ComboFix Demare pas -_-

Bonjour,

Je ne sais pas si je suis au bon endroit, c'est la première fois que j'utilise ce genre de forum (que je trouve super intéressant d'ailleurs...). j'essaie de me débarasser de gomeo et toprix avec combofix mais j'ai un problème. J'ai réussi à télécharger combofix mais il ne s'éxécute pas, j'ai une barre de loading mais il ne se passe rien. Est-ce que quelqu'un peut m'aider ? Pusi-je utiliser autre chose que combofix pour venir à bout de goemo et topprix ? Merci beaucoup

J'ai exactement le méme probleme, j'en suis a SDfix.exe telechargé via un autre pc, comme j'etait dans l'impossibilité de l'installer, j'ai redem&rré en mode sans echec, et la méme probleme, impossible de l'installer.
Je m'en suis sorti grace a winrar, en fesant un clique droit sur SDfix.exe et choisi extraire ici (sur le bureau biensur), le dossier SDfix est à present sur mon bureau.
Quel galere ce spy... je ne sais méme pas ou je l'ai choppé... peut etre sur un site de proposant des script javacript...

bien...te voila pare pour de nouvelles aventures apres avoir mis "resolu" pour aider d autres personnes dans ton cas

et de 2

he following actions will be executed if you choose to clean the selected items:

Delete registry value: '@C:\WINDOWS\system32\netshell.dll,-1200' in HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
Delete registry value: 'C:\WINDOWS\system32\SNDVOL32.EXE' in HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
Delete registry value: '@explorer.exe,-7023' in HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
Delete registry value: '@explorer.exe,-7020' in HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
Delete registry value: '@explorer.exe,-7021' in HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
Delete registry value: '@C:\WINDOWS\system32\SHELL32.dll,-9319' in HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
Delete registry value: '@xpsp1res.dll,-10077' in HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
Delete registry value: '@C:\WINDOWS\system32\SHELL32.dll,-9217' in HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
Delete registry value: '@C:\WINDOWS\system32\SHELL32.dll,-9216' in HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
Delete registry value: '@shell32.dll,-21790' in HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
Delete registry value: '@shell32.dll,-21779' in HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
Delete registry value: '@C:\WINDOWS\system32\SHELL32.dll,-9227' in HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
Delete registry value: 'HRZR_PGYFRFFVBA' in HKCU\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count
Delete file: C:\Documents and Settings\Crazy\Local Settings\Temp\etilqs_vHd3WiyjYbKwOca91PWx
Delete file: C:\Documents and Settings\Crazy\Local Settings\Temp\~DF34DD.tmp
Delete file: C:\Documents and Settings\Crazy\Local Settings\Temp\~DF34E8.tmp
Delete file: C:\Documents and Settings\Crazy\Local Settings\Temp\~DFBB2E.tmp
Delete file: C:\Documents and Settings\Crazy\Local Settings\Temp\~DFCBBC.tmp
Delete file: C:\Documents and Settings\Crazy\Local Settings\Temp\~DFCBCA.tmp
Empty the Recycle Bin
Clean the clipboard
Clean event log: Application
Clean event log: Security
Clean event log: System
Uninstall USB Devices
Clean index.dat file: C:\Documents and Settings\Crazy\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Delete file: C:\Documents and Settings\Crazy\Local Settings\Temporary Internet Files\Content.IE5\6TQO4E5R\index[4].htm
Delete file: C:\Documents and Settings\Crazy\Local Settings\Temporary Internet Files\Content.IE5\9F25NX5Y\sword[1].cur
Delete file: C:\Documents and Settings\Crazy\Local Settings\Temporary Internet Files\Content.IE5\JYGPATGH\ck[1].htm
Delete folder: C:\Documents and Settings\Crazy\Local Settings\Temporary Internet Files\Content.IE5\6TQO4E5R
Delete folder: C:\Documents and Settings\Crazy\Local Settings\Temporary Internet Files\Content.IE5\9F25NX5Y
Delete folder: C:\Documents and Settings\Crazy\Local Settings\Temporary Internet Files\Content.IE5\JYGPATGH
Clean index.dat file: C:\Documents and Settings\Crazy\Cookies\index.dat
Clean index.dat file: C:\Documents and Settings\Crazy\Local Settings\Historique\History.IE5\index.dat
Clean index.dat file: C:\Documents and Settings\Crazy\Local Settings\Historique\History.IE5\MSHist012008112320081124\index.dat
Clean index.dat file: C:\Documents and Settings\Crazy\Local Settings\Historique\History.IE5\MSHist012008112420081125\index.dat
Delete file: C:\Documents and Settings\Crazy\Local Settings\Historique\History.IE5\MSHist012008112320081124\index.dat
Delete file: C:\Documents and Settings\Crazy\Local Settings\Historique\History.IE5\MSHist012008112420081125\index.dat
Delete folder: C:\Documents and Settings\Crazy\Local Settings\Historique\History.IE5\MSHist012008112320081124
Delete folder: C:\Documents and Settings\Crazy\Local Settings\Historique\History.IE5\MSHist012008112420081125
Delete file: C:\Documents and Settings\Crazy\Local Settings\Application Data\Mozilla\Firefox\Profiles\vwc7qxa5.default\cache\_CACHE_001_
Delete file: C:\Documents and Settings\Crazy\Local Settings\Application Data\Mozilla\Firefox\Profiles\vwc7qxa5.default\cache\_CACHE_002_
Delete file: C:\Documents and Settings\Crazy\Local Settings\Application Data\Mozilla\Firefox\Profiles\vwc7qxa5.default\cache\_CACHE_003_
Delete file: C:\Documents and Settings\Crazy\Local Settings\Application Data\Mozilla\Firefox\Profiles\vwc7qxa5.default\cache\_CACHE_MAP_
Delete file: C:\Documents and Settings\Crazy\Application Data\Mozilla\Firefox\Profiles\vwc7qxa5.default\formhistory.sqlite
Delete file: C:\Documents and Settings\Crazy\Application Data\Mozilla\Firefox\Profiles\vwc7qxa5.default\cookies.sqlite

Number of files to delete: 17
Total size of files to delete: 11,123 KB

bha bha bha bha je sais plus koi dire ce pire que faire le menage de ma voiture tout sa XD

touka merci je vais faire mon posible pour toute faire sa merci

en voila un premier

PureRa v1.1 from RaProducts
Log created at 23:04 on 24/11/2008
===================================

C:\Documents and Settings\Administrateur\Application Data\desktop.ini << Deleted.
C:\Documents and Settings\Administrateur\Local Settings\desktop.ini << Deleted.
C:\Documents and Settings\Administrateur\Local Settings\Application Data\IconCache.db << Deleted.
C:\Documents and Settings\Administrateur\Local Settings\Historique\desktop.ini << Deleted.
C:\Documents and Settings\Administrateur\Local Settings\Historique\History.IE5\desktop.ini << Deleted.
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\desktop.ini << Deleted.
C:\Documents and Settings\Administrateur\Menu Démarrer\desktop.ini << Deleted.
C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\desktop.ini << Deleted.
C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Accessoires\desktop.ini << Deleted.
C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Accessoires\Accessibilité\desktop.ini << Deleted.
C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Accessoires\Divertissement\desktop.ini << Deleted.
C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Démarrage\desktop.ini << Deleted.
C:\Documents and Settings\Administrateur\SendTo\desktop.ini << Deleted.
C:\Documents and Settings\All Users\Application Data\desktop.ini << Deleted.
C:\Documents and Settings\All Users\Documents\desktop.ini << Deleted.
C:\Documents and Settings\All Users\Documents\Ma musique\Desktop.ini << Deleted.
C:\Documents and Settings\All Users\Documents\Ma musique\Échantillons de musique\desktop.ini << Deleted.
C:\Documents and Settings\All Users\Documents\Mes images\Desktop.ini << Deleted.
C:\Documents and Settings\All Users\Documents\Mes images\Échantillons d'images\desktop.ini << Deleted.
C:\Documents and Settings\All Users\Documents\Mes images\Échantillons d'images\Thumbs.db << Deleted.
C:\Documents and Settings\All Users\Documents\Mes vidéos\Desktop.ini << Deleted.
C:\Documents and Settings\All Users\Menu Démarrer\desktop.ini << Deleted.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\desktop.ini << Deleted.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\desktop.ini << Deleted.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\Accessibilité\desktop.ini << Deleted.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\Communications\desktop.ini << Deleted.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\Divertissement\desktop.ini << Deleted.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\Outils système\desktop.ini << Deleted.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini << Deleted.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HLSW\desktop.ini << Deleted.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Jeux\desktop.ini << Deleted.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Outils d'administration\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Application Data\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Application Data\Microsoft\Office\Récent\Desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Application Data\SmartFTP\Client 2.0\Favorites\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Bureau\Bob_Sinclar_-_House_Masters__2008\Bob Sinclar - House Masters 2008\Thumbs.db << Deleted.
C:\Documents and Settings\Crazy\Bureau\Cap_tain_-_15_years_Up_By_Killer_Instinct\Cap'tain - 15 years_Up_By_Killer_Instinct\Thumbs.db << Deleted.
C:\Documents and Settings\Crazy\Bureau\lankebeker\Thumbs.db << Deleted.
C:\Documents and Settings\Crazy\Bureau\lankebeker\photo lan\Thumbs.db << Deleted.
C:\Documents and Settings\Crazy\Bureau\Microsoft Windows Xp Live__www.dl4all.com\Thumbs.db << Deleted.
C:\Documents and Settings\Crazy\Contacts\Desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Cookies\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Favoris\Desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Local Settings\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Local Settings\Application Data\IconCache.db << Deleted.
C:\Documents and Settings\Crazy\Local Settings\Application Data\Microsoft\Feeds Cache\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Local Settings\Application Data\Microsoft\Feeds Cache\1JQ2QWK8\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Local Settings\Application Data\Microsoft\Feeds Cache\EPBK6RR5\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Local Settings\Application Data\Microsoft\Feeds Cache\O5RFZR4C\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Local Settings\Application Data\Microsoft\Feeds Cache\VCB5VIVV\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Local Settings\Application Data\Microsoft\Messenger\skateuse13@msn.com\Sharing Folders\coucou_sup@hotmail.com\Thumbs.db << Deleted.
C:\Documents and Settings\Crazy\Local Settings\Application Data\Microsoft\Windows Live Contacts\Desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Local Settings\Historique\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Local Settings\Historique\History.IE5\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Local Settings\Temporary Internet Files\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Local Settings\Temporary Internet Files\Content.IE5\34N5XEP1\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Local Settings\Temporary Internet Files\Content.IE5\6TQO4E5R\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Local Settings\Temporary Internet Files\Content.IE5\9F25NX5Y\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Local Settings\Temporary Internet Files\Content.IE5\C2VFS3AL\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Menu Démarrer\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Menu Démarrer\Programmes\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Menu Démarrer\Programmes\Accessoires\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Menu Démarrer\Programmes\Accessoires\Accessibilité\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Menu Démarrer\Programmes\Accessoires\Divertissement\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Menu Démarrer\Programmes\Démarrage\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Menu Démarrer\Programmes\Outils d'administration\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Mes documents\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Mes documents\Ma musique\Desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Mes documents\Mes images\Desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Mes documents\Mes images\Thumbs.db << Deleted.
C:\Documents and Settings\Crazy\Mes documents\Mes vidéos\Desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Mes documents\Mes vidéos\Thumbs.db << Deleted.
C:\Documents and Settings\Crazy\Recent\Desktop.ini << Deleted.
C:\Documents and Settings\Crazy\SendTo\desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Voisinage réseau\1C Company sur Thecrazyclown\Desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Voisinage réseau\Call of Duty - World at War sur Thecrazyclown\Desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Voisinage réseau\Company of Heroes sur Thecrazyclown\Desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Voisinage réseau\Electronic Arts sur Thecrazyclown\Desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Voisinage réseau\PlayOnline sur Thecrazyclown\Desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Voisinage réseau\SharedDocs sur steph (Steph-140665c47)\Desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Voisinage réseau\SharedDocs sur Thecrazyclown\Desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Voisinage réseau\World of Warcraft sur steph (Steph-140665c47)\Desktop.ini << Deleted.
C:\Documents and Settings\Crazy\Voisinage réseau\_uplauncher sur steph (Steph-140665c47)\Desktop.ini << Deleted.
C:\Documents and Settings\Default User\Application Data\desktop.ini << Deleted.
C:\Documents and Settings\Default User\Local Settings\desktop.ini << Deleted.
C:\Documents and Settings\Default User\Local Settings\Historique\desktop.ini << Deleted.
C:\Documents and Settings\Default User\Local Settings\Historique\History.IE5\desktop.ini << Deleted.
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\desktop.ini << Deleted.
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini << Deleted.
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\8T6VKPYR\desktop.ini << Deleted.
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\C52R896F\desktop.ini << Deleted.
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\S1UR892V\desktop.ini << Deleted.
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\WH2NWLMV\desktop.ini << Deleted.
C:\Documents and Settings\Default User\Menu Démarrer\desktop.ini << Deleted.
C:\Documents and Settings\Default User\Menu Démarrer\Programmes\desktop.ini << Deleted.
C:\Documents and Settings\Default User\Menu Démarrer\Programmes\Accessoires\desktop.ini << Deleted.
C:\Documents and Settings\Default User\Menu Démarrer\Programmes\Accessoires\Accessibilité\desktop.ini << Deleted.
C:\Documents and Settings\Default User\Menu Démarrer\Programmes\Accessoires\Divertissement\desktop.ini << Deleted.
C:\Documents and Settings\Default User\Menu Démarrer\Programmes\Démarrage\desktop.ini << Deleted.
C:\Documents and Settings\Default User\SendTo\desktop.ini << Deleted.
C:\Documents and Settings\LocalService\Favoris\Desktop.ini << Deleted.
C:\Documents and Settings\LocalService\Local Settings\desktop.ini << Deleted.
C:\Documents and Settings\LocalService\Local Settings\Historique\desktop.ini << Deleted.
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\desktop.ini << Deleted.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\desktop.ini << Deleted.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini << Deleted.
C:\Documents and Settings\NetworkService\Local Settings\desktop.ini << Deleted.
C:\Documents and Settings\NetworkService\Local Settings\Historique\desktop.ini << Deleted.
C:\Documents and Settings\NetworkService\Local Settings\Historique\History.IE5\desktop.ini << Deleted.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\desktop.ini << Deleted.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini << Deleted.
C:\Documents and Settings\tester\Application Data\desktop.ini << Deleted.
C:\Documents and Settings\tester\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini << Deleted.
C:\Documents and Settings\tester\Application Data\Microsoft\MSN Messenger\960291752\sqmnoopt00.sqm << Deleted.
C:\Documents and Settings\tester\Application Data\SmartFTP\Client 2.0\Favorites\desktop.ini << Deleted.
C:\Documents and Settings\tester\Favoris\Desktop.ini << Deleted.
C:\Documents and Settings\tester\Local Settings\desktop.ini << Deleted.
C:\Documents and Settings\tester\Local Settings\Application Data\IconCache.db << Deleted.
C:\Documents and Settings\tester\Local Settings\Application Data\Microsoft\Feeds Cache\desktop.ini << Deleted.
C:\Documents and Settings\tester\Local Settings\Application Data\Microsoft\Feeds Cache\0HZ49MJU\desktop.ini << Deleted.
C:\Documents and Settings\tester\Local Settings\Application Data\Microsoft\Feeds Cache\1HNNVQM7\desktop.ini << Deleted.
C:\Documents and Settings\tester\Local Settings\Application Data\Microsoft\Feeds Cache\29SBGXK0\desktop.ini << Deleted.
C:\Documents and Settings\tester\Local Settings\Application Data\Microsoft\Feeds Cache\SZYVLZI8\desktop.ini << Deleted.
C:\Documents and Settings\tester\Local Settings\Application Data\Microsoft\Windows Live Contacts\Desktop.ini << Deleted.
C:\Documents and Settings\tester\Local Settings\Historique\desktop.ini << Deleted.
C:\Documents and Settings\tester\Local Settings\Historique\History.IE5\desktop.ini << Deleted.
C:\Documents and Settings\tester\Local Settings\Temporary Internet Files\desktop.ini << Deleted.
C:\Documents and Settings\tester\Menu Démarrer\desktop.ini << Deleted.
C:\Documents and Settings\tester\Menu Démarrer\Programmes\desktop.ini << Deleted.
C:\Documents and Settings\tester\Menu Démarrer\Programmes\Accessoires\desktop.ini << Deleted.
C:\Documents and Settings\tester\Menu Démarrer\Programmes\Accessoires\Accessibilité\desktop.ini << Deleted.
C:\Documents and Settings\tester\Menu Démarrer\Programmes\Accessoires\Divertissement\desktop.ini << Deleted.
C:\Documents and Settings\tester\Menu Démarrer\Programmes\Démarrage\desktop.ini << Deleted.
C:\Documents and Settings\tester\Mes documents\desktop.ini << Deleted.
C:\Documents and Settings\tester\Mes documents\Ma musique\Desktop.ini << Deleted.
C:\Documents and Settings\tester\Mes documents\Mes images\Desktop.ini << Deleted.
C:\Documents and Settings\tester\Recent\Desktop.ini << Deleted.
C:\Documents and Settings\tester\SendTo\desktop.ini << Deleted.
C:\nDoors\Atlantica\NMap\DeathCastle3\DefaultTexture\Thumbs.db << Deleted.
C:\nDoors\Atlantica\NMap\DeathCastle3\LowerTexture\Thumbs.db << Deleted.
C:\Program Files\1C Company\King's Bounty\desktop.ini << Deleted.
C:\Program Files\EA Sports\NHL08\fe\nhl\EASO\nhl\images\logos\Thumbs.db << Deleted.
C:\Program Files\EA Sports\NHL08\Support\EA Help\Thumbs.db << Deleted.
C:\Program Files\EA Sports\NHL08\Support\EA Help\Cz\Thumbs.db << Deleted.
C:\Program Files\EA Sports\NHL08\Support\EA Help\Da\Thumbs.db << Deleted.
C:\Program Files\EA Sports\NHL08\Support\EA Help\De\Thumbs.db << Deleted.
C:\Program Files\EA Sports\NHL08\Support\EA Help\en-uk\Thumbs.db << Deleted.
C:\Program Files\EA Sports\NHL08\Support\EA Help\en-us\Thumbs.db << Deleted.
C:\Program Files\EA Sports\NHL08\Support\EA Help\en-us\WebHelp_Skin_Files\XP_Silver\Thumbs.db << Deleted.
C:\Program Files\EA Sports\NHL08\Support\EA Help\Es\Thumbs.db << Deleted.
C:\Program Files\EA Sports\NHL08\Support\EA Help\Fi\Thumbs.db << Deleted.
C:\Program Files\EA Sports\NHL08\Support\EA Help\fr-fr\Thumbs.db << Deleted.
C:\Program Files\EA Sports\NHL08\Support\EA Help\Hu\Thumbs.db << Deleted.
C:\Program Files\EA Sports\NHL08\Support\EA Help\It\Thumbs.db << Deleted.
C:\Program Files\EA Sports\NHL08\Support\EA Help\NL\Thumbs.db << Deleted.
C:\Program Files\EA Sports\NHL08\Support\EA Help\No\Thumbs.db << Deleted.
C:\Program Files\EA Sports\NHL08\Support\EA Help\Pol\Thumbs.db << Deleted.
C:\Program Files\EA Sports\NHL08\Support\EA Help\pt\Thumbs.db << Deleted.
C:\Program Files\EA Sports\NHL08\Support\EA Help\pt-br\Thumbs.db << Deleted.
C:\Program Files\EA Sports\NHL08\Support\EA Help\Ru\Thumbs.db << Deleted.
C:\Program Files\EA Sports\NHL08\Support\EA Help\Sv\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\autopatch\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\class\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\ItemIcon\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\MapIcon\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\Mark\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\NameCard\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\Spray\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_Buddy\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_BuyListSet\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_CFPointWeb\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_Channel\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_Character_Create_P\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_Character_Setting\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_Character_Uniform\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_Common\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_FirstLoginNotice\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_GameEnd\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_GameResult\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_GameRoom\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_GNB\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_IDCard\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_Invite\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_Invite_Clan\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_Lobby\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_Login\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_MakeRoom\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_MsgWnd\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_Option\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_Option\InGame\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_Password\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_PromotionMsg\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_ReBuy\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_Replay\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_Resell\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_RoomOption\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_SelectWnd\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_Server\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_Shop2\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\UI_Tutorial\Thumbs.db << Deleted.
C:\Program Files\G4box\CrossFire\rez\UI\WeaponIcon\Thumbs.db << Deleted.
C:\Program Files\HLSW\desktop.ini << Deleted.
C:\Program Files\Microsoft Office\OFFICE11\1036\DataServices\DESKTOP.INI << Deleted.
C:\Program Files\National Guard\Guard Shield\Graphics\FrontEnd\DDS\Thumbs.db << Deleted.
C:\Program Files\National Guard\Guard Shield\Graphics\FrontEnd\Loads\Thumbs.db << Deleted.
C:\Program Files\National Guard\Guard Shield\Graphics\FrontEnd\MP_shots\Thumbs.db << Deleted.
C:\Program Files\National Guard\Guard Shield\Graphics\FrontEnd\ranks\Thumbs.db << Deleted.
C:\Program Files\National Guard\Guard Shield\Graphics\FrontEnd\SP_shots\Thumbs.db << Deleted.
C:\Program Files\National Guard\Guard Shield\Graphics\FrontEnd\UI\Textures\dds\Thumbs.db << Deleted.
C:\Program Files\NETAMIN\Real Baseball\game\user\Thumbs.db << Deleted.
C:\Program Files\Xfire\screenshots\Thumbs.db << Deleted.
C:\RECYCLER\S-1-5-21-1547161642-1409082233-839522115-1003\desktop.ini << Deleted.
C:\WINDOWS\desktop.ini << Deleted.
C:\WINDOWS\Thumbs.db << Deleted.
C:\WINDOWS\assembly\Desktop.ini << Unable to Delete.
C:\WINDOWS\Downloaded Program Files\desktop.ini << Deleted.
C:\WINDOWS\Fonts\desktop.ini << Deleted.
C:\WINDOWS\Offline Web Pages\desktop.ini << Deleted.
C:\WINDOWS\system32\desktop.ini << Deleted.
C:\WINDOWS\system32\config\systemprofile\Application Data\desktop.ini << Deleted.
C:\WINDOWS\system32\config\systemprofile\Local Settings\desktop.ini << Deleted.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\desktop.ini << Deleted.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\desktop.ini << Deleted.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\desktop.ini << Deleted.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini << Deleted.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\74HQYWZ9\desktop.ini << Deleted.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FAGRQZ7A\desktop.ini << Deleted.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\IY9NQ7MP\desktop.ini << Deleted.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\P9U79UWO\desktop.ini << Deleted.
C:\WINDOWS\system32\config\systemprofile\Menu Démarrer\desktop.ini << Deleted.
C:\WINDOWS\system32\config\systemprofile\Menu Démarrer\Programmes\desktop.ini << Deleted.
C:\WINDOWS\system32\config\systemprofile\Menu Démarrer\Programmes\Accessoires\desktop.ini << Deleted.
C:\WINDOWS\system32\config\systemprofile\Menu Démarrer\Programmes\Accessoires\Accessibilité\desktop.ini << Deleted.
C:\WINDOWS\system32\config\systemprofile\Menu Démarrer\Programmes\Accessoires\Divertissement\desktop.ini << Deleted.
C:\WINDOWS\system32\config\systemprofile\Menu Démarrer\Programmes\Démarrage\desktop.ini << Deleted.
C:\WINDOWS\system32\config\systemprofile\SendTo\desktop.ini << Deleted.
C:\WINDOWS\Tasks\desktop.ini << Unable to Delete.

===================================
-EOF-

1)Telecharge :
-------------

https://www.clubic.com/telecharger-fiche262022-purera.html

coche tout a droite sauf config msi , et "clean"

ensuite :
-----------

http://www.commentcamarche.net/telecharger/cleanafterme 34056612 avis opinions.php3

meme chose tu coches tout et "clean selected items"

source = Gen-Hackman..........et puis a faire aussi :

2)

---> Télécharge ToolsCleaner2 sur ton Bureau.
* Double-clique sur ToolsCleaner2.exe pour le lancer.
* Clique sur Recherche et laisse le scan agir.
* Clique sur Suppression pour finaliser.
* Tu peux, si tu le souhaites, te servir des Options Facultatives.
* Clique sur Quitter pour obtenir le rapport.
* Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

3/

---> Télécharge et installe CCleaner (N'installe pas la Yahoo Toolbar) :
* Lance-le. Va dans Options puis Avancé et décoche la case Effacer uniquement les fichiers etc....
* Va dans Nettoyeur, choisis Analyse. Une fois terminé, lance le nettoyage.
* Ensuite, choisis Registre, puis Chercher des erreurs. Une fois terminé, répare toutes les erreurs tant de fois qu il en trouve a l analyse(Sauvegarde la base de registre).

4/

---> Il est nécessaire de désactiver puis réactiver la restauration système pour la purger :
http://www.infos-du-net.com/forum/272480-11-desactiver-activer-restauration-systeme

---> Je te conseille de créer un point de restauration que tu pourras utiliser plus tard si tu as un problème :
https://www.vulgarisation-informatique.com/creer-point-restauration.php

stp poste tous les rapports delivrés....merci.....

si tu as deja Ccleaner ne tiens pas compte du N°3.....mais fais ce qu il est demande avec
(desole le canned est pour tout le monde....lol)

Attention : ne pas toucher au PC pendant qu'il travaille !

B-Nettoyage et Défragmentation de tes Disques
*Nettoyage :
Clic droit sur "poste de travail" ==>"ouvrir" ==>clic droit sur le disque C ==>Propriétés ==>onglet "Général"
Cliques sur le bouton "nettoyage de disque", OK
tu le fais pour chacun de tes disques

*Vérifications des erreurs :
Clic droit sur "poste de travail" ==>"ouvrir" ==>clic droit sur le disque C ==>Propriétés ==>onglet "Outil"
"Vérifier maintenant", une boîte s'ouvre, cocher les cases :
-réparer automatiquement les erreurs...
-rechercher et tenter une récupération...
--->Démarrer, ok
Note : s'il te dis de redémarrer ton Pc pour le faire , tu redémarres et tu laisses faire, cela prend un peu de temps c'est normal
tu le fais pour chacun de tes disques

ensuite toujours dans le même onglet tu choisis :
*Défragmentation :
"défragmenter maintenant", OK
une boîte s'ouvre, tu sélectionnes le disque à défragmenter, et tu cliques sur "analyser", puis après l'analyse, "défragmenter" . OK
tu le fais pour chacun de tes disques

Note : si tu as un utilitaire pour défragmenter , utilises le à la place ...

pour ce faire je te conseille ceci :

https://www.clubic.com/telecharger-fiche44314-defraggler.html

C-Crées un point de restauration de ton PC :

Aller dans le Menu Démarrer puis dans Programmes,
- Ensuite dans Accessoires et enfin dans Outils système,
- Choisir "Restauration du système",
- Sélectionner "Créer un point de restauration",
- Cliquer sur "Suivant",
- Entrer un nom pour le point de restauration (ce nom doit être assez évocateur), exemple :
<< Point restauration sain >> .

--> Cliquer sur "Créer" et le point de restauration se créé automatiquement.

> Peux-tu vérifier ta console JAVA ici ? : https://www.java.com/fr/download/uninstalltool.jsp et installer la nouvelle version si besoin est (dans ce cas désinstalle avant l'ancienne version).
Pour info. ou en cas de problème : http://assiste.com.free.fr/p/abc/c/anti_java.html

> Mets à jour Acrobat si ce n'est pas le cas (désinstalle avant la version antérieure) : https://get2.adobe.com/reader/otherversions/

> Télécharge et installe Update Checker : https://filehippo.com/windows/tuning-utilities/
- Lance le programme. Une page web de ce type va s'ouvrir.
- Fais les mises à jour de tous les logiciels proposés pour Update. Je ne te conseille pas de faire celles pour les versions béta (elles peuvent être instables).
- Fais un copier/coller de la liste de éléments "Updates". Puis poste la sur le forum.
- Une fois les mises à jour effectuées, relance ton PC.
Tuto si problèmes : https://www.commentcamarche.net/list 9908 update checker vos logiciels sont ils a jour

> Télécharge et installe Easy Cleaner : https://www.01net.com/telecharger/windows/Utilitaire/registre/fiches/8351.html
(lien miroir : https://www.clubic.com/telecharger-fiche11170-easycleaner.html )
- Lance le programme puis clique sur <Registre> puis sur <Trouver>.
- A la fin du scan clique sur <Supprime tout> puis confirme par <Oui> puis quitte le programme.
Si besoin tuto ici : https://www.pcparadise.fr
et http://www.6ma.fr/tuto/easycleaner-nettoyer-windows-des-elements-obsoletes/

> Tu peux aussi vider ta corbeille......quoi que Ccleaner le fasse tout seul.......

> Si nous avons utilisé MalwaresByte's Anti-Malware : vide sa quarantaine.
- Lance le programme puis clique sur <Quarantaine>.
- Sélectionne tous les éléments puis clique sur <supprime>.
- Quitte la programme.

> Idem pour ton antivirus : vide sa quarantaine si ce n'est pas déjà fait...

> Désactive et réactive la restauration de système, pour cela : suis les instructions de ce lien :

liens XP:

http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20020830101856924

liens Vista :

http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/4f60eedf1156c8068525695b005ca288/c066b2e9a50cc948802572870032b170?OpenDocument
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Quelques conseils et recommandations pour l'avenir :

> Passe un coup d'AGV et/ou de MalwareByte's Anti-Malware et de Ccleaner de temps en temps (1 fois par semaine à 1 fois par mois, suivant l'utilisation que tu fais de ton PC. Tu peux aussi décocher la casse dans l’onglet "Options" puis clique sur "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier temp de Windows, plus vieux que 48 heures").
- Utilise aussi tes autres logiciels de protection (scannes antivirus, antispywares...). N'oublie pas de faire les mises à jour avant de les utiliser.
- Pense aussi à faire une défragmentation de tes disques durs de temps en temps (garde suffisamment d'espace sur C:\ (1/3 de libre pour être à l'aise))

> Pour bien protéger ton PC :
[1 seul Antivirus] + [1 seul Pare feu (/!\ les routeurs et box en possèdent un)] + [Quelques Antispywares] + [Mises à Jour récentes Windows et Logiciels de Protection] + [Utilisation de Firefox -ou autres- (Internet Explorer présente des failles de sécurité qui mettent longtemps avant d'être corrigées mais il faut absolument le conserver pour les mises à jour Windows)] + [Utilisation du PC en mode Invité (= limité). Lors d'une infection en mode administrateur le PC est beaucoup plus vulnérable. Voir ICI]
PS : En fait la meilleure des protections c'est toi même : ce que tu fais avec ton PC : où tu surfes, télécharges...ect....
Les virus utilisent les failles de ton PC pour infecter un système. Info : http://assiste.com.free.fr/p/abc/a/zombies_et_botnets.html

> Quelques liens utiles :
- https://www.commentcamarche.net/list 2432 securite proteger un ordinateur contre les malwares d internet
- https://sebsauvage.net/safehex.html
- https://www.zebulon.fr/telechargements/securite/protection-donnees-personnelles/spywareblaster.html (= petit logiciel qui bloque l'installation d'activ-X nuisibles au PC. Fonctionne en arrière plan)

Voila,
Bonne lecture....

source : DllD..............;-)

Gen-hackman.......................

un menage ?? je dois faire ko iau juste ?

Merci

bien on a pas l air mal la.......si tu n as plus de soucis on va faire le menage

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:59, on 2008-11-24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\FlashGet\flashget.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\HooTech\NetMeter\HooNetMeter.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\VentSrv\ventrilo_svc.exe
C:\Program Files\VentSrv\ventrilo_srv.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ca
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo R220 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE /P30 "EPSON Stylus Photo R220 Series" /O6 "USB001" /M "Stylus Photo R220"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NetMeter] C:\Program Files\HooTech\NetMeter\HooNetMeter.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O8 - Extra context menu item: &Tout télécharger avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.systemrequirementslab.com/cyri
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://plugin.driveragent.com/files/driveragent.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: VMware Agent Service (ufad-ws60) - Unknown owner - (no file)
O23 - Service: Ventrilo - Unknown owner - C:\Program Files\VentSrv\ventrilo_svc.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe

peux tu maintenant fournir un nouvel hijackthis ?

rien mauvaise place :P

EDIT

Touka premierement j ai plus les adresse rediriger sur google et mon internet es beaucoup plus vite , MErci !

par la suite je peut maintenant ouvrir combofix :P jai pas fait de scan j att de vos nouvelle avant

mais jai eu 2 -3 erreur au demarge j espere cetais quune fois ^^ et quand j ai ouvert combofix our voir si il fonctionnais j ai "Question console de recuperation , combo fix a detecter que la console de recupretation windows n existe pas sur ce pc vous aurier VRAIMENT TOUT INTERET a l 'installer "

donc es ce que je l install ?

Merci encore ;)

bon bha combofix ma pas laisser le temps de l arrete donc voici le log de combofix aussi ^^

ComboFix 08-11-18.A2 - Crazy 2008-11-19 13:30:20.5 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.1359 [GMT -5:00]
Lancé depuis: C:\Documents and Settings\Crazy\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé
* Resident AV is active

[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\Fonts\syn00-1B-FC-8E-AC-FC\system
C:\WINDOWS\Fonts\syn00-50-56-C0-00-01\system
C:\WINDOWS\Fonts\syn00-50-56-C0-00-08\system
C:\WINDOWS\Fonts\syn00-50-56-C0-00-08\system\smss.exe
C:\WINDOWS\system32\msporc.dll

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_TDSSSERV.SYS

((((((((((((((((((((((((((((( Fichiers créés du 2008-10-19 au 2008-11-19 ))))))))))))))))))))))))))))))))))))
.

2008-11-19 10:24 . 2008-11-19 10:24 <REP> d-------- C:\WINDOWS\ERUNT
2008-11-19 10:21 . 2008-11-19 13:19 <REP> d-------- C:\SDFix
2008-11-18 23:57 . 2008-11-18 23:57 2,988 --a------ C:\WINDOWS\system32\tmp.reg
2008-11-18 23:55 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-11-18 23:55 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-11-18 23:55 . 2008-10-01 14:51 87,552 --a------ C:\WINDOWS\system32\VACFix.exe
2008-11-18 23:55 . 2008-10-10 07:58 82,944 --a------ C:\WINDOWS\system32\o4Patch.exe
2008-11-18 23:55 . 2008-05-18 20:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-11-18 23:55 . 2008-10-10 07:58 82,944 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-11-18 23:55 . 2008-08-18 11:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe
2008-11-18 23:55 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-11-18 23:55 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-11-18 23:55 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-11-18 18:33 . 2008-11-19 13:33 100,352 --a------ C:\WINDOWS\system32\drivers\cgbxzectixp.sys
2008-11-16 20:50 . 2008-11-16 20:57 <REP> d-------- C:\nDoors
2008-11-14 10:58 . 2008-11-14 10:58 <REP> d-------- C:\rsit
2008-11-14 10:18 . 2008-11-14 10:28 <REP> d-------- C:\Program Files\FindyKill
2008-11-12 10:53 . 2008-11-12 10:53 <REP> d-------- C:\Program Files\CCleaner
2008-11-10 22:43 . 2008-11-10 22:43 <REP> d-------- C:\Program Files\ESET
2008-11-09 23:39 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-11-09 23:39 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-11-09 23:39 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-11-09 23:19 . 2008-11-10 09:31 869 --a------ C:\WINDOWS\SysMech6.INI
2008-11-09 23:18 . 2008-11-09 23:18 406 --a------ C:\WINDOWS\system32\ioloBootDefrag.cfg
2008-11-09 23:15 . 2008-11-14 10:08 <REP> d-------- C:\Program Files\adslTV
2008-11-08 12:15 . 2008-11-08 12:15 <REP> d-------- C:\Program Files\G4box
2008-11-07 13:25 . 2008-11-09 18:01 8,192 --ahs---- C:\WINDOWS\Thumbs.db
2008-11-04 14:50 . 2008-11-04 14:50 319 --a------ C:\WINDOWS\game.ini
2008-10-29 20:24 . 2008-10-29 20:24 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-10-27 19:29 . 2008-10-27 19:29 <REP> d-------- C:\Program Files\Hamachi
2008-10-27 19:29 . 2008-11-13 21:40 <REP> d-------- C:\Documents and Settings\Crazy\Application Data\Hamachi
2008-10-27 19:29 . 2008-10-27 19:29 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2008-10-27 18:55 . 2008-10-27 19:01 <REP> d-------- C:\Program Files\HoverIP
2008-10-27 18:40 . 2008-10-27 18:40 <REP> d-------- C:\Documents and Settings\Crazy\Application Data\Leadertech
2008-10-25 08:24 . 2008-10-25 08:24 <REP> d-------- C:\Program Files\HooTech
2008-10-25 08:24 . 2008-10-25 08:24 <REP> d-------- C:\Documents and Settings\Crazy\Application Data\HTNetMeter
2008-10-23 09:22 . 2008-11-08 13:47 682,280 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-10-20 20:05 . 2008-05-30 14:11 3,850,760 --a------ C:\WINDOWS\system32\D3DX9_38.dll
2008-10-20 20:05 . 2008-05-30 14:11 1,491,992 --a------ C:\WINDOWS\system32\D3DCompiler_38.dll
2008-10-20 20:05 . 2008-05-30 14:19 507,400 --a------ C:\WINDOWS\system32\XAudio2_1.dll
2008-10-20 20:05 . 2008-05-30 14:11 467,984 --a------ C:\WINDOWS\system32\d3dx10_38.dll
2008-10-20 20:05 . 2008-05-30 14:18 238,088 --a------ C:\WINDOWS\system32\xactengine3_1.dll
2008-10-20 20:05 . 2008-05-30 14:17 65,032 --a------ C:\WINDOWS\system32\XAPOFX1_0.dll
2008-10-20 20:05 . 2008-05-30 14:17 25,608 --a------ C:\WINDOWS\system32\X3DAudio1_4.dll
2008-10-20 20:04 . 2008-10-20 20:04 <REP> d-------- C:\WINDOWS\Logs
2008-10-20 19:52 . 2008-10-20 20:08 <REP> d-------- C:\Program Files\Âåäüìàê Äîïîëíåííîå èçäàíèå
2008-10-20 16:09 . 2008-10-20 16:09 2,915,944 --a------ C:\WINDOWS\system32\drivers\appdrv01.sys
2008-10-20 16:09 . 2008-10-20 16:09 304,528 --a------ C:\WINDOWS\system32\appdrvrem01.exe
2008-10-19 19:22 . 2008-10-26 22:46 <REP> d-------- C:\Program Files\THQ
2008-10-19 16:09 . 2008-10-27 18:37 <REP> d-------- C:\Program Files\EA Sports

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-19 18:34 --------- d-----w C:\Documents and Settings\Crazy\Application Data\Skype
2008-11-19 18:33 --------- d-----w C:\Documents and Settings\LocalService\Application Data\VMware
2008-11-19 18:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\VMware
2008-11-19 18:31 --------- d-----w C:\Program Files\FlashGet
2008-11-19 18:21 --------- d-----w C:\Documents and Settings\Crazy\Application Data\skypePM
2008-11-19 03:58 --------- d-----w C:\Program Files\Windows Live
2008-11-19 03:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-11-19 03:21 --------- d-----w C:\Program Files\XAC
2008-11-19 02:46 202,648 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-11-19 02:46 138,408 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-11-19 02:38 --------- d-----w C:\Program Files\Xfire
2008-11-18 19:24 --------- d-----w C:\Documents and Settings\Crazy\Application Data\IGN_DLM
2008-11-18 03:12 --------- d-----w C:\Documents and Settings\Crazy\Application Data\teamspeak2
2008-11-17 15:43 --------- d-----w C:\Documents and Settings\Crazy\Application Data\Xfire
2008-11-17 01:57 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-11-13 22:45 --------- d-----w C:\Program Files\Steam
2008-11-10 00:13 --------- d-----w C:\Program Files\Teamspeak2_RC2
2008-11-08 18:48 22,328 ----a-w C:\Documents and Settings\Crazy\Application Data\PnkBstrK.sys
2008-11-08 18:40 --------- d-----w C:\Program Files\Activision
2008-11-06 19:20 --------- d-----w C:\Program Files\Wakfu
2008-11-04 19:57 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-10-31 23:00 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-10-30 16:44 --------- d-----w C:\Program Files\1C Company
2008-10-18 14:41 --------- d-----w C:\Program Files\Common Files
2008-10-18 14:31 --------- d-----w C:\Program Files\gpotato
2008-10-18 14:26 --------- d-----w C:\Program Files\XoftSpySE
2008-10-17 12:04 --------- d-----w C:\Program Files\WorldOfGooDemo
2008-10-17 12:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\2DBoy
2008-10-16 14:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trymedia
2008-10-16 14:44 --------- d-----w C:\Program Files\Eidos Interactive
2008-10-14 19:00 --------- d-----w C:\Program Files\Fichiers communs\TortoiseOverlays
2008-10-14 18:59 --------- d-----w C:\Program Files\TortoiseHg
2008-10-12 17:23 --------- d-----w C:\Documents and Settings\Crazy\Application Data\VMware
2008-10-12 04:28 --------- d-----w C:\Program Files\Symantec
2008-10-12 04:27 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-10-12 02:51 --------- d-----w C:\Program Files\VMware
2008-10-11 23:24 --------- d-----w C:\Program Files\Microsoft Virtual PC
2008-10-11 19:31 --------- d-----w C:\Program Files\Skype
2008-10-11 19:31 --------- d-----w C:\Program Files\Fichiers communs\Skype
2008-10-11 19:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-10-10 16:45 --------- d-----w C:\Program Files\Dofus
2008-10-10 03:38 --------- d-----w C:\Program Files\VentSrv
2008-10-10 03:12 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-10-09 04:23 --------- d-----w C:\Program Files\CV Expert 3
2008-10-08 20:49 --------- d-----w C:\Program Files\AdventNet
2008-10-07 18:52 --------- d-----w C:\Program Files\QuickTime
2008-10-07 13:16 --------- d-----w C:\Program Files\Fichiers communs\Borland Shared
2008-10-05 22:02 --------- d-----w C:\Program Files\PlayOnline
2008-10-05 20:11 --------- d-----w C:\Program Files\NETAMIN
2008-10-05 05:01 --------- d-----w C:\Documents and Settings\Crazy\Application Data\MSN Pictures Displayer
2008-10-05 05:00 --------- d-----w C:\Program Files\MSN Pictures Displayer
2008-10-05 05:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\MSN Pictures Displayer
2008-10-05 01:54 --------- d-----w C:\Program Files\Fichiers communs\Blizzard Entertainment
2008-10-04 00:24 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-10-03 03:15 --------- d-----w C:\Documents and Settings\tester\Application Data\SmartFTP
2008-10-03 03:15 --------- d-----w C:\Documents and Settings\tester\Application Data\Nero
2008-10-03 03:15 --------- d-----w C:\Documents and Settings\tester\Application Data\ATI
2008-10-02 19:29 --------- d-----w C:\Program Files\FlashFXP
2008-10-02 19:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\FlashFXP
2008-10-02 18:41 --------- d-----w C:\Program Files\SmartFTP Client 3.0 Setup Files
2008-10-02 18:41 --------- d-----w C:\Program Files\SmartFTP Client
2008-10-02 18:41 --------- d-----w C:\Documents and Settings\Crazy\Application Data\SmartFTP
2008-10-02 05:03 --------- d-----w C:\Program Files\Ventrilo
2008-10-01 19:36 --------- d-----w C:\Program Files\TomCat Soft
2008-10-01 18:57 --------- d-----w C:\Program Files\EPSON
2008-10-01 18:57 --------- d-----w C:\Documents and Settings\LocalService\Application Data\Xfire
2008-10-01 03:17 --------- d-----w C:\Program Files\Outspark
2008-10-01 03:17 --------- d-----w C:\Program Files\Fichiers communs\DirectX
2008-09-28 02:57 --------- d-----w C:\Program Files\Microsoft.NET
2008-09-28 02:42 --------- d-----w C:\Documents and Settings\Crazy\Application Data\AdobeUM
2008-09-28 02:40 --------- d-----w C:\Program Files\Fichiers communs\Adobe Systems Shared
2008-09-28 02:40 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-09-28 02:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-09-28 02:35 --------- d-----w C:\Program Files\PDFCreator
2008-09-27 22:21 --------- d-----w C:\Program Files\mordernpaintball
2008-09-27 03:59 151,552 ----a-w C:\WINDOWS\system32\dots.exe
2008-09-26 22:52 --------- d-----w C:\Documents and Settings\Crazy\Application Data\Nero
2008-09-26 22:51 --------- d-----w C:\Program Files\Nero
2008-09-26 22:51 --------- d-----w C:\Program Files\Fichiers communs\Nero
2008-09-26 22:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-09-23 16:58 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-09-23 16:58 --------- d--h--r C:\Documents and Settings\Crazy\Application Data\SecuROM
2008-09-23 03:15 --------- d-----w C:\Program Files\Everest Poker
2008-09-23 00:59 --------- d-----w C:\Program Files\Lavalys
2008-09-22 04:54 --------- d-----w C:\Program Files\Lighthouse Interactive
2008-09-21 19:03 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-09-21 19:03 --------- d-----w C:\Documents and Settings\Crazy\Application Data\Malwarebytes
2008-09-21 19:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-19 16:20 --------- d-----w C:\Program Files\Gestion PME
2008-09-19 03:12 857,392 ----a-w C:\WINDOWS\system32\drivers\vmx86.sys
2008-09-19 03:12 54,960 ----a-w C:\WINDOWS\system32\drivers\vmci.sys
2008-09-19 03:12 32,304 ----a-w C:\WINDOWS\system32\drivers\hcmon.sys
2008-09-19 03:12 26,288 ----a-w C:\WINDOWS\system32\drivers\vmnetuserif.sys
2008-09-19 03:12 23,216 ----a-w C:\WINDOWS\system32\drivers\VMkbd.sys
2008-09-19 03:11 723,504 ----a-w C:\WINDOWS\system32\vnetlib.dll
2008-09-19 03:11 399,920 ----a-w C:\WINDOWS\system32\vmnat.exe
2008-09-19 03:11 326,192 ----a-w C:\WINDOWS\system32\vmnetdhcp.exe
2008-09-18 22:25 248,368 ----a-w C:\WINDOWS\system32\vmnc.dll
2008-09-18 20:49 55,856 ----a-r C:\WINDOWS\system32\vnetinst.dll
2008-09-18 20:49 50,736 ----a-r C:\WINDOWS\system32\vmnetbridge.dll
.

bon voila le raport de smithfraud

[b]SDFix: Version 1.240 [/b]
Run by Crazy on 2008-11-19 at 12:08

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

[b]Checking Files [/b]:

Trojan Files Found:

C:\WINDOWS\system32\drivers\TDSSmxfe.sys - Deleted
C:\WINDOWS\system32\TDSSoiuu.dll - Deleted
C:\WINDOWS\system32\TDSSkrxx.dll - Deleted
C:\WINDOWS\system32\TDSSyaqu.dll - Deleted
C:\WINDOWS\system32\TDSSnpur.dll - Deleted
C:\WINDOWS\system32\TDSSdxgp.dll - Deleted
C:\WINDOWS\system32\TDSSrpye.dat - Deleted
C:\WINDOWS\system32\TDSSakod.log - Deleted

Removing Temp Files

[b]ADS Check [/b]:

[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-19 13:18:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:96,c3,6b,aa,30,cc,0a,1b,42,9b,8a,0a,8d,26,79,3a,f8,ec,94,ed,c7,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,74,fe,f1,76,34,3b,8b,af,dc,f6,63,1d,88,d7,2a,10,1a,..
"khjeh"=hex:d2,19,d7,15,bd,74,55,3e,70,a9,20,6c,b5,7c,2f,47,03,90,e0,c4,7e,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:1e,1f,1e,06,be,52,ae,8d,27,dd,95,9a,f4,46,2d,ee,61,ee,86,d4,1c,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:96,c3,6b,aa,30,cc,0a,1b,42,9b,8a,0a,8d,26,79,3a,f8,ec,94,ed,c7,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,74,fe,f1,76,34,3b,8b,af,dc,f6,63,1d,88,d7,2a,10,1a,..
"khjeh"=hex:d2,19,d7,15,bd,74,55,3e,70,a9,20,6c,b5,7c,2f,47,03,90,e0,c4,7e,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:1e,1f,1e,06,be,52,ae,8d,27,dd,95,9a,f4,46,2d,ee,61,ee,86,d4,1c,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

[b]Remaining Services [/b]:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\\Program Files\\Xfire\\xfire.exe"="C:\\Program Files\\Xfire\\xfire.exe:*:Enabled:Xfire"
"C:\\Documents and Settings\\Crazy\\Bureau\\COD4CCDaemon\\DaemonServer.exe"="C:\\Documents and Settings\\Crazy\\Bureau\\COD4CCDaemon\\DaemonServer.exe:*:Enabled:COD4CC Daemon server"
"C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe:*:Enabled:DNA"
"C:\\Program Files\\Ubisoft\\Heroes of Might and Magic V\\bin\\H5_Game.exe"="C:\\Program Files\\Ubisoft\\Heroes of Might and Magic V\\bin\\H5_Game.exe:*:Enabled:Heroes of Might and Magic V"
"C:\\Program Files\\BPFTP Server\\G6FTPSrv.exe"="C:\\Program Files\\BPFTP Server\\G6FTPSrv.exe:*:Enabled:BPFTP Server for Internet."
"C:\\Program Files\\GTactix\\GTactix.exe"="C:\\Program Files\\GTactix\\GTactix.exe:*:Enabled:Gtactix"
"C:\\Program Files\\FlashGet\\FlashGet.exe"="C:\\Program Files\\FlashGet\\FlashGet.exe:*:Enabled:Flashget"
"C:\\Program Files\\Outspark\\Blackshot\\System\\BlackShot.exe"="C:\\Program Files\\Outspark\\Blackshot\\System\\BlackShot.exe:*:Enabled:BlackShot"
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"="C:\\Program Files\\SmartFTP Client\\SmartFTP.exe:*:Enabled:SmartFTP Client 3.0"
"C:\\Program Files\\FlashFXP\\FlashFXP.exe"="C:\\Program Files\\FlashFXP\\FlashFXP.exe:*:Enabled:FlashFXP v3"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\NETAMIN\\Real Baseball\\game\\RealBaseball.exe"="C:\\Program Files\\NETAMIN\\Real Baseball\\game\\RealBaseball.exe:*:Enabled:Cal Ripken's Real Baseball"
"C:\\Program Files\\NETAMIN\\Real Baseball\\patcher\\fc.exe"="C:\\Program Files\\NETAMIN\\Real Baseball\\patcher\\fc.exe:*:Enabled:Cal Ripken's Real Baseball SysAnalyzer"
"C:\\Program Files\\AdventNet\\ME\\OpManager\\apache\\bin\\Apache.exe"="C:\\Program Files\\AdventNet\\ME\\OpManager\\apache\\bin\\Apache.exe:*:Enabled:Apache HTTP Server"
"C:\\Program Files\\AdventNet\\ME\\OpManager\\jre\\bin\\java.exe"="C:\\Program Files\\AdventNet\\ME\\OpManager\\jre\\bin\\java.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"C:\\Documents and Settings\\Crazy\\Bureau\\XIII MP Package\\XIII\\system\\XIII.exe"="C:\\Documents and Settings\\Crazy\\Bureau\\XIII MP Package\\XIII\\system\\XIII.exe:*:Enabled:XIII"
"C:\\Program Files\\VentSrv\\ventrilo_srv.exe"="C:\\Program Files\\VentSrv\\ventrilo_srv.exe:*:Enabled:ventrilo_srv"
"C:\\Program Files\\VMware\\VMware Workstation\\vmware-authd.exe"="C:\\Program Files\\VMware\\VMware Workstation\\vmware-authd.exe:*:Enabled:VMware Authd"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"G:\\JEUX\\Medal of Honor\\moh_Breakthrough_server.exe"="G:\\JEUX\\Medal of Honor\\moh_Breakthrough_server.exe:*:Enabled:Medal of Honor Allied Assault(tm) Breakthrough"
"C:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"="C:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe:*:Enabled:RelicCOH"
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"="C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe:*:Enabled:Assistance … distance - Windows Messenger et voix"
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"="C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) "
"C:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"="C:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe:*:Enabled:Call of Duty(R) - World at War(TM) "
"C:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"="C:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe:*:Enabled:Call of Duty(R) - World at War(TM) "
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\FlashFXP\\FlashFXP.exe"="C:\\Program Files\\FlashFXP\\FlashFXP.exe:*:Enabled:FlashFXP v3"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:

File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Thu 28 Aug 2008 2,509,543,414 A..H. --- "C:\Program Files\NCsoft\Tabula Rasa (PTS)\BIT34E.tmp"
Thu 28 Aug 2008 99,527,965 A..H. --- "C:\Program Files\NCsoft\Tabula Rasa\data\BIT28C.tmp"
Thu 28 Aug 2008 99,527,965 A..H. --- "C:\Program Files\NCsoft\Tabula Rasa (PTS)\data\BIT2BB.tmp"
Thu 19 Aug 2004 28,000 ..SH. --- "C:\WINDOWS\Fonts\syn00-50-56-C0-00-08\system\smss.exe"
Sat 11 Oct 2008 165,232 A..H. --- "C:\Documents and Settings\Crazy\Application Data\Microsoft\Virtual PC\VPCKeyboard.dll"
Wed 12 Nov 2008 4,836 ...HR --- "C:\Documents and Settings\Crazy\Application Data\SecuROM\UserData\securom_v7_01.bak"

[b]Finished![/b]

Et le Raport de Hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:24:02, on 2008-11-19
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\VentSrv\ventrilo_svc.exe
C:\Program Files\VentSrv\ventrilo_srv.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\FlashGet\flashget.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HooTech\NetMeter\HooNetMeter.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.ca
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.ca
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ca
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo R220 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE /P30 "EPSON Stylus Photo R220 Series" /O6 "USB001" /M "Stylus Photo R220"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NetMeter] C:\Program Files\HooTech\NetMeter\HooNetMeter.exe
O4 - Startup: MSN Pictures Displayer.lnk = C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O8 - Extra context menu item: &Tout télécharger avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O10 - Broken Internet access because of LSP provider 'c:\program files\vmware\vmware workstation\vsocklib.dll' missing
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.systemrequirementslab.com/cyri
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://plugin.driveragent.com/files/driveragent.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: VMware Agent Service (ufad-ws60) - Unknown owner - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe (file missing)
O23 - Service: Ventrilo - Unknown owner - C:\Program Files\VentSrv\ventrilo_svc.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe

non pcq comem aj i dit la premiere parti en mode sans echec et je suis rendu la

Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.

la sa demare sur mon systeme normal mais sans rien juste l arriere plan et une fenetre qui dit que sa peut prendre plusieur minute mais sa fait 2 heure sa roule et sa continue -_- je demandais juste si c etais normal sa soit si long que sa :P

et bien si tu as un rapport a fournir.................................!!!!!!!!!!!!!!!

je l ai downloader a partir d un autre ordi pas de cle usb , pas de msn , pas de reseau -_- jai fait passr par Xfire :P

bon sa fait plusieur heure que le programme roule ce normal sa soit si long ??

Ps:la premiere parti en mode sans echec es fait

ah...moi le lien me demande si je veux executer ou enregistrer.......2ième solution est au top

oki desole pour le temps jai mis a lire ton post mais jetais parti me coucher il etais 0h00 passer ;)

bon le lien que tu ma donner j arrive pas a le downloader

sa me donne

La connexion avec le serveur a été réinitialisée pendant le chargement de la page.

La liaison au réseau a été interrompue pendant la négociation d'une connexion. Veuillez réessayer.

Imprime ces instructions car tu n'y auras pas accès durant le passage en mode sans échec.
Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
ça peut prendre un peu de temps. Tu verras seulement un tiret blanc qui apparaît-disparaît.
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le scrïpt.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du scrïpt et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

SmitFraudFix v2.375

Rapport fait à 23:57:03,50, 2008-11-18
Executé à partir de C:\Documents and Settings\Crazy\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\FlashGet\flashget.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HooTech\NetMeter\HooNetMeter.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\VentSrv\ventrilo_svc.exe
C:\Program Files\VentSrv\ventrilo_srv.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\installer\WLSetupSvc.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Crazy\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Crazy

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Crazy\LOCALS~1\Temp

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Crazy\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Crazy\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Attansic L1 Gigabit Ethernet 10/100/1000Base-T Controller - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.0.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{C684C7DA-864D-411E-92BA-C2F16A44CAD3}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C684C7DA-864D-411E-92BA-C2F16A44CAD3}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{C684C7DA-864D-411E-92BA-C2F16A44CAD3}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin