BV:AutoRun-E [Wrm]

Résolu
sofie353 -  
Bonjour,
Voici un virus repéré par Avast: BV:AutoRun-E [Wrm].
Comment faire pour le supprimer?
Dois-je le supprimer?
Merci d'avance!
Configuration: Windows XP
Internet Explorer 7.0

49 réponses

Résumé de la discussion

BV:AutoRun-E [Wrm] est identifié comme un virus par Avast et concerne une infection sur un PC Windows XP avec Internet Explorer 7, suscitant des questionnements sur la suppression et la nécessité d'agir. Plusieurs conseils techniques apparaissent, incluant l'utilisation de HiJackThis pour identifier des traces et un éventuel outil de réparation fourni via Navilog1.exe, sous forme d'instructions pas à pas. En cas d'analyse, un extrait long de HiJackThis montre de nombreuses entrées système et services actifs, illustrant la complexité de l'infection et la prudence nécessaire lors de l'exécution d'outils externes. D'autres éléments mentionnent des outils potentiels douteux et des configurations malveillantes, comme des redirections et des programmes de contrôle, nécessitant une vérification du système et des sauvegardes récentes.

Bobot (l’IA à votre service)
  1. chimay8 Contributeur sécurité
    c'est pas chiquitine29, c'est chiquitine1664
    3. jlpjlp Contributeur sécurité
      zut encore un cas pas assez difficile pour chiquitine29 !

      et pourtant
      sofie353 y avait mis le paquet :)

      encore bravo!
      3. sofie353
        Ca y est j'ai plus rien???
        Trop cool merci beaucoup!
        Certains outils que j'avais perdu sont réapparut (comme la barre qui indique le niveau du volume...), ou le nettoyage du disque qui ne voulait plus s'ouvrir...!
        Encore une fois merci bcp!
        2. sofie353
          [ Rapport ToolsCleaner version 2.2.6 (par A.Rothstein & dj QUIOU) ]

          -->- Recherche:

          C:\fixnavi.txt: trouvé !
          C:\cleannavi.txt: trouvé !
          C:\UsbFix.txt: trouvé !
          C:\SDFIX: trouvé !
          C:\Combofix: trouvé !
          C:\Qoobox: trouvé !
          C:\_OtMoveIt: trouvé !
          C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: trouvé !
          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: trouvé !
          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: trouvé !
          C:\Documents and Settings\Sophie Chantrel\Bureau\HijackThis.exe: trouvé !
          C:\Documents and Settings\Sophie Chantrel\Bureau\UsbFix.exe: trouvé !
          C:\Documents and Settings\Sophie Chantrel\Bureau\UsbFix.lnk: trouvé !
          C:\Documents and Settings\Sophie Chantrel\Bureau\OTMoveIt3.exe: trouvé !
          C:\Documents and Settings\Sophie Chantrel\Bureau\SmitFraudfix: trouvé !
          C:\Documents and Settings\Sophie Chantrel\Menu Démarrer\Programmes\UsbFix: trouvé !
          C:\Documents and Settings\Sophie Chantrel\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: trouvé !
          C:\Documents and Settings\Sophie Chantrel\Recent\HijackThis.lnk: trouvé !
          C:\Program Files\Navilog1: trouvé !
          C:\Program Files\UsbFix: trouvé !
          C:\Program Files\Navilog1\Navilog1.bat: trouvé !
          C:\Program Files\UsbFix\UsbFix.exe: trouvé !
          C:\WINDOWS\msnfix.txt: trouvé !

          ---------------------------------
          -->- Suppression:

          C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: supprimé !
          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: supprimé !
          C:\Documents and Settings\Sophie Chantrel\Bureau\HijackThis.exe: supprimé !
          C:\Documents and Settings\Sophie Chantrel\Recent\HijackThis.lnk: supprimé !
          C:\Program Files\Navilog1\Navilog1.bat: supprimé !
          C:\fixnavi.txt: supprimé !
          C:\cleannavi.txt: supprimé !
          C:\UsbFix.txt: supprimé !
          C:\Documents and Settings\Sophie Chantrel\Bureau\UsbFix.exe: supprimé !
          C:\Documents and Settings\Sophie Chantrel\Bureau\UsbFix.lnk: supprimé !
          C:\Documents and Settings\Sophie Chantrel\Bureau\OTMoveIt3.exe: supprimé !
          C:\Documents and Settings\Sophie Chantrel\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: supprimé !
          C:\Program Files\UsbFix\UsbFix.exe: supprimé !
          C:\WINDOWS\msnfix.txt: supprimé !
          C:\SDFIX: supprimé !
          C:\Combofix: supprimé !
          C:\Qoobox: supprimé !
          C:\_OtMoveIt: supprimé !
          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: supprimé !
          C:\Documents and Settings\Sophie Chantrel\Bureau\SmitFraudfix: supprimé !
          C:\Documents and Settings\Sophie Chantrel\Menu Démarrer\Programmes\UsbFix: supprimé !
          C:\Program Files\Navilog1: supprimé !
          C:\Program Files\UsbFix: supprimé !

          Fichiers temporaires nettoyés !
          2. sofie353
            C'est bon en fait!

            [ Rapport ToolsCleaner version 2.2.6 (par A.Rothstein & dj QUIOU) ]

            -->- Recherche:

            C:\fixnavi.txt: trouvé !
            C:\cleannavi.txt: trouvé !
            C:\UsbFix.txt: trouvé !
            C:\SDFIX: trouvé !
            C:\Combofix: trouvé !
            C:\Qoobox: trouvé !
            C:\_OtMoveIt: trouvé !
            C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: trouvé !
            C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: trouvé !
            C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: trouvé !
            C:\Documents and Settings\Sophie Chantrel\Bureau\HijackThis.exe: trouvé !
            C:\Documents and Settings\Sophie Chantrel\Bureau\UsbFix.exe: trouvé !
            C:\Documents and Settings\Sophie Chantrel\Bureau\UsbFix.lnk: trouvé !
            C:\Documents and Settings\Sophie Chantrel\Bureau\OTMoveIt3.exe: trouvé !
            C:\Documents and Settings\Sophie Chantrel\Bureau\SmitFraudfix: trouvé !
            C:\Documents and Settings\Sophie Chantrel\Menu Démarrer\Programmes\UsbFix: trouvé !
            C:\Documents and Settings\Sophie Chantrel\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: trouvé !
            C:\Documents and Settings\Sophie Chantrel\Recent\HijackThis.lnk: trouvé !
            C:\Program Files\Navilog1: trouvé !
            C:\Program Files\UsbFix: trouvé !
            C:\Program Files\Navilog1\Navilog1.bat: trouvé !
            C:\Program Files\UsbFix\UsbFix.exe: trouvé !
            C:\WINDOWS\msnfix.txt: trouvé !
            2. sofie353
              J'ai un souci, Toolscleaner2.exe ne veut pas s'ouvrir, voici le message: "n'est pas une application Win 32 valide"
              1. Utilisateur anonyme
                bon c est nettoyé

                on va affiner

                réouvre hijackthis
                fais scan only
                coches ces lignes :

                R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC

                R3 - Default URLSearchHook is missing
                O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)

                O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

                O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

                O4 - Startup: Rainlendar.lnk = ?
                O4 - Startup: SM.lnk = C:\Program Files\SM\skymessnet.exe
                O4 - Global Startup: hp psc 1000 series.lnk = ?
                O4 - Global Startup: hpoddt01.exe.lnk = ?

                O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites

                O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
                O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

                tu les coches et tu clic sur fix checked

                ensuite :

                Démarrer > executer > tape : services.msc

                - Clic droit sur le service cité - Planificateur LiveUpdate automatique
                - propriétés
                - et dans "type de démarrage" et mets le sur « désactivé ».
                - Ensuite si le "Status du service" est sur "Démarré" faire : « arrêté »

                Tutorial : https://www.zebulon.fr/dossiers/windows/31-services.html

                ensuite :

                regarde ceci concernant avast :

                antivir vs avast :

                -> http://forum.malekal.com/ftopic3528.php

                alors je te conseille de le desinstaller et d´installer antivir a la place

                Telecharge et instales l'antivirus Antivir Personal Edition Classic :

                ->Antivir le telecharger

                tuto : https://www.malekal.com/avira-free-security-antivirus-gratuit/
                tuto : http://www.swl1f.net/viewtopic.php?f=14&t=59

                Pour désinstaller Avast telecharge cet outil

                ensuite :

                -> Télécharge Ccleaner (n'installe pas la barre d'outil Yahoo):

                http://download.piriform.com/ccsetup210.exe

                https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

                -> Tuto : https://www.malekal.com/tutoriel-ccleaner/

                ensuite :

                * pour supprimer les outils/fix utilisés :

                Télécharge ToolsCleaner sur ton bureau.
                -->
                http://pc-system.fr/
                http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner

                # Clique sur Recherche et laisse le scan agir ...
                # Clique sur Suppression pour finaliser.
                # Tu peux, si tu le souhaites, te servir des Options facultatives.
                # Clique sur Quitter pour obtenir le rapport.
                # Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

                Désactive et réactive ta restauration system :

                (1) Désactiver la Restauration du système

                cliques sur Démarrer
                Cliques droit sur Poste de travail
                cliques sur Propriétés
                Cliques sur l'onglet Restauration du système
                Coches Désactiver la Restauration du système sur tous les lecteurs
                Cliques sur Appliquer, Lorsque le message de confirmation apparaît,
                cliques sur Oui.
                Cliques sur OK.

                (2) Activer la Restauration du système

                cliques sur Démarrer
                Cliques droit sur Poste de travail
                cliques sur Propriétés
                Cliques sur l'onglet Restauration du système
                Décoches Désactiver la Restauration du système sur tous les lecteurs
                Cliques sur Appliquer, Lorsque le message de confirmation apparaît,
                cliques sur Oui.
                Cliques sur OK.

                Tuto xp : http://service1.symantec.com/support/inter/tsgeninfointl.Nsf/fr_docid/20020830101856924

                1. sofie353
                  je restaure quand même le système?
              2. sofie353
                Logfile of Trend Micro HijackThis v2.0.2
                Scan saved at 20:25:21, on 2008-11-26
                Platform: Windows XP SP2 (WinNT 5.01.2600)
                MSIE: Internet Explorer v7.00 (7.00.6000.16735)
                Boot mode: Normal

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                C:\Program Files\Alwil Software\Avast4\ashServ.exe
                C:\WINDOWS\system32\spoolsv.exe
                C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
                C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                C:\Program Files\Bonjour\mDNSResponder.exe
                C:\WINDOWS\eHome\ehRecvr.exe
                C:\WINDOWS\eHome\ehSched.exe
                C:\WINDOWS\System32\GEARSec.exe
                C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                C:\WINDOWS\system32\svchost.exe
                C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
                C:\WINDOWS\Explorer.EXE
                C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
                C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
                C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
                C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                C:\WINDOWS\system32\dllhost.exe
                C:\Program Files\Apoint\Apoint.exe
                C:\WINDOWS\ehome\ehtray.exe
                C:\WINDOWS\eHome\ehmsas.exe
                C:\WINDOWS\system32\ICO.EXE
                C:\Program Files\Apoint\Apntex.exe
                C:\WINDOWS\system32\hkcmd.exe
                C:\WINDOWS\system32\igfxpers.exe
                C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
                C:\Program Files\Sony\ISB Utility\ISBMgr.exe
                C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
                C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
                C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
                C:\WINDOWS\System32\svchost.exe
                C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
                C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
                C:\Program Files\iTunes\iTunesHelper.exe
                C:\WINDOWS\system32\ctfmon.exe
                C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
                C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
                C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
                C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
                C:\WINDOWS\system32\wuauclt.exe
                C:\Program Files\Rainlendar\Rainlendar.exe
                C:\Program Files\SM\skymessnet.exe
                C:\Program Files\Internet Explorer\iexplore.exe
                C:\Program Files\OpenOffice.org 3\program\soffice.exe
                C:\Program Files\OpenOffice.org 3\program\soffice.bin
                C:\Program Files\iPod\bin\iPodService.exe
                C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
                C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                C:\WINDOWS\system32\wuauclt.exe
                C:\WINDOWS\system32\wbem\wmiapsrv.exe
                C:\Program Files\Windows Live\Messenger\usnsvc.exe
                C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
                C:\Documents and Settings\Sophie Chantrel\Bureau\HiJackThis.exe

                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
                R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                R3 - Default URLSearchHook is missing
                O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
                O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
                O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
                O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\PROGRA~1\GOOGLE~1\BAE.dll (file missing)
                O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
                O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
                O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
                O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
                O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
                O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
                O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
                O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
                O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
                O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
                O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
                O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
                O4 - HKLM\..\Run: [SonyPowerCfg] "C:\Program Files\Sony\VAIO Power Management\SPMgr.exe"
                O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
                O4 - HKLM\..\Run: [Switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
                O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
                O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
                O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
                O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
                O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
                O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdyvp.exe] C:\WINDOWS\system32\kdyvp.exe
                O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                O4 - HKCU\..\Run: [DesktopX] "C:\PROGRA~1\Stardock\OBJECT~1\DesktopX\DesktopX Builder.exe" -noui
                O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
                O4 - HKCU\..\Run: [VeohPlugin] "C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
                O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                O4 - Startup: MSN Pictures Displayer.lnk = C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
                O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
                O4 - Startup: Rainlendar.lnk = ?
                O4 - Startup: SM.lnk = C:\Program Files\SM\skymessnet.exe
                O4 - Global Startup: hp psc 1000 series.lnk = ?
                O4 - Global Startup: hpoddt01.exe.lnk = ?
                O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                O8 - Extra context menu item: Ajouter un site de support RSS à VAIO Information FLOW - C:\Program Files\Sony\VAIO Information FLOW\aiesc.html
                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
                O8 - Extra context menu item: Transfert par Image Converter 2 Plus - C:\Program Files\Sony\Image Converter 2\menu.htm
                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/fr/
                O15 - Trusted Zone: *.sony-europe.com
                O15 - Trusted Zone: *.sonystyle-europe.com
                O15 - Trusted Zone: *.vaio-link.com
                O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
                O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
                O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
                O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
                O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
                O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
                O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
                O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
                O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
                O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\Avlib\SSScsiSV.exe
                O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
                O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
                O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
                O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
                O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
                O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
                O23 - Service: VAIO Cooporated Initialisation (VCI) - Sony Corporation - C:\Program Files\Sony\VAIO Cooperated Initialisation\VCI_SVC.exe
                O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
                O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
                O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
                1. Utilisateur anonyme
                  hé sofie ,

                  j y croyais plus -;)

                  désinstal norton :

                  pour désinstaller norton proprement telecharge cet outil

                  http://service1.symantec.com/support/inter/tsgeninfointl.nsf/fr_docid/20050414110429924?OpenDocument&seg=hm&lg=fr&ct=fr

                  ensuite refais un scan hijackthis et pos le rapport stp
                  1. sofie353
                    ========== PROCESSES ==========
                    Process explorer.exe killed successfully.
                    ========== FILES ==========
                    File/Folder C:\WINDOWS\system32\kdyvp.exe not found.
                    C:\Program Files\SweetIM\Messenger moved successfully.
                    C:\Program Files\SweetIM moved successfully.
                    ========== COMMANDS ==========
                    File delete failed. C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\Acr9E33.tmp scheduled to be deleted on reboot.
                    File delete failed. C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\Acr9E35.tmp scheduled to be deleted on reboot.
                    File delete failed. C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\Perflib_Perfdata_6e4.dat scheduled to be deleted on reboot.
                    File delete failed. C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\Perflib_Perfdata_acc.dat scheduled to be deleted on reboot.
                    File delete failed. C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\Perflib_Perfdata_b0c.dat scheduled to be deleted on reboot.
                    File delete failed. C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\Perflib_Perfdata_b50.dat scheduled to be deleted on reboot.
                    File delete failed. C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\~DF7C3C.tmp scheduled to be deleted on reboot.
                    File delete failed. C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\~DFA12A.tmp scheduled to be deleted on reboot.
                    File delete failed. C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\~DFA720.tmp scheduled to be deleted on reboot.
                    File delete failed. C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\~DFA748.tmp scheduled to be deleted on reboot.
                    File delete failed. C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\~DFB778.tmp scheduled to be deleted on reboot.
                    File delete failed. C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\~DFB78E.tmp scheduled to be deleted on reboot.
                    File delete failed. C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\~DFC056.tmp scheduled to be deleted on reboot.
                    File delete failed. C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\~DFC07D.tmp scheduled to be deleted on reboot.
                    File delete failed. C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\~WRF0001.tmp scheduled to be deleted on reboot.
                    User's Temp folder emptied.
                    User's Temporary Internet Files folder emptied.
                    User's Internet Explorer cache folder emptied.
                    Local Service Temp folder emptied.
                    File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
                    Local Service Temporary Internet Files folder emptied.
                    File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
                    File delete failed. C:\WINDOWS\temp\JETD10B.tmp scheduled to be deleted on reboot.
                    File delete failed. C:\WINDOWS\temp\JETD1C7.tmp scheduled to be deleted on reboot.
                    File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_398.dat scheduled to be deleted on reboot.
                    File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_604.dat scheduled to be deleted on reboot.
                    Windows Temp folder emptied.
                    Java cache emptied.
                    FireFox cache emptied.
                    Temp folders emptied.
                    Explorer started successfully

                    OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 11262008_194916

                    Files moved on Reboot...
                    C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\Acr9E33.tmp moved successfully.
                    C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\Acr9E35.tmp moved successfully.
                    File C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\Perflib_Perfdata_6e4.dat not found!
                    File C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\Perflib_Perfdata_acc.dat not found!
                    File C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\Perflib_Perfdata_b0c.dat not found!
                    File C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\Perflib_Perfdata_b50.dat not found!
                    C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\~DF7C3C.tmp moved successfully.
                    C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\~DFA12A.tmp moved successfully.
                    File C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\~DFA720.tmp not found!
                    File C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\~DFA748.tmp not found!
                    File C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\~DFB778.tmp not found!
                    File C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\~DFB78E.tmp not found!
                    File C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\~DFC056.tmp not found!
                    File C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\~DFC07D.tmp not found!
                    File C:\DOCUME~1\SOPHIE~1\LOCALS~1\Temp\~WRF0001.tmp not found!
                    File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
                    File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
                    File C:\WINDOWS\temp\JETD10B.tmp not found!
                    File C:\WINDOWS\temp\JETD1C7.tmp not found!
                    C:\WINDOWS\temp\Perflib_Perfdata_398.dat moved successfully.
                    File C:\WINDOWS\temp\Perflib_Perfdata_604.dat not found!
                    1. Utilisateur anonyme
                      réouvre malewarebyte
                      va sur quarantaine
                      supprime tout

                      ---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :
                      http://oldtimer.geekstogo.com/OTMoveIt3.exe

                      ---> Double-clique sur OTMoveIt3.exe afin de le lancer.

                      ---> Copie (Ctrl+C) le texte suivant ci-dessous :

                      :processes
                      explorer.exe

                      :files
                      C:\WINDOWS\system32\kdyvp.exe
                      C:\Program Files\SweetIM

                      :commands
                      [emptytemp]
                      [start explorer]
                      [reboot]

                      ---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

                      ---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

                      Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
                      Accepte en cliquant sur YES.

                      ---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
                      Le nom du rapport correspond au moment de sa création : date_heure.log
                      1. sofie353 Auteur
                        Malwarebytes' Anti-Malware 1.30
                        Version de la base de données: 1422
                        Windows 5.1.2600 Service Pack 2

                        2008-11-25 18:15:52
                        mbam-log-2008-11-25 (18-15-52).txt

                        Type de recherche: Examen complet (C:\|D:\|)
                        Eléments examinés: 150115
                        Temps écoulé: 1 hour(s), 1 minute(s), 58 second(s)

                        Processus mémoire infecté(s): 0
                        Module(s) mémoire infecté(s): 0
                        Clé(s) du Registre infectée(s): 20
                        Valeur(s) du Registre infectée(s): 0
                        Elément(s) de données du Registre infecté(s): 13
                        Dossier(s) infecté(s): 25
                        Fichier(s) infecté(s): 62

                        Processus mémoire infecté(s):
                        (Aucun élément nuisible détecté)

                        Module(s) mémoire infecté(s):
                        (Aucun élément nuisible détecté)

                        Clé(s) du Registre infectée(s):
                        HKEY_CLASSES_ROOT\CLSID\{1962c5bc-e475-465b-823b-133e711bceb9} (Adware.Starware) -> Quarantined and deleted successfully.
                        HKEY_CLASSES_ROOT\CLSID\{5f90c0e3-4c0a-4d54-a8ac-5afe6163a99e} (Adware.Starware) -> Quarantined and deleted successfully.
                        HKEY_CLASSES_ROOT\CLSID\{ab3dfa03-f743-4302-81dd-c370bffeca23} (Adware.Starware) -> Quarantined and deleted successfully.
                        HKEY_CLASSES_ROOT\CLSID\{e550dc77-ef3b-474f-b59c-b3e2aa1fa6a5} (Adware.Starware) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3e720452-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1962c5bc-e475-465b-823b-133e711bceb9} (Adware.Starware) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5f90c0e3-4c0a-4d54-a8ac-5afe6163a99e} (Adware.Starware) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1962c5bc-e475-465b-823b-133e711bceb9} (Adware.Starware) -> Quarantined and deleted successfully.
                        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\starware370 (Adware.Starware) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\starware370 (Adware.Starware) -> Quarantined and deleted successfully.

                        Valeur(s) du Registre infectée(s):
                        (Aucun élément nuisible détecté)

                        Elément(s) de données du Registre infecté(s):
                        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System (Rootkit.DNSChanger.H) -> Data: kdyvp.exe -> Quarantined and deleted successfully.
                        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{07d7e714-13c0-4f8a-ac41-7cca07050b9d}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.114;85.255.112.14 -> Delete on reboot.
                        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{07d7e714-13c0-4f8a-ac41-7cca07050b9d}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.114;85.255.112.14 -> Delete on reboot.
                        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{3f7c65e8-4635-4116-afb0-aa2bad451a29}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.114;85.255.112.14 -> Quarantined and deleted successfully.
                        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{3f7c65e8-4635-4116-afb0-aa2bad451a29}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.114;85.255.112.14 -> Quarantined and deleted successfully.
                        HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{07d7e714-13c0-4f8a-ac41-7cca07050b9d}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.114;85.255.112.14 -> Delete on reboot.
                        HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{07d7e714-13c0-4f8a-ac41-7cca07050b9d}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.114;85.255.112.14 -> Delete on reboot.
                        HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{3f7c65e8-4635-4116-afb0-aa2bad451a29}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.114;85.255.112.14 -> Quarantined and deleted successfully.
                        HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{3f7c65e8-4635-4116-afb0-aa2bad451a29}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.114;85.255.112.14 -> Quarantined and deleted successfully.
                        HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{07d7e714-13c0-4f8a-ac41-7cca07050b9d}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.114;85.255.112.14 -> Quarantined and deleted successfully.
                        HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{07d7e714-13c0-4f8a-ac41-7cca07050b9d}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.114;85.255.112.14 -> Quarantined and deleted successfully.
                        HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{3f7c65e8-4635-4116-afb0-aa2bad451a29}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.114;85.255.112.14 -> Quarantined and deleted successfully.
                        HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{3f7c65e8-4635-4116-afb0-aa2bad451a29}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.114;85.255.112.14 -> Quarantined and deleted successfully.

                        Dossier(s) infecté(s):
                        C:\Program Files\Starware370 (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Program Files\Starware370\bin (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Program Files\Starware370\icons (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370 (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\buttons (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\contexts (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\SimpleUpdate (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370 (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\BrowserSearch (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Button_6 (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Button_7 (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Button_8 (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Configurator (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\ErrorSearch (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Layouts (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Manager (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Paroles (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Radio_FR (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Recherche_de_musique (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\RelatedSearch (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Telechargement (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Toolbar (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\ToolbarLogo (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\ToolbarSearch (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\TravelSearch (Adware.Starware) -> Quarantined and deleted successfully.

                        Fichier(s) infecté(s):
                        C:\WINDOWS\system32\kdyvp.exe (Rootkit.DNSChanger.H) -> Delete on reboot.
                        C:\Program Files\Starware370\Starware370Config.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Program Files\Starware370\Starware370Uninstall.exe (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Program Files\Starware370\icons\star_16.ico (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\buttons\563_button_1b_def.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\buttons\563_button_1b_over.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\buttons\572_button_1b_def.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\buttons\572_button_1b_over.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\buttons\573_button_1b_def.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\buttons\573_button_1b_over.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\buttons\Button_60.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\buttons\Button_70.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\buttons\Button_80.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\buttons\FindIt.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\buttons\FindItHot.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\buttons\findithotxp.png (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\buttons\finditxp.png (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\buttons\logo.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\buttons\logoxp.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\contexts\error.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\contexts\Related.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\contexts\Travel.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\SimpleUpdate\ProductMessagingConfig.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\SimpleUpdate\ProductMessagingConfig.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\SimpleUpdate\SimpleUpdateConfig.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\SimpleUpdate\SimpleUpdateConfig.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\SimpleUpdate\TimerManagerConfig.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\All Users\Application Data\Starware370\SimpleUpdate\TimerManagerConfig.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\BrowserSearch\BrowserSearch.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\BrowserSearch\BrowserSearch.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Button_6\Button_6Options.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Button_6\Button_6Options.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Button_7\Button_7Options.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Button_7\Button_7Options.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Button_8\Button_8Options.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Button_8\Button_8Options.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Configurator\Configurator.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Configurator\Configurator.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\ErrorSearch\ErrorSearchOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\ErrorSearch\ErrorSearchOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Layouts\ToolbarLayout.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Layouts\ToolbarLayout.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Manager\ManagerOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Manager\ManagerOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Paroles\ParolesOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Paroles\ParolesOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Radio_FR\Radio_FROptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Radio_FR\Radio_FROptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Recherche_de_musique\Recherche_de_musiqueOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Recherche_de_musique\Recherche_de_musiqueOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\RelatedSearch\RelatedSearchOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\RelatedSearch\RelatedSearchOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Telechargement\TelechargementOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Telechargement\TelechargementOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Toolbar\TBProductsOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\Toolbar\TBProductsOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\ToolbarLogo\ToolbarLogoOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\ToolbarLogo\ToolbarLogoOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\ToolbarSearch\ToolbarSearchOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\ToolbarSearch\ToolbarSearchOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\TravelSearch\TravelSearchOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Sophie Chantrel\Application Data\Starware370\TravelSearch\TravelSearchOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                        1. Utilisateur anonyme
                          Telecharge malwarebytes

                          Tu l´instale; le programme va se mettre automatiquement a jour.

                          Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

                          Click maintenant sur l´onglet recherche et coche la case : "executer un examen complet".

                          Puis click sur "rechercher".

                          Laisse le scanner le pc...

                          Si des elements on ete trouvés > click sur supprimer la selection.

                          si il t´es demandé de redemarrer > click sur "yes".

                          A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.
                          Copie et colle le rapport stp.

                          PS : les rapport sont aussi rangé dans l onglet rapport/log
                          1. sofie353 Auteur
                            Logfile of Trend Micro HijackThis v2.0.2
                            Scan saved at 16:56:08, on 2008-11-25
                            Platform: Windows XP SP2 (WinNT 5.01.2600)
                            MSIE: Internet Explorer v7.00 (7.00.6000.16735)
                            Boot mode: Normal

                            Running processes:
                            C:\WINDOWS\system32\csrss.exe
                            C:\WINDOWS\system32\winlogon.exe
                            C:\WINDOWS\system32\services.exe
                            C:\WINDOWS\system32\lsass.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                            C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
                            C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                            C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
                            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                            C:\Program Files\Alwil Software\Avast4\ashServ.exe
                            C:\WINDOWS\system32\spoolsv.exe
                            C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
                            C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                            C:\Program Files\Bonjour\mDNSResponder.exe
                            C:\WINDOWS\eHome\ehRecvr.exe
                            C:\WINDOWS\eHome\ehSched.exe
                            C:\WINDOWS\System32\GEARSec.exe
                            C:\Program Files\Norton Ghost\Agent\VProSvc.exe
                            C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                            C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
                            C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
                            C:\WINDOWS\system32\igfxext.exe
                            C:\WINDOWS\system32\igfxsrvc.exe
                            C:\WINDOWS\ehome\mcrdsvc.exe
                            C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
                            C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
                            C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                            C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                            C:\WINDOWS\system32\dllhost.exe
                            C:\WINDOWS\System32\alg.exe
                            C:\Program Files\Apoint\Apoint.exe
                            C:\WINDOWS\ehome\ehtray.exe
                            C:\WINDOWS\system32\ICO.EXE
                            C:\WINDOWS\system32\hkcmd.exe
                            C:\Program Files\Apoint\Apntex.exe
                            C:\WINDOWS\system32\igfxpers.exe
                            C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
                            C:\Program Files\Sony\ISB Utility\ISBMgr.exe
                            C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
                            C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
                            C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
                            C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
                            C:\Program Files\Norton Ghost\Agent\GhostTray.exe
                            C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
                            C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                            C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                            C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
                            C:\Program Files\iTunes\iTunesHelper.exe
                            C:\WINDOWS\system32\ctfmon.exe
                            C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                            C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
                            C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
                            C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
                            C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
                            C:\Program Files\Rainlendar\Rainlendar.exe
                            C:\Program Files\SM\skymessnet.exe
                            C:\Program Files\OpenOffice.org 3\program\soffice.exe
                            C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
                            C:\Program Files\OpenOffice.org 3\program\soffice.bin
                            C:\Program Files\iPod\bin\iPodService.exe
                            C:\WINDOWS\system32\wbem\wmiapsrv.exe
                            C:\WINDOWS\system32\wuauclt.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\Program Files\Windows Live\Messenger\usnsvc.exe
                            C:\WINDOWS\explorer.exe
                            C:\Program Files\Internet Explorer\iexplore.exe
                            C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                            C:\Documents and Settings\Sophie Chantrel\Bureau\HiJackThis.exe
                            C:\WINDOWS\system32\wbem\wmiprvse.exe

                            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
                            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
                            R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                            R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                            R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                            R3 - Default URLSearchHook is missing
                            O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
                            O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                            O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                            O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
                            O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
                            O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\PROGRA~1\GOOGLE~1\BAE.dll (file missing)
                            O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
                            O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
                            O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
                            O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
                            O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
                            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                            O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
                            O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
                            O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
                            O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
                            O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
                            O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
                            O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
                            O4 - HKLM\..\Run: [SonyPowerCfg] "C:\Program Files\Sony\VAIO Power Management\SPMgr.exe"
                            O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
                            O4 - HKLM\..\Run: [Switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
                            O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
                            O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
                            O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
                            O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
                            O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
                            O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                            O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
                            O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
                            O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                            O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdyvp.exe] C:\WINDOWS\system32\kdyvp.exe
                            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                            O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                            O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                            O4 - HKCU\..\Run: [DesktopX] "C:\PROGRA~1\Stardock\OBJECT~1\DesktopX\DesktopX Builder.exe" -noui
                            O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                            O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
                            O4 - HKCU\..\Run: [VeohPlugin] "C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
                            O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                            O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                            O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                            O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                            O4 - Startup: MSN Pictures Displayer.lnk = C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
                            O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
                            O4 - Startup: Rainlendar.lnk = ?
                            O4 - Startup: SM.lnk = C:\Program Files\SM\skymessnet.exe
                            O4 - Global Startup: hp psc 1000 series.lnk = ?
                            O4 - Global Startup: hpoddt01.exe.lnk = ?
                            O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                            O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                            O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                            O8 - Extra context menu item: Ajouter un site de support RSS à VAIO Information FLOW - C:\Program Files\Sony\VAIO Information FLOW\aiesc.html
                            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
                            O8 - Extra context menu item: Transfert par Image Converter 2 Plus - C:\Program Files\Sony\Image Converter 2\menu.htm
                            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                            O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                            O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                            O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                            O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/fr/
                            O15 - Trusted Zone: *.sony-europe.com
                            O15 - Trusted Zone: *.sonystyle-europe.com
                            O15 - Trusted Zone: *.vaio-link.com
                            O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
                            O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                            O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                            O17 - HKLM\System\CCS\Services\Tcpip\..\{07D7E714-13C0-4F8A-AC41-7CCA07050B9D}: NameServer = 85.255.112.114;85.255.112.14
                            O17 - HKLM\System\CCS\Services\Tcpip\..\{3F7C65E8-4635-4116-AFB0-AA2BAD451A29}: NameServer = 85.255.112.114;85.255.112.14
                            O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
                            O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                            O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                            O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                            O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                            O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                            O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                            O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                            O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
                            O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
                            O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                            O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
                            O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
                            O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
                            O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                            O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
                            O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
                            O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
                            O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                            O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
                            O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                            O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                            O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                            O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                            O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
                            O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\Avlib\SSScsiSV.exe
                            O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
                            O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
                            O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
                            O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
                            O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
                            O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
                            O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
                            O23 - Service: VAIO Cooporated Initialisation (VCI) - Sony Corporation - C:\Program Files\Sony\VAIO Cooperated Initialisation\VCI_SVC.exe
                            O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
                            O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
                            O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
                            • 1
                            • 2
                            • 3

                            Discussions similaires

                            je ne c’est pas s’en que cela veut dire bv
                            ginettedu76

                            1 réponse
                            Problème BVCAM
                            Ricou34

                            4 réponses
                            Bv
                            Ben

                            1 réponse
                            Arnaque WorldPay
                            yann.2005

                            24 réponses
                            Worldpay escroquerie internet sur carte bancaire
                            Cayayou

                            9 réponses