreport.rprtctrl (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\shoppingreport.rprtctrl.1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{8ad9ad05-36be-4e40-ba62-5422eb0d02fb} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{aebf09e2-0c15-43c8-99bf-928c645d98a0} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{ca356d79-679b-4b4c-8e49-5af97014f4c1} (Adware.Starware) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{2d51d869-c36b-42bd-ae68-0a81bc771fa5} (Adware.Starware) -> Quarantined and deleted successfully.
          HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{2d51d869-c36b-42bd-ae68-0a81bc771fa5} (Adware.Starware) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{7bed0340-176b-44bc-915e-c21c1dd6f617} (Adware.Starware) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ca356d79-679b-4b4c-8e49-5af97014f4c1} (Adware.Starware) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{d49e9d35-254c-4c6a-9d17-95018d228ff5} (Adware.Starware) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Typelib\{cdca70d8-c6a6-49ee-9bed-7429d6c477a2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Typelib\{d136987f-e1c4-4ccc-a220-893df03ec5df} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{eddbb5ee-bb64-4bfc-9dbe-e7c85941335b} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\TypeLib\{148e1447-c728-48fd-beec-a7d06c5fff58} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{8ee46f55-1ce1-4db9-811a-68938ec7f3dd} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{a87dfd99-cf81-4241-85ce-881e0026b686} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{c96b9fae-a032-4100-bb47-32ef05e28be4} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{14113b47-d59c-4f0f-9d10-ff1730265584} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{a9c42a57-421c-4572-8b12-249c59183d1c} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\TypeLib\{8292078f-f6e9-412b-8eb1-360c05c5ece5} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{2447e305-5e90-42a8-bd1e-0bc333b807e1} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{50d2fdcc-2707-49cb-8223-7fe0424909aa} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{878ce013-7ba9-4650-a78c-b2234c0c1648} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{a5b6fa30-d317-41ca-9cb1-c898d3c7f34e} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{cc19a5f2-b4ad-41d5-a5c9-0680904c1483} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\TypeLib\{03d7ff6e-9781-40b5-bb7f-94291a361604} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{3ceb04ab-08af-45f4-81b4-70d13c1f7b85} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{a7213d71-47e1-4832-92d7-d61dfe9f231f} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{cf82f350-e1c4-4916-ac12-ba73db60afb7} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\TypeLib\{c62a9e79-2b52-439b-af57-2e60bb06e86c} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{15fd8424-d12a-4c51-8c6c-d5d57b80f781} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{67b3becf-7b6f-42b2-99f0-f7656f89cffa} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{715ffd42-4e05-4eab-9513-c8daa5395ae2} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{759d6f7c-8d30-45b6-abea-fa51c190eed5} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{9a4a64a4-a2fb-48fa-9bba-1ac50267695d} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{62906e60-bce2-4e1b-9ed0-8b9042ee15e4} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{f9bfa98d-9935-4ea4-a05a-72c7f0778f02} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\TypeLib\{abec1835-3181-4abd-8dde-875aec4df6d2} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{0af9a087-0cbf-46b2-9dc9-52d0d16b5ab6} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{69725738-cd68-4f36-8d02-8c43722ee5da} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{69725738-cd68-4f36-8d02-8c43722ee5da} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\TypeLib\{89085678-632d-4deb-bda0-cd912c63203e} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{30b15818-e110-4527-9c05-46ace5a3460d} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{618aad04-921f-44c2-be38-c0818af69861} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{b5d2ed96-62f9-4c2c-956d-e425b1f67337} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{d3a412e8-1e4b-47d2-9b12-f88291f5afbb} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{3788e535-897b-463d-b6d6-fee5b86ec144} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3788e535-897b-463d-b6d6-fee5b86ec144} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{d3f940ea-4e87-423b-9091-934e1e4fceae} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{d3f940ea-4e87-423b-9091-934e1e4fceae} (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\TypeLib\{4de61e1e-4c41-3791-8a76-fd2c826e435c} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{65c1417f-5644-3947-8c2a-84d3a947bed1} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{1fe4d123-cccb-36a5-b538-8ccbd332988b} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\TypeLib\{e6d30f8f-e915-3781-a498-c0fced320949} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{5ea5e265-ba8d-30b3-b408-10e7b508acb9} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{4d00191d-6d55-3961-856e-a0da521fbf36} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4d00191d-6d55-3961-856e-a0da521fbf36} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\TypeLib\{a57470de-14c7-4fcd-9d4c-e5711f24f0ed} (Adware.180Solutions) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{2557dd3f-23a0-477c-bcd8-90fd0aecc4b8} (Adware.180Solutions) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{2893116c-a176-42b1-8794-da8c9fc45564} (Adware.180Solutions) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{99fdca0c-7380-4e9c-8d99-5dc4750334ef} (Adware.180Solutions) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{b1d9f4b1-b9ff-463f-bf15-ab9cb26160f7} (Adware.180Solutions) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{2aa2fbf8-9c76-4e97-a226-25c5f4ab6358} (Adware.180Solutions) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{2aa2fbf8-9c76-4e97-a226-25c5f4ab6358} (Adware.180Solutions) -> Quarantined and deleted successfully.
          HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{2aa2fbf8-9c76-4e97-a226-25c5f4ab6358} (Adware.180Solutions) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{71f731b3-008b-4052-9ea4-4145acce40c3} (Adware.180Solutions) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\TypeLib\{a56fe01c-77c4-4f5e-8198-e4b72207890a} (Adware.180Solutions) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\Interface\{af55160d-cde1-4a8b-8001-66da06bee740} (Adware.180Solutions) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\shoppingreport (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\starware354 (Adware.Starware) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhclt3j0e915 (Rogue.Multiple) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\rhclt3j0e915 (Rogue.Multiple) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00fdc34 (Trojan.Vundo) -> Quarantined and deleted successfully.
          HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
          HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.
          HKEY_CURRENT_USER\SOFTWARE\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          HKEY_CURRENT_USER\SOFTWARE\zangosa (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CURRENT_USER\SOFTWARE\Zango (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZangoSA (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\zangoax.clientdetector (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\zangoax.clientdetector.1 (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\zangoax.userprofiles (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\zangoax.userprofiles.1 (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\wallpaper.wallpapermanager (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\wallpaper.wallpapermanager.1 (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\toolbar.toolbarctl (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\toolbar.toolbarctl.1 (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\toolbar.htmlmenuui (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\toolbar.htmlmenuui.1 (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\srv.coreservices (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\srv.coreservices.1 (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\hostol.webmailsend (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\hostol.webmailsend.1 (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\hostol.mailanim (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\hostol.mailanim.1 (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\hostie.bho (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\hostie.bho.1 (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\hbr.hbmain (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\hbr.hbmain.1 (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\hbmain.commband (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\hbmain.commband.1 (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\coresrv.coreservices (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\coresrv.coreservices.1 (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CURRENT_USER\SOFTWARE\starware354 (Adware.Starware) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\zango (Adware.180Solutions) -> Quarantined and deleted successfully.

          Valeur(s) du Registre infectée(s):
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zangosa (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{d49e9d35-254c-4c6a-9d17-95018d228ff5} (Adware.Starware) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zangooe (Adware.180Solutions) -> Quarantined and deleted successfully.
          HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weatherdpa (Adware.180Solutions) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smrhclt3j0e915 (Rogue.Multiple) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\rhclt3j0e915 (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
          HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00fb88899.exe (Trojan.Agent) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\Zango@Zango.com (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\zango 10.3.37.0 (Adware.Zango) -> Quarantined and deleted successfully.
          HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.
          HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\backupwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
          HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

          Elément(s) de données du Registre infecté(s):
          HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
          HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

          Dossier(s) infecté(s):
          C:\Program Files\Zango (Adware.180Solutions) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin (Adware.180Solutions) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0 (Adware.180Solutions) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\firefox (Adware.180Solutions) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\firefox\extensions (Adware.180Solutions) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\firefox\extensions\components (Adware.180Solutions) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\firefox\extensions\plugins (Adware.180Solutions) -> Quarantined and deleted successfully.
          C:\Program Files\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          C:\Program Files\ShoppingReport\Bin (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          C:\Program Files\ShoppingReport\Bin\2.5.0 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          C:\Program Files\SpyShredder (Rogue.SpyShredder) -> Quarantined and deleted successfully.
          C:\Program Files\Starware354 (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Program Files\Starware354\bin (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Program Files\Starware354\icons (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Program Files\rhclt3j0e915 (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\ShoppingReport\cs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\ShoppingReport\cs\db (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\ShoppingReport\cs\dwld (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\ShoppingReport\cs\report (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\ShoppingReport\cs\res1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\ZangoSA (Adware.Zango) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354 (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\buttons (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\contexts (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\SimpleUpdate (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354 (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\BrowserSearch (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Configurator (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\ErrorSearch (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Games (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Games\images (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Games\images\active (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Games\images\default (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Layouts (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Manager (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Movies (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Movies\images (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Movies\images\active (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Movies\images\default (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\RecipeSearch_Foreign (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Recipes_Foreign (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\RelatedSearch (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\ScreensaversMarketingSitePager (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\ScreensaversMarketingSitePager\images (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\ScreensaversMarketingSitePager\images\active (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\ScreensaversMarketingSitePager\images\default (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Toolbar (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\ToolbarLogo (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\ToolbarSearch (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\TravelSearch (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\rhclt3j0e915 (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\rhclt3j0e915\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\rhclt3j0e915\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\rhclt3j0e915\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\rhclt3j0e915\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\rhclt3j0e915\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\rhclt3j0e915\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\rhclt3j0e915\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\rhclt3j0e915\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\rhclt3j0e915\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\rhclt3j0e915\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.

          Fichier(s) infecté(s):
          C:\WINDOWS\SYSTEM32\NNNONHEC.DLL (Trojan.Vundo.H) -> Quarantined and deleted successfully.
          C:\WINDOWS\system32\empmqv.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\ZangoSA.exe (Adware.Zango) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\CoreSrv.dll (Adware.Zango) -> Quarantined and deleted successfully.
          C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          C:\PROGRAM FILES\STARWARE354\bin\STARWARE354.DLL (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\1XUVLL4M\hyta[1].jpg (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CT45YR01\uaqrta[1].jpg (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Program Files\Everest Poker\gvcrt.dll (Adware.Adorable casino) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\CntntCntr.dll (Adware.Zango) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\HostOL.dll (Adware.Zango) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\Srv.exe (Adware.Zango) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\Toolbar.dll (Adware.Zango) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\Wallpaper.dll (Adware.Zango) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\WeSkin.dll (Adware.Zango) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\ZangoSAAX.dll (Adware.Zango) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\ZangoSADF.exe (Adware.Zango) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\ZangoSAHook.dll (Adware.Zango) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\ZangoUninstaller.exe (Adware.Zango) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\firefox\extensions\plugins\npclntax_ZangoSA.dll (Adware.Zango) -> Quarantined and deleted successfully.
          C:\WINDOWS\system32\mmx40270.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          C:\WINDOWS\system32\mmx77537.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          C:\WINDOWS\system32\mx40270.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          C:\WINDOWS\system32\mx77537.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          C:\WINDOWS\Temp\35AAA61F.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\arrow.ico (Adware.180Solutions) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\copyright.txt (Adware.180Solutions) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\HostIE.dll (Adware.180Solutions) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\HostOE.dll (Adware.180Solutions) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\link.ico (Adware.180Solutions) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\OEAddOn.exe (Adware.180Solutions) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\Weather.exe (Adware.180Solutions) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\firefox\extensions\install.rdf (Adware.180Solutions) -> Quarantined and deleted successfully.
          C:\Program Files\Zango\bin\10.3.37.0\firefox\extensions\components\npclntax.xpt (Adware.180Solutions) -> Quarantined and deleted successfully.
          C:\Program Files\ShoppingReport\Uninst.exe (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          C:\Program Files\SpyShredder\SpyShredder0.ss (Rogue.SpyShredder) -> Quarantined and deleted successfully.
          C:\Program Files\SpyShredder\SpyShredder1.ss (Rogue.SpyShredder) -> Quarantined and deleted successfully.
          C:\Program Files\Starware354\brand.bmp (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Program Files\Starware354\Starware354Config.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Program Files\Starware354\Starware354Uninstall.exe (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Program Files\Starware354\icons\star_16.ico (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Program Files\rhclt3j0e915\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Program Files\rhclt3j0e915\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Program Files\rhclt3j0e915\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Program Files\rhclt3j0e915\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Program Files\rhclt3j0e915\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Program Files\rhclt3j0e915\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Program Files\rhclt3j0e915\rhclt3j0e915.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Program Files\rhclt3j0e915\rhclt3j0e915.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Program Files\rhclt3j0e915\Uninstall.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\ShoppingReport\cs\Config.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\ShoppingReport\cs\db\Aliases.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\ShoppingReport\cs\db\Sites.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\ShoppingReport\cs\dwld\WhiteList.xip (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\ShoppingReport\cs\report\aggr_storage.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\ShoppingReport\cs\report\send_storage.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\ShoppingReport\cs\res1\WhiteList.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSA.dat (Adware.Zango) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSAAbout.mht (Adware.Zango) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSAau.dat (Adware.Zango) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSAEula.mht (Adware.Zango) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSA_kyf.dat (Adware.Zango) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\buttons\FindIt.bmp (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\buttons\FindItHot.bmp (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\buttons\findithotxp.png (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\buttons\finditxp.png (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\buttons\Highlight.bmp (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\buttons\HighlightHot.bmp (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\buttons\highlighthotxp.png (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\buttons\highlightxp.png (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\buttons\recipes.bmp (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\buttons\recipes.png (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\buttons\recipes_foreign_feed.bmp (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\buttons\recipes_foreign_feed.png (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\buttons\starware_toolbar_icon.bmp (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\contexts\error.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\contexts\Related.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\contexts\Travel.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\SimpleUpdate\ProductMessagingConfig.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\SimpleUpdate\ProductMessagingConfig.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\SimpleUpdate\SimpleUpdateConfig.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\SimpleUpdate\SimpleUpdateConfig.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\SimpleUpdate\TimerManagerConfig.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\All Users\Application Data\Starware354\SimpleUpdate\TimerManagerConfig.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\BrowserSearch\BrowserSearch.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\BrowserSearch\BrowserSearch.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Configurator\Configurator.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Configurator\Configurator.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\ErrorSearch\ErrorSearchOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\ErrorSearch\ErrorSearchOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Games\GamesOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Games\GamesOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Games\images\active\Games0.bmp (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Layouts\ToolbarLayout.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Layouts\ToolbarLayout.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Manager\ManagerOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Manager\ManagerOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Movies\MoviesOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Movies\MoviesOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Movies\images\active\Movies0.bmp (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\RecipeSearch_Foreign\RecipeSearch_ForeignOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\RecipeSearch_Foreign\RecipeSearch_ForeignOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Recipes_Foreign\Recipes_ForeignOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Recipes_Foreign\Recipes_ForeignOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\RelatedSearch\RelatedSearchOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\RelatedSearch\RelatedSearchOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\ScreensaversMarketingSitePager\images\active\ScreensaversMarketingSitePager0.bmp (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Toolbar\TBProductsOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\Toolbar\TBProductsOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\ToolbarLogo\ToolbarLogoOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\ToolbarLogo\ToolbarLogoOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\ToolbarSearch\ToolbarSearchOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\ToolbarSearch\ToolbarSearchOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\TravelSearch\TravelSearchOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Application Data\Starware354\TravelSearch\TravelSearchOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
          C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
          C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
          C:\a (Trojan.Agent) -> Quarantined and deleted successfully.
          C:\Program Files\KB53775.exe (Trojan.Agent) -> Quarantined and deleted successfully.
          C:\WINDOWS\BM8b37b6fa.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
          C:\WINDOWS\BM8b37b6fa.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
          C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
          C:\WINDOWS\system32\phcgt3j0e915.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          C:\WINDOWS\system32\pphcgt3j0e915.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          C:\WINDOWS\system32\__c002FB04.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Local Settings\Temp\.tt1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Local Settings\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Local Settings\Temp\.ttB.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Local Settings\Temp\.ttC.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Local Settings\Temp\.ttD.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Local Settings\Temp\.ttE.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Utilisateur\Local Settings\Temp\.ttF.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

          -1
          1. anthony5151 Contributeur sécurité
            1) Maintenant, démarre en mode sans échec :
            Pour cela, tu tapotes sur la touche F8 (F5 sur certains pc) dès le début de l’allumage du PC sans t’arrêter, avant l'apparition du logo Windows. Un menu va apparaitre, déplace-toi avec les flèches du clavier sur Démarrer en mode sans échec puis tape Entrée. Choisis ta session habituelle, et ne t'inquiète pas si les couleurs et la taille des icônes changent, c'est normal !

            Relance le programme SmitfraudFix.
            Cette fois, choisis l’option 2, répond oui à tous;
            A la fin, sauvegarde le rapport, redémarre en mode normal, copie-colle le rapport sauvegardé sur le forum.

            2) Télécharge et installe Malwarebytes' Anti-Malware
            - A la fin de l'installation, veille à ce que l'option « mettre a jour Malwarebyte's Anti-Malware » soit cochée
            - Lance MBAM, laisse les Mises à jour se télécharger et referme le programme

            Redémarre en "Mode sans échec" : redémarre ton ordinateur et tapote sur la touche F8 jusqu'à l'affichage du menu des options avancées de Windows, et sélectionne "Mode sans échec". Choisis ta session habituelle

            Lance MBAM
            - Puis va dans l'onglet "Recherche", coche "Exécuter un examen complet" puis "Rechercher"
            - Sélectionne tes disques durs" puis clique sur "Lancer l’examen"
            - A la fin du scan, clique sur Afficher les résultats
            - Coche tous les éléments détectés puis clique sur Supprimer la sélection
            - Enregistre le rapport
            - S'il t'est demandé de redémarrer, clique sur Yes

            Poste le rapport de scan après la suppression ici

            1
            1. sergioleo Auteur
              ok je reviens dans 5 min environ a moins que ca ne prenne plus de temps
              -1
            2. sergioleo Auteur
              as-tu bien recu mon message
              -1
          2. anthony5151 Contributeur sécurité
            Télécharge SmitfraudFix : http://siri.urz.free.fr/Fix/SmitfraudFix.exe

            - Enregistre-le sur le bureau

            - Double-clique sur SmitfraudFix.exe et choisis l'option 1 puis Entrée

            - Un rapport sera généré, poste-le dans ta prochaine réponse stp.

            Tutoriel ici pour t'aider : http://www.malekal.com//tutorial_SmitFraudfix.php

            Pour mémoire, je remets ton rapport hijackthis ici :

            Logfile of Trend Micro HijackThis v2.0.2
            Scan saved at 18:43:12, on 16/10/2008
            Platform: Windows XP SP2 (WinNT 5.01.2600)
            MSIE: Internet Explorer v7.00 (7.00.6000.16640)
            Boot mode: Normal

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
            C:\WINDOWS\system32\CTsvcCDA.EXE
            C:\WINDOWS\eHome\ehRecvr.exe
            C:\WINDOWS\eHome\ehSched.exe
            C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
            C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
            C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
            C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
            C:\Program Files\MySecurityCenter\Programs\service.exe
            C:\WINDOWS\system32\nvsvc32.exe
            C:\Program Files\CyberLink\Shared files\RichVideo.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\MsPMSPSv.exe
            c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
            C:\WINDOWS\system32\dllhost.exe
            C:\WINDOWS\Explorer.EXE
            C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
            C:\WINDOWS\system32\wscntfy.exe
            C:\WINDOWS\ehome\ehtray.exe
            C:\Program Files\Analog Devices\Core\smax4pnp.exe
            C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
            C:\WINDOWS\system32\RUNDLL32.EXE
            C:\Program Files\QuickTime\qttask.exe
            C:\WINDOWS\eHome\ehmsas.exe
            C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
            C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
            C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
            C:\WINDOWS\CTHELPER.EXE
            C:\WINDOWS\system32\CTXFIHLP.EXE
            C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
            C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
            C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
            C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
            C:\Program Files\Logitech\QuickCam\Quickcam.exe
            C:\Program Files\MySecurityCenter\Programs\RegistrationPopup.exe
            C:\WINDOWS\system32\ctfmon.exe
            C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
            C:\Program Files\MSN Messenger\MsnMsgr.Exe
            C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
            C:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
            C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe­
            D:\eMule\emule.exe
            C:\Program Files\ASUS WiFi-AP Solo\RtWLan.exe
            C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
            C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
            C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
            C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
            C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
            C:\Program Files\MSN Messenger\usnsvc.exe
            C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
            C:\WINDOWS\system32\spider.exe
            C:\Program Files\Internet Explorer\iexplore.exe
            C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
            C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.free.fr/freebox/index.html
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
            R3 - Default URLSearchHook is missing
            O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
            O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
            O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
            O2 - BHO: (no name) - {D421B084-6EC9-4320-AC03-554FBB58751D} - C:\WINDOWS\system32\rqRIcdEX.dll (file missing)
            O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
            O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
            O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
            O3 - Toolbar: (no name) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - (no file)
            O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
            O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
            O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
            O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
            O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
            O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
            O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe
            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
            O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
            O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
            O4 - HKLM\..\Run: [RCSystem] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup
            O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
            O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
            O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
            O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
            O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
            O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Logitech\Video\InstallHelper.exe /inspect
            O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
            O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
            O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
            O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
            O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
            O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
            O4 - HKLM\..\Run: [setc] C:\Program Files\MySecurityCenter\Programs\setc.exe
            O4 - HKLM\..\Run: [regist] C:\Program Files\MySecurityCenter\Programs\RegistrationPopup.exe
            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
            O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
            O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
            O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
            O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
            O4 - HKCU\..\Run: [eMuleAutoStart] D:\eMule\emule.exe -AutoStart
            O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
            O4 - Global Startup: ASUS WiFi-AP Solo.lnk = ?
            O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
            O4 - Global Startup: hpoddt01.exe.lnk = ?
            O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
            O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
            O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
            O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
            O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
            O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
            O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?b5c66bf9c7fb41fa9524f77e75648db4
            O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?b5c66bf9c7fb41fa9524f77e75648db4
            O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
            O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
            O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
            O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
            O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} (CamfrogWEB Advanced Unicode Control) - https://www.bobtv.fr/download/cfweb_www.bobtv.fr-download_instmodule.exe
            O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
            O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
            O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
            O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
            O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
            O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
            O23 - Service: MySecurityCenter License Service - Unknown owner - C:\Program Files\MySecurityCenter\Programs\service.exe
            O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
            O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
            O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
            O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
            O24 - Desktop Component 0: (no name) - http://srx.fr.ebayrtm.com/

            1
            1. sergioleo Auteur
              ok voici le rapport:

              SmitFraudFix v2.362

              Rapport fait à 18:50:23,22, 16/10/2008
              Executé à partir de C:\Documents and Settings\Utilisateur\Bureau\SmitfraudFix
              OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
              Le type du système de fichiers est NTFS
              Fix executé en mode normal

              »»»»»»»»»»»»»»»»»»»»»»»» Process

              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\system32\spoolsv.exe
              C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
              C:\WINDOWS\system32\CTsvcCDA.EXE
              C:\WINDOWS\eHome\ehRecvr.exe
              C:\WINDOWS\eHome\ehSched.exe
              C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
              C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
              C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
              C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
              C:\Program Files\MySecurityCenter\Programs\service.exe
              C:\WINDOWS\system32\nvsvc32.exe
              C:\Program Files\CyberLink\Shared files\RichVideo.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\system32\MsPMSPSv.exe
              c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
              C:\WINDOWS\system32\dllhost.exe
              C:\WINDOWS\Explorer.EXE
              C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
              C:\WINDOWS\system32\wscntfy.exe
              C:\WINDOWS\ehome\ehtray.exe
              C:\Program Files\Analog Devices\Core\smax4pnp.exe
              C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
              C:\WINDOWS\system32\RUNDLL32.EXE
              C:\Program Files\QuickTime\qttask.exe
              C:\WINDOWS\eHome\ehmsas.exe
              C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
              C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
              C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
              C:\WINDOWS\CTHELPER.EXE
              C:\WINDOWS\system32\CTXFIHLP.EXE
              C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
              C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
              C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
              C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
              C:\Program Files\Logitech\QuickCam\Quickcam.exe
              C:\Program Files\MySecurityCenter\Programs\RegistrationPopup.exe
              C:\WINDOWS\system32\ctfmon.exe
              C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
              C:\Program Files\MSN Messenger\MsnMsgr.Exe
              C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
              C:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
              C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
              D:\eMule\emule.exe
              C:\Program Files\ASUS WiFi-AP Solo\RtWLan.exe
              C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
              C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
              C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
              C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
              C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
              C:\Program Files\MSN Messenger\usnsvc.exe
              C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
              C:\WINDOWS\system32\spider.exe
              C:\Program Files\Internet Explorer\iexplore.exe
              C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
              C:\WINDOWS\system32\cmd.exe

              »»»»»»»»»»»»»»»»»»»»»»»» hosts

              »»»»»»»»»»»»»»»»»»»»»»»» C:\

              »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

              »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

              »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

              »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

              »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

              »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Utilisateur

              »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Utilisateur\Application Data

              »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

              »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\UTILIS~1\Favoris

              »»»»»»»»»»»»»»»»»»»»»»»» Bureau

              »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

              »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

              »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

              [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
              "Source"="http://srx.fr.ebayrtm.com/..."
              "SubscribedURL"="http://srx.fr.ebayrtm.com/..."
              "FriendlyName"=""

              [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
              "Source"="About:Home"
              "SubscribedURL"="About:Home"
              "FriendlyName"="Ma page d'accueil"

              »»»»»»»»»»»»»»»»»»»»»»»» o4Patch
              !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

              o4Patch
              Credits: Malware Analysis & Diagnostic
              Code: S!Ri

              »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
              !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

              IEDFix
              Credits: Malware Analysis & Diagnostic
              Code: S!Ri

              »»»»»»»»»»»»»»»»»»»»»»»» VACFix
              !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

              VACFix
              Credits: Malware Analysis & Diagnostic
              Code: S!Ri

              »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
              !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

              404Fix
              Credits: Malware Analysis & Diagnostic
              Code: S!Ri

              »»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
              !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

              AntiXPVSTFix
              Credits: Malware Analysis & Diagnostic
              Code: S!Ri

              »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
              !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

              SrchSTS.exe by S!Ri
              Search SharedTaskScheduler's .dll

              »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
              !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
              "AppInit_DLLs"=""

              »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
              !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
              "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
              "System"=""

              »»»»»»»»»»»»»»»»»»»»»»»» RK

              »»»»»»»»»»»»»»»»»»»»»»»» DNS

              Description: Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter
              DNS Server Search Order: 212.27.40.240
              DNS Server Search Order: 212.27.40.241

              HKLM\SYSTEM\CCS\Services\Tcpip\..\{A7CF4D62-FD50-4E5D-B10D-0E7FE6A96774}: DhcpNameServer=212.27.40.240 212.27.40.241
              HKLM\SYSTEM\CS1\Services\Tcpip\..\{A7CF4D62-FD50-4E5D-B10D-0E7FE6A96774}: DhcpNameServer=212.27.40.240 212.27.40.241
              HKLM\SYSTEM\CS2\Services\Tcpip\..\{A7CF4D62-FD50-4E5D-B10D-0E7FE6A96774}: DhcpNameServer=212.27.40.240 212.27.40.241
              HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241
              HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241
              HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241

              »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

              »»»»»»»»»»»»»»»»»»»»»»»» Fin
              0
          3. anthony5151 Contributeur sécurité
            Oui stp
            Ca ne prend que 30 secondes
            1
            1. anthony5151 Contributeur sécurité
              Bonjour,

              Télécharge hijackthis (logiciel de diagnostique) sur ton bureau : https://www.commentcamarche.net/telecharger/securite/11747-hijackthis/

              Installe le, lance le et clique sur "Do a system scan and save a logfile".
              Fais un copier-coller du rapport entier sur le forum

              -1
              1. sergioleo Auteur
                bonjour
                j'ai deja fais un scan avec malwarebyte's anti-malware dois je quand meme en refaire un avec hijackthis
                merci
                0

            Discussions similaires

            Ou trouver le pilote pour epson xp-2205
            lutttinette

            19 réponses
            probleme configuration wifi epson xp-225
            sam099

            35 réponses
            Google Chrome "  Échec de l'analyse antivirus "
            jmpower

            18 réponses