SOS : About: blanc + Spyware secure!

Merci beaucoup pour ta réponse rapide jlpjlp,

alors voila le rapport hijackthis:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 18:39:14, on 11/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Controle Parental\bin\optproxy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\Explorer.EXE
C:\ATI-CPanel\atiptaxx.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Mes Tirages Photo\TiragesPhoto.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\LogProtect\LogProtect.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\LogProtect\lpwchdg.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\PROGRA~1\Wanadoo\WOOBRO~1\DownloadManager.exe
C:\DOCUME~1\CHEZNO~1\MESDOC~1\DAVIDG~1\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: _URLHandler - {86005BD2-D46B-448F-8232-BF29E10BC5A5} - C:\PROGRA~1\MESTIR~1\MYPHOT~1.DLL
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - c:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [MesTiragesPhoto] C:\Program Files\Mes Tirages Photo\TiragesPhoto.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [LogProtect] "C:\Program Files\LogProtect\LogProtect.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [RamBoostXp] C:\Program Files\RamBoost XP\rambxpfr.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-961543905-3322731482-18396572-1009\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'LAURA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\Broderbund\PrintMaster\PMremind.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?248cba23f08849ad85db31cb2c74d23f
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?248cba23f08849ad85db31cb2c74d23f
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O12 - Plugin for .fpx: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O12 - Plugin for .ivr: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Control Parental (OPTENET_FILTER) - Contrôle Parental - C:\Program Files\Controle Parental\bin\optproxy.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

voici le rapport navilog 2 :

Clean Navipromo version 2.0.5 commencé le 14/07/2007 à 14:03:49,09

Fix lancé depuis C:\Program Files\navilog1
Mise a jour le 01.07.2007 a 12h00 by IL-MAFIOSO

Mode suppression automatique avec prise en charge résultats Blacklight

*** fsbl1.txt non trouvé ***
(Assurez-vous que Blacklight n'avait rien trouvé lors de la recherche)

*** Suppression dossiers dans C:\WINDOWS ***

je fais la suite

*** Suppression dossiers dans C:\Program Files ***

C:\Program Files\InternetGameBox ...suppression...
C:\Program Files\InternetGameBox supprimé !

*** Suppression dossiers dans C:\Documents and Settings\All Users\Application Data ***

*** Suppression dossiers dans C:\Documents and Settings\chez nous\Application Data ***

*** Suppression fichiers ***

C:\WINDOWS\pack.epk supprimé !
C:\WINDOWS\system32\nvs2.inf supprimé !

*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\chez nous\Local Settings\Temp effectué !

*** Sauvegarde du registre vers dossier Backupnavi***

sauvegarde du registre réalise avec succes !

*** Nettoyage registre ***

Erreur application fixreg

Le registre n'a pas été nettoyé !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:

2)Recherche et Suppression Heuristique :

*
C:\WINDOWS\System32\rbggqlbnf.dat trouvé !
Copie C:\WINDOWS\system32\rbggqlbnf.dat réalise avec succes !
C:\WINDOWS\system32\rbggqlbnf.dat supprimé !

**
***
****
C:\WINDOWS\System32\rbggqlbnf_navps.dat trouvé !
Copie C:\WINDOWS\system32\rbggqlbnf_navps.dat réalise avec succes !
C:\WINDOWS\system32\rbggqlbnf_navps.dat supprimé !

*****
C:\WINDOWS\System32\rbggqlbnf_nav.dat trouvé !
Copie C:\WINDOWS\system32\rbggqlbnf_nav.dat réalise avec succes !
C:\WINDOWS\system32\rbggqlbnf_nav.dat supprimé !

******
*******
********

3)Contrôle présence clés Rootkit dans le registre :

Aucune autre clés présente dans le registre !

4)Certificats :

Certificat Egroup supprimé !

*** Nettoyage termine le 14/07/2007 à 14:09:23,76 ***

J'ai lancé Stinger qui a fait un scan et qui maintenant me demande "enter a directory path to scan"...

Je ne sais pas ce que je dois faire... Je suis désolée, je t'avais dis que je n'étais pas douée en anglais...

OK je suis en train de faire la suite,

J'en suis à Hijackthis,le rapport pour savoir les lignes que je dois supprimer, ce n'est pas le même que tout à l'heure, je suppose que c'est la première liste de lignes qui s'affiche, mais je ne trouve pas comment le copier dans le forum

je suis toujours dans la procédure (j'en suis à redemarre en mode ...)

Par contre, j'ai un soucis : pour avast, on me dit de corriger ce qui concerne About: Blank , mais je n'ai AUCUNE idée de ce qui concerne About: Blank !!!

Bon, je continue quand même, tu m'expliquera plus tard....

C'est gentil de m'encourrager, car je vois bien que je ne suis pas au bout!!!!

Encore un grand merci pour ton aide

A+

Bon, étape suivante : je viens de faire ce que tu me disais avec SDFix, et voici donc le rapport :

SDFix: Version 1.91

Run by Administrateur on 16/07/2007 at 10:02

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Missing Security Center Service
Restoring Missing SharedAccess Service

Rebooting...

Normal Mode:
Checking Files:

No Trojan Files Found

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Mes Tirages Photo\\TiragesPhoto.exe"="C:\\Program Files\\Mes Tirages Photo\\TiragesPhoto.exe:*:Enabled:Agent de transfert de photos par Internet"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files:
---------------

Files with Hidden Attributes:

C:\Program Files\Canon\MP Navigator 3.0\uinstrsc.dll
C:\Program Files\Canon\MP Navigator 3.0\Maint.exe
C:\WINDOWS\DelQuete.exe
C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp
C:\Documents and Settings\chez nous\Application Data\Microsoft\ModŠles\~WRL0004.tmp
C:\Documents and Settings\chez nous\Application Data\Microsoft\ModŠles\~WRL0005.tmp
C:\Documents and Settings\chez nous\Application Data\Microsoft\ModŠles\~WRL0125.tmp
C:\Documents and Settings\chez nous\Application Data\Microsoft\ModŠles\~WRL0724.tmp
C:\Documents and Settings\chez nous\Application Data\Microsoft\ModŠles\~WRL1211.tmp
C:\Documents and Settings\chez nous\Application Data\Microsoft\ModŠles\~WRL1816.tmp
C:\Documents and Settings\chez nous\Application Data\Microsoft\ModŠles\~WRL2190.tmp
C:\Documents and Settings\chez nous\Application Data\Microsoft\ModŠles\~WRL3161.tmp
C:\Documents and Settings\chez nous\Application Data\Microsoft\Word\~WRL1791.tmp
C:\Documents and Settings\chez nous\Application Data\Microsoft\Word\~WRL2357.tmp
C:\Documents and Settings\chez nous\Application Data\Microsoft\Word\~WRL3077.tmp
C:\Documents and Settings\chez nous\Application Data\Microsoft\Word\~WRL3690.tmp
C:\Documents and Settings\chez nous\Application Data\Microsoft\Word\~WRL3969.tmp
C:\Documents and Settings\LAURA\Application Data\Microsoft\ModŠles\~WRL0003.tmp
C:\Documents and Settings\LAURA\Application Data\Microsoft\ModŠles\~WRL2971.tmp
C:\Documents and Settings\LAURA\Application Data\Microsoft\Word\~WRL0003.tmp
C:\Documents and Settings\LAURA\Mes documents\Mes photos\No‰l 2005+toutes mes photos\100MEDIA\SIVC.tmp
C:\Program Files\InterActual\InterActual Player\iti3.tmp

Finished

Mais avant, il y a eu des étapes ou je pense ne pas avoir fait correctement.

par exemple pour SpywareBlaster, je l'ai téléchargé, j'ai fais la première étape (je ne me souviens plus

comment cela s'appelait) mais je n'ai pas eu l'impression d'agir sur l'ordi., je veux dire, quand tu me fais

utiliser un logiciel qui analyse puis supprime, là, je comprend, mais pour SpywareBlaster... Je ne

comprend pas ce que cela a apporté.

J'ai pourtant cherché avec le mode d'emploi en français, mais....

Bon, je continue la série d'après.

A+

Et maintenant, le rapport de Combmfix :

"chez nous" - 2007-07-16 10:41:17 - ComboFix 07-07-14.6 - Service Pack 2 NTFS

/wow section not completed

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\CHEZNO~1\APPLIC~1\ShoppingReport
C:\DOCUME~1\CHEZNO~1\APPLIC~1\ShoppingReport\cs\Config.xml
C:\DOCUME~1\CHEZNO~1\APPLIC~1\ShoppingReport\cs\db\Aliases.dbs
C:\DOCUME~1\CHEZNO~1\APPLIC~1\ShoppingReport\cs\db\Sites.dbs
C:\DOCUME~1\CHEZNO~1\APPLIC~1\ShoppingReport\cs\dwld\WhiteList.xip
C:\DOCUME~1\CHEZNO~1\APPLIC~1\ShoppingReport\cs\persist.dbs
C:\DOCUME~1\CHEZNO~1\APPLIC~1\ShoppingReport\cs\report\aggr_storage.xml
C:\DOCUME~1\CHEZNO~1\APPLIC~1\ShoppingReport\cs\report\send_storage.xml
C:\DOCUME~1\CHEZNO~1\APPLIC~1\ShoppingReport\cs\res1(2)\WhiteList.dbs
C:\DOCUME~1\CHEZNO~1\APPLIC~1\ShoppingReport\cs\res2(2)(2)\WhiteList.dbs
C:\DOCUME~1\CHEZNO~1\APPLIC~1\ShoppingReport\cs\res2(3)\WhiteList.dbs
C:\DOCUME~1\DAVID\APPLIC~1\ShoppingReport
C:\DOCUME~1\DAVID\APPLIC~1\ShoppingReport\cs\Config.xml
C:\DOCUME~1\DAVID\APPLIC~1\ShoppingReport\cs\persist.dbs
C:\DOCUME~1\LAURA\APPLIC~1\ShoppingReport
C:\DOCUME~1\LAURA\APPLIC~1\ShoppingReport\cs\persist.dbs
C:\DOCUME~1\LOCALS~1\APPLIC~1\ShoppingReport
C:\DOCUME~1\LOCALS~1\APPLIC~1\ShoppingReport\cs\Config.xml
C:\DOCUME~1\LOCALS~1\APPLIC~1\ShoppingReport\cs\dwld\WhiteList.xip
C:\DOCUME~1\LOCALS~1\APPLIC~1\ShoppingReport\cs\persist.dbs
C:\DOCUME~1\LOCALS~1\APPLIC~1\ShoppingReport\cs\report\aggr_storage.xml
C:\DOCUME~1\LOCALS~1\APPLIC~1\ShoppingReport\cs\report\send_storage.xml
C:\DOCUME~1\LOCALS~1\APPLIC~1\ShoppingReport\cs\res1\WhiteList.dbs
C:\DOCUME~1\LYDIA2~1\APPLIC~1\ShoppingReport
C:\DOCUME~1\LYDIA2~1\APPLIC~1\ShoppingReport\cs\persist.dbs
C:\Program Files\ShoppingReport
C:\Program Files\ShoppingReport\cs\persist.dbs
C:\WINDOWS\system32\nvs2.inf
C:\WINDOWS\system32\rbggqlbnf.dat
C:\WINDOWS\system32\rbggqlbnf.exe

((((((((((((((((((((((((( Files Created from 2007-06-16 to 2007-07-16 )))))))))))))))))))))))))))))))

2007-07-16 10:40 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-16 10:01 <REP> d-------- C:\WINDOWS\ERUNT
2007-07-16 07:52 3,778 --a------ C:\WINDOWS\system32\tmp.reg
2007-07-16 07:51 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-07-16 07:51 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-07-16 07:51 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-07-15 19:54 <REP> d-------- C:\Program Files\SpywareBlaster
2007-07-15 08:43 <REP> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\.Mes Tirages
2007-07-15 08:39 1,048,576 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-07-15 08:39 <REP> dr------- C:\DOCUME~1\ADMINI~1\Mes documents
2007-07-15 08:39 <REP> dr------- C:\DOCUME~1\ADMINI~1\Menu D‚marrer
2007-07-15 08:39 <REP> dr------- C:\DOCUME~1\ADMINI~1\Favoris
2007-07-15 08:39 <REP> d--h----- C:\DOCUME~1\ADMINI~1\Voisinage r‚seau
2007-07-15 08:39 <REP> d--h----- C:\DOCUME~1\ADMINI~1\Voisinage d'impression
2007-07-15 08:39 <REP> d--h----- C:\DOCUME~1\ADMINI~1\ModŠles
2007-07-15 08:39 <REP> d-------- C:\DOCUME~1\ADMINI~1\Bureau
2007-07-14 19:42 <REP> d-------- C:\Program Files\Lavasoft
2007-07-14 19:42 <REP> d-------- C:\DOCUME~1\CHEZNO~1\APPLIC~1\Lavasoft
2007-07-14 16:18 <REP> d-------- C:\Program Files\Hijackthis Version Fran‡aise
2007-07-14 13:04 <REP> d-------- C:\Program Files\Navilog1
2007-07-13 12:09 <REP> d-------- C:\DOCUME~1\LYDIA2~1\APPLIC~1\Spyware Terminator
2007-07-13 08:35 <REP> d-------- C:\DOCUME~1\LAURA\APPLIC~1\Spyware Terminator
2007-07-12 17:58 138,368 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2007-07-12 17:58 <REP> d-------- C:\DOCUME~1\NETWOR~1\APPLIC~1\Spyware Terminator
2007-07-12 17:53 <REP> d-------- C:\Program Files\Spyware Terminator
2007-07-12 17:53 <REP> d-------- C:\DOCUME~1\CHEZNO~1\APPLIC~1\Spyware Terminator
2007-07-12 17:53 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spyware Terminator
2007-07-05 10:15 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2007-07-03 13:59 <REP> d-------- C:\DOCUME~1\LYDIA2~1\APPLIC~1\Canon
2007-06-29 08:38 <REP> d---s---- C:\DOCUME~1\DAVID\UserData
2007-06-28 20:15 <REP> d---s---- C:\DOCUME~1\LAURA\UserData
2007-06-27 11:27 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-06-23 13:50 <REP> d-------- C:\Program Files\Snapshot Viewer
2007-06-23 13:50 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBT
2007-06-23 11:57 <REP> d---s---- C:\DOCUME~1\GWENAE~1\UserData
2007-06-22 20:41 <REP> d-------- C:\Program Files\Macrogaming
2007-06-22 08:59 <REP> d-------- C:\DOCUME~1\LYDIA2~1\Contacts
2007-06-20 09:04 <REP> d---s---- C:\DOCUME~1\LYDIA2~1\UserData
2007-06-18 18:41 95,872 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-06-18 18:41 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-06-18 18:41 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-06-18 18:41 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-06-18 18:41 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-06-18 18:41 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-06-18 18:41 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-06-17 20:51 <REP> d-------- C:\Program Files\Alwil Software
2007-06-16 16:31 <REP> d-------- C:\DOCUME~1\DAVID\APPLIC~1\.Mes Tirages
2007-06-16 14:56 <REP> d-------- C:\DOCUME~1\LAURA\APPLIC~1\.Mes Tirages
2007-06-16 11:27 <REP> d-------- C:\DOCUME~1\GWENAE~1\APPLIC~1\.Mes Tirages

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-16 08:40:12 -------- d-----w C:\DOCUME~1\CHEZNO~1\APPLIC~1\LogProtect
2007-07-16 08:24:05 -------- d-----w C:\Program Files\Wanadoo
2007-07-14 14:20:46 -------- d-----w C:\Program Files\Hijackthis Version Française
2007-07-03 16:28:48 21,840 -c--atw C:\WINDOWS\system32\SIntfNT.dll
2007-07-03 16:28:48 17,212 -c--atw C:\WINDOWS\system32\SIntf32.dll
2007-07-03 16:28:48 12,067 -c--atw C:\WINDOWS\system32\SIntf16.dll
2007-06-30 09:00:02 -------- d-----w C:\DOCUME~1\CHEZNO~1\APPLIC~1\.Mes Tirages
2007-06-26 17:15:18 -------- d-----w C:\Program Files\LogProtect
2007-06-23 11:49:02 -------- d-----w C:\Program Files\Microsoft Publisher
2007-06-19 09:53:46 -------- d-----w C:\Program Files\Mes Tirages Photo
2007-06-12 12:54:27 -------- d-----w C:\DOCUME~1\CHEZNO~1\APPLIC~1\AdobeUM
2007-06-11 07:23:05 -------- d-----w C:\Program Files\RegClean
2007-06-08 12:50:36 -------- d-----w C:\Program Files\AntivirusFirewall
2007-06-08 12:45:13 -------- d-----w C:\Program Files\Fichiers communs\HP
2007-06-07 05:14:26 -------- d-----w C:\Program Files\Windows Media Connect 2
2007-06-07 03:43:45 -------- d-----w C:\Program Files\PhotoCite Collection
2007-06-07 03:42:20 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-06-07 03:42:19 -------- d-----w C:\Program Files\ArcSoft
2007-05-31 19:32:28 -------- d-----w C:\Program Files\MSXML 4.0
2007-05-31 18:19:06 64,484 ----a-w C:\WINDOWS\system32\perfc00C.dat
2007-05-31 18:19:06 446,566 ----a-w C:\WINDOWS\system32\perfh00C.dat
2007-05-31 18:02:13 -------- d-----w C:\Program Files\Messenger
2007-05-31 17:43:16 -------- d-----w C:\Program Files\Ahead
2007-05-31 17:43:00 -------- d-----w C:\Program Files\iPlayer Mass Storage Driver V3.1
2007-05-31 17:41:58 -------- d-----w C:\Program Files\Services en ligne
2007-05-31 17:41:57 -------- d-----w C:\Program Files\Microsoft Works Suite 2003
2007-05-31 17:41:57 -------- d-----w C:\Program Files\Microsoft Works
2007-05-31 17:41:44 -------- d-----w C:\Program Files\IncrediMail
2007-05-31 17:41:40 -------- d-----w C:\Program Files\hp deskjet 3420 series
2007-05-31 17:41:39 -------- d-----w C:\Program Files\Hewlett-Packard
2007-05-31 17:41:25 -------- d-----w C:\Program Files\Windows Live Safety Center
2007-05-31 17:40:56 -------- d-----w C:\Program Files\Fichiers communs\Broderbund
2007-05-31 17:37:27 -------- d-----w C:\Program Files\HP
2007-05-31 17:27:40 -------- d-----w C:\Program Files\MSN Messenger
2007-05-28 06:56:41 -------- d-----w C:\Program Files\Windows Live Toolbar
2007-05-28 06:56:41 -------- d-----w C:\Program Files\Movie Maker
2007-05-25 12:44:32 -------- d-----w C:\DOCUME~1\CHEZNO~1\APPLIC~1\Help
2007-05-18 08:58:21 -------- d-----w C:\Program Files\Logitech
2007-05-18 08:57:05 -------- d-----w C:\Program Files\Fichiers communs\Labtec
2007-05-17 11:10:48 -------- d-----w C:\Program Files\Windows NT
2007-05-17 09:11:26 -------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-05-16 15:13:53 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-07 18:27:45 131 ----a-w C:\ispInst.dat
2007-05-07 18:27:45 116 ----a-w C:\ispInfo.dat
2007-05-07 18:27:41 3 ----a-w C:\00.dat
2007-04-25 14:22:35 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:14:18 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-16 20:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
2007-04-16 20:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-12-18 04:16 59032 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A}]
2006-11-05 16:44 548992 -ra------ C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{243B17DE-77C7-46BF-B94B-0B5F309A0E64}]
2002-07-17 11:00 163906 --a------ c:\Program Files\Microsoft Money\System\mnyside.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
2005-05-31 01:04 853672 --a------ C:\PROGRA~1\SPYBOT~1\SDHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{68F9551E-0411-48E4-9AAF-4BC42A6A46BE}]
2006-04-18 19:04 34304 --a------ C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
2006-08-31 20:33 322368 --a------ C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
2006-09-27 17:45 544032 --a------ C:\Program Files\Windows Live Toolbar\msntb.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 16:24 C:\WINDOWS\system32\Ati2mdxx.exe]
"Wizard"="" []
"ATIPTA"="C:\ATI-CPanel\atiptaxx.exe" [2003-08-12 21:10]
"FirstSteps"="" []
"Omnipage"="C:\Program Files\ScanSoft\OmniPageSE\opware32.exe" [2002-06-03 11:38]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2004-12-26 14:41]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2003-09-15 15:58]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 16:49]
"SSBkgdUpdate"="C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-30 00:14]
"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-03-21 13:19]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55]
"MesTiragesPhoto"="C:\Program Files\Mes Tirages Photo\TiragesPhoto.exe" [2007-06-18 20:10]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-12-27 16:53]
"LogProtect"="C:\Program Files\LogProtect\LogProtect.exe" [2007-04-19 16:46]
"SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2007-07-12 18:02]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09]
"MoneyAgent"="c:\Program Files\Microsoft Money\System\mnyexpr.exe" [2002-07-17 11:00]
"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-12-27 16:53]

Contents of the 'Scheduled Tasks' folder
2007-07-16 07:04:04 C:\WINDOWS\tasks\Vérifier les mises à jour de Windows Live Toolbar.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-16 10:45:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-16 10:46:04
C:\ComboFix-quarantined-files.txt ... 2007-07-16 10:45

--- E O F ---

je continue d'abord ce que tu m'avais dit, non?

J'en suis donc au rapport Cleanzip :

16/07/2007 a 11:27:49,48

*** Recherche des fichiers dans C:

*** Recherche des fichiers dans C:\WINDOWS\

*** Recherche des fichiers dans C:\WINDOWS\system32

*** Recherche des fichiers dans C:\Program Files
*** Fin du rapport !

Quand tu m'avais donné tout ça à faire, l'étape suivant était un scan en ligne, je fais ou je recolle hijackthis?

je viens d'aller dans une autre session de mon ordi., et spyware Terminator s'est mit à faire une analyse et a trouvé 2 menaces.

Je pensais avoir déja réglé ça sur le compte administrateur, mais on dirait que non.

J'espère que ça ne signifie pas qu'il faille faire tout ce qu'on a déja fait sur toutes les sessions?

Je te colle le rapport de spyware terminator et je retourne voir si j'ai de pub ou about: blank

@lydia03tout d'abord, le rapport :

Spyware Terminator Version: 1.9.3.142
Start time: 16/07/2007 13:26:05
System: Windows XP
User: Limited

Processes Scan
smss.exe [file not found]
csrss.exe [file not found]
winlogon.exe [file not found]
services.exe [file not found]
lsass.exe [file not found]
svchost.exe [file not found]
aswUpdSv.exe [file not found]
ashServ.exe [file not found]
C:\WINDOWS\Explorer.EXE [Microsoft Corporation] C:\Program Files\ScanSoft\OmniPageSE\ophook32.dll [ScanSoft, Inc], C:\Program Files\ScanSoft\OmniPageSE4.0\OpHookSE4.dll [ScanSoft, Inc.], C:\Program Files\Macrogaming\SweetIM\mgAdaptersProxy.dll [MacroGaming], C:\Program Files\LogProtect\DllHookM.dll [Empty], C:\Program Files\Wanadoo\Inactivity.dll [Empty],
C:\ATI-CPanel\atiptaxx.exe [ATI Technologies, Inc.] ATRPUIXX.FRA [ATI Technologies, Inc.], atipdsxx.dll [ATI Technologies, Inc.], ophook32.dll, atipdxxx.dll [ATI Technologies, Inc.], OpHookSE4.dll,
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe [ScanSoft, Inc] ophook32.dll, OpHookSE4.dll,
C:\Program Files\QuickTime\qttask.exe [Apple Computer, Inc.] QuickTime.qts [Apple Computer, Inc.], OpHookSE4.dll, ophook32.dll, QuickTime3GPP.qtx [Apple Computer, Inc.], QuickTimeAuthoring.qtx [Apple Computer, Inc.], QuickTimeCapture.qtx [Apple Computer, Inc.], QuickTimeEffects.qtx [Apple Computer, Inc.], QuickTimeEssentials.qtx [Apple Computer, Inc.], QuickTimeImage.qtx [Apple Computer, Inc.], QuickTimeInternetExtras.qtx [Apple Computer, Inc.], C:\WINDOWS\system32\QuickTime\QuickTimeMPEG.qtx [Apple Computer, Inc], QuickTimeMPEG4.qtx [Apple Computer, Inc.], QuickTimeMPEG4Authoring.qtx [Apple Computer, Inc.], QuickTimeMusic.qtx [Apple Computer, Inc.], QuickTimeStreaming.qtx [Apple Computer, Inc.], QuickTimeStreamingAuthoring.qtx [Apple Computer, Inc.], QuickTimeStreamingExtras.qtx [Apple Computer, Inc.],
C:\Program Files\Ahead\InCD\InCD.exe [Ahead Software AG] C:\Program Files\Ahead\InCD\InCDapi.dll [AHEAD Software], C:\Program Files\Ahead\InCD\InCDunt.dll [AHEAD Software], ophook32.dll, DriveLocker.dll [Ahead Software AG], C:\Program Files\Ahead\InCD\incdshx.dll [Ahead Software, Karlsbad, Germany], OpHookSE4.dll,
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [Hewlett-Packard Company] ophook32.dll, OpHookSE4.dll,
spoolsv.exe [file not found]
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe [ScanSoft, Inc.] ophook32.dll, OpHookSE4.dll,
C:\Program Files\Mes Tirages Photo\TiragesPhoto.exe [Pokepix] OpHookSE4.dll, ophook32.dll, C:\Program Files\Mes Tirages Photo\SelectionMgr.dll [Empty], C:\WINDOWS\system32\LTKRN13N.DLL [LEAD Technologies, Inc.], C:\WINDOWS\system32\LTDIS13N.DLL [LEAD Technologies, Inc.], C:\WINDOWS\system32\LTFIL13N.DLL [LEAD Technologies, Inc.], C:\WINDOWS\system32\LTEFX13N.DLL [LEAD Technologies, Inc.], mgAdaptersProxy.dll, C:\Program Files\Controle Parental\bin\lsp.dll [Empty], PhotoLogin.dll [Pokepix],
C:\Program Files\Wanadoo\TaskBarIcon.exe [France Télécom R&D] OutilsFT.dll [France Télécom R&D], StyleIHM.dll [France Télécom R&D], c:\Program Files\Wanadoo\skin\Default\main\ResourceStyle.dll [Empty], WooIHMF.dll [France Télécom R&D], OpHookSE4.dll, ophook32.dll,
C:\Program Files\Alwil Software\Avast4\ashDisp.exe [ALWIL Software] aswCmnOS.dll [ALWIL Software], ashBase.dll [ALWIL Software], aswCmnB.dll [ALWIL Software], aswCmnS.dll [ALWIL Software], ashTask.dll [ALWIL Software], aswAux.dll [ALWIL Software], Aavm4h.dll [ALWIL Software], Base.dll [ALWIL Software], Lang.dll [ALWIL Software], AavmRpch.dll [ALWIL Software], ahruimai.dll [ALWIL Software], ashUInt.dll [ALWIL Software], C:\Program Files\Alwil Software\Avast4\XT1922.dll [Codejock Software], ahruimes.dll [ALWIL Software], ahruins.dll [ALWIL Software], ahruiout.dll [ALWIL Software], ahruip2p.dll [ALWIL Software], ahruistd.dll [ALWIL Software], ahruiws.dll [ALWIL Software], OpHookSE4.dll, ophook32.dll,
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe [MacroGaming LTD.] C:\Program Files\Macrogaming\SweetIM\mgUpdateSupport.dll [MacroGaming], C:\Program Files\Macrogaming\SweetIM\mgcommon.dll [MacroGaming], C:\Program Files\Macrogaming\SweetIM\mgcommunication.dll [MacroGaming], C:\Program Files\Macrogaming\SweetIM\mgconfig.dll [MacroGaming], C:\Program Files\Macrogaming\SweetIM\mgxml_wrapper.dll [MacroGaming], C:\Program Files\Macrogaming\SweetIM\mghooking.dll [MacroGaming], C:\Program Files\Macrogaming\SweetIM\mgIEPlayer.dll [MacroGaming], mgAdaptersProxy.dll, OpHookSE4.dll, ophook32.dll, lsp.dll,
FTRTSVC.exe [file not found]
C:\Program Files\LogProtect\LogProtect.exe [LogProtect] DllHookM.dll, C:\Program Files\LogProtect\DllHook.dll [Empty], OpHookSE4.dll, ophook32.dll, mgAdaptersProxy.dll,
incdsrv.exe [file not found]
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [Crawler.com] mgAdaptersProxy.dll, OpHookSE4.dll, ophook32.dll,
C:\WINDOWS\system32\ctfmon.exe [Microsoft Corporation] mgAdaptersProxy.dll, OpHookSE4.dll, ophook32.dll,
optproxy.exe [file not found]
C:\Program Files\MSN Messenger\msnmsgr.exe [Microsoft Corporation] mgAdaptersProxy.dll, mgUpdateSupport.dll, mgcommon.dll, mgcommunication.dll, mgconfig.dll, mgxml_wrapper.dll, mghooking.dll, mgIEPlayer.dll, C:\Program Files\Macrogaming\SweetIM\mgmsnmessengeradapter.dll [MacroGaming], C:\Program Files\Macrogaming\SweetIM\mgMsnAuto.dll [MacroGaming], C:\Program Files\Macrogaming\SweetIM\mglogger.dll [Macrogaming LTD.], C:\Program Files\Macrogaming\SweetIM\mgSweetIM.dll [MacroGaming], C:\Program Files\Macrogaming\SweetIM\mgFlashPlayer.dll [MacroGaming], C:\Program Files\Macrogaming\SweetIM\mgArchive.dll [MacroGaming], OpHookSE4.dll, ophook32.dll, lsp.dll, Inactivity.dll, DllHookM.dll, C:\WINDOWS\System32\Macromed\Flash\Flash9c.ocx [Adobe Systems, Inc.], C:\WINDOWS\system32\Macromed\Common\SwSupport.dll [Macromedia, Inc.],
reader_sl.exe [file not found]
sp_rsser.exe [file not found]
C:\Program Files\LogProtect\lpwchdg.exe [Empty]
fxssvc.exe [file not found]
C:\Program Files\Wanadoo\GestionnaireInternet.exe [France Télécom R&D] OutilsFT.dll, StyleIHM.dll, mgAdaptersProxy.dll, OpHookSE4.dll, ophook32.dll, WooIHMF.dll, Inactivity.dll, DllHookM.dll, ResourceStyle.dll, C:\WINDOWS\system32\AlertModule\AlertClient.dll [Empty], C:\Program Files\Wanadoo\DetectComponent.dll [Empty], C:\Program Files\Wanadoo\SynchroDll.dll [Empty], lsp.dll,
C:\Program Files\Wanadoo\ComComp.exe [France Télécom R&D] OutilsFT.dll, WLANManager.dll [France Télécom R&D], IfHelper.dll [France Télécom R&D], C:\WINDOWS\system32\W32N50.dll [Printing Communications Assoc., Inc. (PCAUSA)], mgAdaptersProxy.dll, OpHookSE4.dll, ophook32.dll, GestAppFT.dll [France Télécom R&D], ModifFT.dll [France Télécom R&D], C:\Program Files\Wanadoo\PMStub.dll [Empty], C:\Program Files\Wanadoo\PhoneManager.dll [Empty], DetectComponent.dll, NDIS_Gen.dll [France Télécom R&D],
C:\Program Files\Wanadoo\Toaster.exe [France Telecom R&D] StyleIHM.dll, mgAdaptersProxy.dll, OpHookSE4.dll, ophook32.dll, AlertClient.dll, ResourceStyle.dll,
C:\Program Files\Wanadoo\Inactivity.exe [Empty] mgAdaptersProxy.dll, OpHookSE4.dll, ophook32.dll, AlertClient.dll, Inactivity.dll, DllHookM.dll, DllHook.dll,
C:\Program Files\Wanadoo\PollingModule.exe [Empty] OutilsFT.dll, SynchroDll.dll, mgAdaptersProxy.dll, OpHookSE4.dll, ophook32.dll, AlertClient.dll, lsp.dll,
C:\WINDOWS\system32\AlertModule\AlertModule.exe [Empty] mgAdaptersProxy.dll, OpHookSE4.dll, ophook32.dll,
wuauclt.exe [file not found]
ashMaiSv.exe [file not found]
ashWebSv.exe [file not found]
alg.exe [file not found]
C:\Program Files\Wanadoo\Watch.exe [France Télécom R&D] ModifFT.dll, IfHelper.dll,
C:\Program Files\Spyware Terminator\SpywareTerminator.exe [Crawler.com] mgAdaptersProxy.dll, OpHookSE4.dll, ophook32.dll, Inactivity.dll, DllHookM.dll, lsp.dll,
usnsvc.exe [file not found]

Startup Scan

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [ Microsoft Corporation ]
"WOOKIT" = "C:\PROGRAM FILES\WANADOO\SHELL.EXE" [ Empty ]
"rbggqlbnf" = "c:\windows\system32\rbggqlbnf.exe rbggqlbnf" [ file not found ]
"msnmsgr" = "~"C:\Program Files\MSN Messenger\msnmsgr.exe" \background" [ file not found ]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"ATIModeChange" = "C:\WINDOWS\system32\Ati2mdxx.exe" [ ATI Technologies, Inc. ]
"ATIPTA" = "C:\ATI-CPanel\atiptaxx.exe" [ ATI Technologies, Inc. ]
"Omnipage" = "C:\Program Files\ScanSoft\OmniPageSE\opware32.exe" [ ScanSoft, Inc ]
"QuickTime Task" = "C:\PROGRAM FILES\QUICKTIME\QTTASK.EXE" [ Apple Computer, Inc. ]
"InCD" = "C:\Program Files\Ahead\InCD\InCD.exe" [ Ahead Software AG ]
"HP Software Update" = "C:\PROGRAM FILES\HP\HP SOFTWARE UPDATE\HPWUSCHD2.EXE" [ Hewlett-Packard Company ]
"SSBkgdUpdate" = "C:\PROGRAM FILES\FICHIERS COMMUNS\SCANSOFT SHARED\SSBKGDUPDATE\SSBKGDUPDATE.EXE" [ Scansoft, Inc. ]
"OpwareSE4" = "C:\PROGRAM FILES\SCANSOFT\OMNIPAGESE4.0\OPWARESE4.EXE" [ ScanSoft, Inc. ]
"WOOWATCH" = "C:\Program Files\Wanadoo\Watch.exe" [ France Télécom R&D ]
"WOOTASKBARICON" = "C:\Program Files\Wanadoo\GestMAJ.exe" [ France Télécom R&D ]
"MesTiragesPhoto" = "C:\Program Files\Mes Tirages Photo\TiragesPhoto.exe" [ Pokepix ]
"avast!" = "C:\Program Files\Alwil Software\Avast4\ashDisp.exe" [ ALWIL Software ]
"SweetIM" = "C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [ MacroGaming LTD. ]
"LogProtect" = "C:\PROGRAM FILES\LOGPROTECT\LOGPROTECT.EXE" [ LogProtect ]
"SpywareTerminator" = "C:\PROGRAM FILES\SPYWARE TERMINATOR\SPYWARETERMINATORSHIELD.EXE" [ Crawler.com ]

Toolbars Scan
Easy-WebPrint {327C2873-E90D-4c37-AA9D-10AC9BABA46C} []
Windows Live Toolbar {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} []
SweetIM For Internet Explorer {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} []

BHO Scan
Adobe PDF Reader Link Helper {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} []
SWEETIE Class {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} []
{243B17DE-77C7-46BF-B94B-0B5F309A0E64} []
{53707962-6F74-2D53-2644-206D7942484F} []
EWPBrowseObject Class {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} []
{7E853D72-626A-48EC-A868-BA8D5E23E045} []
Windows Live Sign-in Helper {9030D464-4C02-4ABF-8ECC-5164760863C6} []
Windows Live Toolbar Helper {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} []
{FDD3B846-8D59-4ffb-8758-209B6AD74ACC} []
{{FB5F1910-F110-11d2-BB9E-00C04F795683} []
{E023F504-0C5A-4750-A1E7-A9046DEA8A21} []

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
{00022613-0000-0000-C000-000000000046} = Feuille de propriétés du fichier multimédia () []
{176d6597-26d3-11d1-b350-080036a75b03} = Gestion de scanneur ICM () []
{1F2E5C40-9550-11CE-99D2-00AA006E086C} = Page de sécurité NTFS () []
{3EA48300-8CF6-101B-84FB-666CCB9BCD32} = Page des propriétés de OLE DocFile () []
{40dd6e20-7c17-11ce-a804-00aa003ca9f6} = Extensions de l'environnement pour le partage () []
{41E300E0-78B6-11ce-849B-444553540000} = PlusPack CPL Extension () []
{42071712-76d4-11d1-8b24-00a0c9068ff3} = Extension Affichage Carte du Panneau de configuration () []
{42071713-76d4-11d1-8b24-00a0c9068ff3} = Extension Affichage Écran du Panneau de configuration () []
{42071714-76d4-11d1-8b24-00a0c9068ff3} = Extension Affichage Panorama du Panneau de configuration () []
{4E40F770-369C-11d0-8922-00A024AB2DBB} = Page de sécurité DS () []
{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8} = Page de compatibilité () []
{56117100-C0CD-101B-81E2-00AA004AE837} = Gestionnaire de données endommagées de l'environnement () []
{59099400-57FF-11CE-BD94-0020AF85B590} = Extension copie de disquette () []
{59be4990-f85c-11ce-aff7-00aa003ca9f6} = Extensions de l'environnement pour les objets réseau de Microsoft Windows () []
{5DB2625A-54DF-11D0-B6C4-0800091AA605} = Gestion d'écran ICM () []
{675F097E-4C4D-11D0-B6C1-0800091AA605} = Gestion d'imprimante ICM () []
{764BF0E1-F219-11ce-972D-00AA00A14F56} = Extensions de l'environnement de compression de fichiers () []
{77597368-7b15-11d0-a0c2-080036af3f03} = Extension de l'environnement d'imprimante Web () []
{7988B573-EC89-11cf-9C00-00AA00A14F56} = Disk Quota UI () []
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} = Menu contextuel de cryptage () []
{85BBD920-42A0-1069-A2E4-08002B30309D} = Porte-documents () []
{88895560-9AA2-1069-930E-00AA0030EBC8} = Extension icône HyperTerminal () []
{BD84B380-8CA2-1069-AB1D-08000948F534} = Fonts () []
{DBCE2480-C732-101B-BE72-BA78E9AD5B27} = Profil ICC () []
{F37C5810-4D3F-11d0-B4BF-00AA00BBB723} = Page de sécurité des imprimantes () []
{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = Extensions de l'environnement pour le partage () []
{f92e8c40-3d33-11d2-b1aa-080036a75b03} = Display TroubleShoot CPL Extension () []
{7444C717-39BF-11D1-8CD9-00C04FC29D45} = Extension de cryptographie PKO () []
{7444C719-39BF-11D1-8CD9-00C04FC29D45} = Extension de cryptographie Sign () []
{7007ACC7-3202-11D1-AAD2-00805FC1270E} = Connexions réseau () []
{992CFFA0-F557-101A-88EC-00DD010CCC48} = Connexions réseau () []
{E211B736-43FD-11D1-9EFB-0000F8757FCD} = &Scanneurs et appareils photo () []
{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD} = &Scanneurs et appareils photo () []
{905667aa-acd6-11d2-8080-00805f6596d2} = &Scanneurs et appareils photo () []
{3F953603-1008-4f6e-A73A-04AAC7A992F1} = &Scanneurs et appareils photo () []
{83bbcbf3-b28a-4919-a5aa-73027445d672} = &Scanneurs et appareils photo () []
{F0152790-D56E-4445-850E-4F3117DB740C} = Remote Sessions CPL Extension () []
{5F327514-6C5E-4d60-8F16-D07FA08A78ED} = Auto Update Property Sheet Extension () []
{60254CA5-953B-11CF-8C96-00AA00B8708C} = Extensions de l'interpréteur de commandes pour l'environnement d'exécution de scripts Windows () []
{2206CDB2-19C1-11D1-89E0-00C04FD7A829} = Liaison de données Microsoft () []
{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF} = Tasks Folder Icon Handler () []
{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF} = Tasks Folder Shell Extension () []
{D6277990-4C6A-11CF-8D87-00AA0060F5BF} = Tâches planifiées () []
{0DF44EAA-FF21-4412-828E-260A8728E7F1} = Barre des tâches et menu Démarrer () []
{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0} = Rechercher () []
{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0} = Aide et support () []
{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0} = Aide et support () []
{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0} = Exécuter... () []
{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0} = Internet () []
{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0} = Courrier électronique () []
{D20EA4E1-3957-11d2-A40B-0C5020524152} = Polices () []
{D20EA4E1-3957-11d2-A40B-0C5020524153} = Outils d'administration () []
{875CB1A1-0F29-45de-A1AE-CFB4950D0B78} = Audio Media Properties Handler () []
{40C3D757-D6E4-4b49-BB41-0E5BBEA28817} = Video Media Properties Handler () []
{E4B29F9D-D390-480b-92FD-7DDB47101D71} = Wav Properties Handler () []
{87D62D94-71B3-4b9a-9489-5FE6850DC73E} = Avi Properties Handler () []
{A6FD9E45-6E44-43f9-8644-08598F5A74D9} = Midi Properties Handler () []
{c5a40261-cd64-4ccf-84cb-c394da41d590} = Video Thumbnail Extractor () []
{5E6AB780-7743-11CF-A12B-00AA004AE837} = Barre d'outils Internet Microsoft () []
{22BF0C20-6DA7-11D0-B373-00A0C9034938} = État du téléchargement () []
{91EA3F8B-C99B-11d0-9815-00C04FD91972} = Dossier Bureau étendu () []
{6413BA2C-B461-11d1-A18A-080036B11A03} = Dossier du shell augmenté () []
{F61FFEC1-754F-11d0-80CA-00AA005B4383} = BandProxy () []
{7BA4C742-9E81-11CF-99D3-00AA004AE837} = Bande du navigateur Microsoft () []
{30D02401-6A81-11d0-8274-00C04FD5AE38} = Bande de recherche () []
{32683183-48a0-441b-a342-7c2a440a9478} = Media Band () []
{169A0691-8DF9-11d1-A1C4-00C04FD75D13} = Volet intégré de recherche () []
{07798131-AF23-11d1-9111-00A0C98BA67D} = Recherche Web () []
{AF4F6510-F982-11d0-8595-00AA004CD6D8} = Utilitaire des options de l'arborescence du Registre () []
{01E04581-4EEE-11d0-BFE9-00AA005B4383} = &Adresse () []
{A08C11D2-A228-11d0-825B-00AA005B4383} = Boîte d'entrée de l'adresse () []
{00BB2763-6A77-11D0-A535-00C04FD7D062} = Saisie semi-automatique Microsoft () []
{7376D660-C583-11d0-A3A5-00C04FD706EC} = TridentImageExtractor () []
{6756A641-DE71-11d0-831B-00AA005B4383} = Liste de saisie semi-automatique MRU () []
{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A} = Liste de saisie semi-automatique personnalisée MRU () []
{7e653215-fa25-46bd-a339-34a2790f3cb7} = Accessible () []
{acf35015-526e-4230-9596-becbe19f0ac9} = Barre de progrès auto-ouvrante () []
{E0E11A09-5CB8-4B6C-8332-E00720A168F2} = Analyseur de la barre d'adresses () []
{00BB2764-6A77-11D0-A535-00C04FD7D062} = Liste de saisie semi-automatique de l'historique Microsoft () []
{03C036F1-A186-11D0-824A-00AA005B4383} = Liste de saisie semi-automatique du dossier Shell Microsoft () []
{00BB2765-6A77-11D0-A535-00C04FD7D062} = Conteneur de la liste de saisie semi-automatique multiple Microsoft () []
{ECD4FC4E-521C-11D0-B792-00A0C90312E1} = Menu Site de bandes () []
{3CCF8A41-5C85-11d0-9796-00AA00B90ADF} = Shell DeskBarApp () []
{ECD4FC4C-521C-11D0-B792-00A0C90312E1} = Barre du Bureau () []
{ECD4FC4D-521C-11D0-B792-00A0C90312E1} = Shell Rebar BandSite () []
{DD313E04-FEFF-11d1-8ECD-0000F87A470C} = Assistance utilisateur () []
{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11} = Paramètres du dossier global () []
{EFA24E61-B078-11d0-89E4-00C04FC9E26E} = Favorites Band () []
{0A89A860-D7B1-11CE-8350-444553540000} = Shell Automation Inproc Service () []
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} = Shell DocObject Viewer () []
{A5E46E3A-8849-11D1-9D8C-00C04FC99D61} = Microsoft Browser Architecture () []
{FBF23B40-E3F0-101B-8488-00AA003E56F8} = InternetShortcut () []
{3C374A40-BAE4-11CF-BF7D-00AA006946EE} = Microsoft Url History Service () []
{FF393560-C2A7-11CF-BFF4-444553540000} = Historique () []
{7BD29E00-76C1-11CF-9DD0-00A0C9034933} = Temporary Internet Files () []
{7BD29E01-76C1-11CF-9DD0-00A0C9034933} = Temporary Internet Files () []
{CFBFAE00-17A6-11D0-99CB-00C04FD64497} = Microsoft Url Search Hook () []
{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC} = Image de démarrage de la Suite IE4 () []
{67EA19A0-CCEF-11d0-8024-00C04FD75D13} = CDF Extension Copy Hook () []
{131A6951-7F78-11D0-A979-00C04FD705A2} = ISFBand OC () []
{9461b922-3c5a-11d2-bf8b-00c04fb93661} = Search Assistant OC () []
{3DC7A020-0ACD-11CF-A9BB-00AA004AE837} = Internet () []
{871C5380-42A0-1069-A2EA-08002B30309D} = Internet Name Space () []
{EFA24E64-B078-11d0-89E4-00C04FC9E26E} = Explorer Band () []
{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE} = Sendmail service () []
{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE} = Sendmail service () []
{88C6C381-2E85-11D0-94DE-444553540000} = Dossier ActiveX Cache () []
{E6FB5E20-DE35-11CF-9C87-00AA005127ED} = WebCheck () []
{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE} = Subscription Mgr () []
{F5175861-2688-11d0-9C5E-00AA00A45957} = Dossier Inscription () []
{08165EA0-E946-11CF-9C87-00AA005127ED} = WebCheckWebCrawler () []
{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB} = WebCheckChannelAgent () []
{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7} = TrayAgent () []
{7D559C10-9FE9-11d0-93F7-00AA0059CE02} = Code Download Agent () []
{E6CC6978-6B6E-11D0-BECA-00C04FD940BE} = ConnectionAgent () []
{D8BD2030-6FC9-11D0-864F-00AA006809D9} = PostAgent () []
{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB} = WebCheck SyncMgr Handler () []
{352EC2B7-8B9A-11D1-B8AE-006008059382} = Gestionnaire d'applications d'environnement () []
{0B124F8F-91F0-11D1-B8B5-006008059382} = Énumérateur d'applications installées () []
{CFCCC7A0-A282-11D1-9082-006008059382} = Publication d'application Darwin () []
{e84fda7c-1d6a-45f6-b725-cb260c236066} = Shell Image Verbs () []
{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178} = Shell Image Data Factory () []
{3F30C968-480A-4C6C-862D-EFC0897BB84B} = Extracteur de miniatures de fichier + GDI () []
{9DBD2C50-62AD-11d0-B806-00C04FD706EC} = Gestionnaire de miniatures - Informations de résumé (DOCFILES) () []
{EAB841A0-9550-11cf-8C16-00805F1408F3} = Extracteur de miniatures HTML () []
{eb9b1153-3b57-4e68-959a-a3266bc3d7fe} = Shell Image Property Handler () []
{CC6EEFFB-43F6-46c5-9619-51D571967F7D} = Assistant Publication de sites Web () []
{add36aa8-751a-4579-a266-d66f5202ccbb} = Commande d'impressions via le Web () []
{6b33163c-76a5-4b6c-bf21-45de9cd503a1} = Objet Assistant de publication Shell () []
{58f1f272-9240-4f51-b6d4-fd63d1618591} = Assistant Obtenir une identité Passport () []
{7A9D77BD-5403-11d2-8785-2E0420524153} = Comptes d'utilisateurs () []
{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31} = Dossier compressé () []
{BD472F60-27FA-11cf-B8B4-444553540000} = Compressed (zipped) Folder Right Drag Handler () []
{888DCA60-FC0A-11CF-8F0F-00C04FD7D062} = Compressed (zipped) Folder SendTo Target () []
{f39a0dc0-9cc8-11d0-a599-00c04fd64433} = Fichier de chaîne () []
{f3aa0dc0-9cc8-11d0-a599-00c04fd64434} = Raccourci de chaîne () []
{f3ba0dc0-9cc8-11d0-a599-00c04fd64435} = Channel Handler Object () []
{f3da0dc0-9cc8-11d0-a599-00c04fd64437} = Channel Menu () []
{f3ea0dc0-9cc8-11d0-a599-00c04fd64438} = Channel Properties () []
{63da6ec0-2e98-11cf-8d82-444553540000} = FTP Folders Webview () []
{883373C3-BF89-11D1-BE35-080036B11A03} = Microsoft DocProp Shell Ext () []
{A9CF0EAE-901A-4739-A481-E35B73E47F6D} = Microsoft DocProp Inplace Edit Box Control () []
{8EE97210-FD1F-4B19-91DA-67914005F020} = Microsoft DocProp Inplace ML Edit Box Control () []
{0EEA25CC-4362-4A12-850B-86EE61B0D3EB} = Microsoft DocProp Inplace Droplist Combo Control () []
{6A205B57-2567-4A2C-B881-F787FAB579A3} = Microsoft DocProp Inplace Calendar Control () []
{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33} = Microsoft DocProp Inplace Time Control () []
{8A23E65E-31C2-11d0-891C-00A024AB2DBB} = Directory Query UI () []
{9E51E0D0-6E0F-11d2-9601-00C04FA31A86} = Shell properties for a DS object () []
{163FDC20-2ABC-11d0-88F0-00A024AB2DBB} = Directory Object Find () []
{F020E586-5264-11d1-A532-0000F8757D7E} = Directory Start/Search Find () []
{0D45D530-764B-11d0-A1CA-00AA00C16E65} = Directory Property UI () []
{62AE1F9A-126A-11D0-A14B-0800361B1103} = Directory Context Menu Verbs () []
{ECF03A33-103D-11d2-854D-006008059367} = MyDocs Copy Hook () []
{ECF03A32-103D-11d2-854D-006008059367} = MyDocs Drop Target () []
{4a7ded0a-ad25-11d0-98a8-0800361b1103} = MyDocs Properties () []
{750fdf0e-2a26-11d1-a3ea-080036587f03} = Offline Files Menu () []
{10CFC467-4392-11d2-8DB4-00C04FA31A66} = Offline Files Folder Options () []
{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E} = Dossier Fichiers hors connexion () []
{143A62C8-C33B-11D1-84FE-00C04FA34A14} = Microsoft Agent Character Property Sheet Handler () []
{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6} = DfsShell () []
{60fd46de-f830-4894-a628-6fa81bc0190d} = %DESC_PublishDropTarget% () []
{7A80E4A8-8005-11D2-BCF8-00C04F72C717} = MMC Icon Handler () []
{0CD7A5C0-9F37-11CE-AE65-08002B2E1262} = .CAB file viewer () []
{32714800-2E5F-11d0-8B85-00AA0044F941} = Des &personnes... () []
{8DD448E6-C188-4aed-AF92-44956194EB1F} = Windows Media Player Burn Audio CD Context Menu Handler () []
{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C} = Windows Media Player Play as Playlist Context Menu Handler () []
{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD} = Windows Media Player Add to Playlist Context Menu Handler () []
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} = Dossiers Web () []
{1D2680C9-0E2A-469d-B787-065558BC7D43} = Fusion Cache () []
{0006F045-0000-0000-C000-000000000046} = Microsoft Outlook Custom Icon Handler () []
{950FF917-7A57-46BC-8017-59D9BF474000} = Shell Extension for CDRW () []
{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D} = Messenger Sharing Folders () []
{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0} = Set Program Access and Defaults () []
{596AB062-B4D2-4215-9F74-E9109B0A8153} = Previous Versions Property Page () []
{9DB7A13C-F208-4981-8353-73CC61AE2783} = Previous Versions () []
{692F0339-CBAA-47e6-B5B5-3B84DB604E87} = Extensions Manager Folder () []
{21569614-B795-46b1-85F4-E737A8DC09AD} = Shell Search Band () []
{640167b4-59b0-47a6-b335-a6b3c0695aea} = Portable Media Devices () []
{35786D3C-B075-49b9-88DD-029876E11C01} = Portable Devices () []
{D6791A63-E7E2-4fee-BF52-5DED8E86E9B8} = Portable Devices Menu () []
{F1FE4FF4-9C8F-49ED-BBCC-92E9F28D6DE8} = PhotoContextMenu () []
{B416E3EF-8EE0-49A3-A61C-D3F1C1DA51C9} = cltContextMenu () []
{806CCED1-00A0-4287-911B-6DC0A79F5DB8} = Mes Tirage () []
{472083B0-C522-11CF-8763-00608CC02F24} = avast () []
{BD88A479-9623-4897-8546-BC62B9628F44} = SPTHandler () []

Winlogon Notify Scan
WgaLogon = WgaLogon.dll (C:\WINDOWS\system32\WgaLogon.dll) [Microsoft Corporation]

Services Scan
"aswUpdSv" = C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASWUPDSV.EXE [ALWIL Software]
"ati2mtag" = C:\WINDOWS\System32\DRIVERS\ati2mtag.sys [ATI Technologies Inc.]
"avast! Antivirus" = C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE [ALWIL Software]
"avast! Mail Scanner" = C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE [ALWIL Software]
"avast! Web Scanner" = C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE [ALWIL Software]
"basic2" = C:\WINDOWS\System32\DRIVERS\HSF_BSC2.sys [Conexant]
"catchme" = C:\DOCUME~1\CHEZNO~1\LOCALS~1\Temp\catchme.sys []
"dmboot" = C:\WINDOWS\System32\drivers\dmboot.sys [Microsoft Corp., Veritas Software]
"dmio" = C:\WINDOWS\System32\drivers\dmio.sys [Microsoft Corp., Veritas Software]
"dmload" = C:\WINDOWS\System32\drivers\dmload.sys [Microsoft Corp., Veritas Software.]
"Fallback" = C:\WINDOWS\System32\DRIVERS\HSF_FALL.sys [Conexant]
"Fsks" = C:\WINDOWS\System32\DRIVERS\HSF_FSKS.sys [Conexant]
"FTRTSVC" = C:\WINDOWS\System32\FTRTSVC.exe [France Telecom]
"HSFHWBS2" = C:\WINDOWS\System32\DRIVERS\HSFHWBS2.sys [Conexant Systems, Inc.]
"HSF_DP" = C:\WINDOWS\System32\DRIVERS\HSF_DP.sys [Conexant Systems, Inc.]
"hsf_msft" = C:\WINDOWS\System32\DRIVERS\HSF_MSFT.sys [Conexant]
"InCDPass" = C:\WINDOWS\System32\DRIVERS\InCDPass.sys [Ahead Software]
"InCDsrv" = C:\Program Files\Ahead\InCD\InCDsrv.exe [AHEAD Software]
"K56" = C:\WINDOWS\System32\DRIVERS\HSF_K56K.sys [Conexant]
"mdmxsdk" = C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys [Conexant]
"nvax" = C:\WINDOWS\system32\drivers\nvax.sys [NVIDIA Corporation]
"NVENET" = C:\WINDOWS\System32\DRIVERS\NVENET.sys [NVIDIA Corporation]
"nvnforce" = C:\WINDOWS\system32\drivers\nvapu.sys [NVIDIA Corporation]
"nv_agp" = C:\WINDOWS\System32\DRIVERS\nv_agp.sys [NVIDIA Corporation]
"OPTENET_FILTER" = C:\Program Files\Controle Parental\bin\optproxy.exe [Contrôle Parental]
"PCAMPR5" = C:\WINDOWS\system32\PCAMPR5.SYS []
"PCANDIS5" = C:\WINDOWS\SYSTEM32\PCANDIS5.SYS [Printing Communications Assoc., Inc. (PCAUSA)]
"PID_08A0" = C:\WINDOWS\system32\DRIVERS\LV302AV.SYS [Labtec Inc.]
"Ptilink" = C:\WINDOWS\System32\DRIVERS\ptilink.sys [Parallel Technologies, Inc.]
"PxHelp20" = C:\WINDOWS\System32\DRIVERS\PxHelp20.sys [Sonic Solutions]
"Rksample" = C:\WINDOWS\System32\DRIVERS\HSF_SAMP.sys [Conexant]
"Secdrv" = C:\WINDOWS\System32\DRIVERS\secdrv.sys []
"SoftFax" = C:\WINDOWS\System32\DRIVERS\HSF_FAXX.sys [Conexant]
"sp_rsdrv2" = C:\WINDOWS\SYSTEM32\DRIVERS\SP_RSDRV2.SYS [Crawler.com]
"sp_rssrv" = C:\PROGRAM FILES\SPYWARE TERMINATOR\SP_RSSER.EXE [Crawler.com]
"SQTECH905C" = C:\WINDOWS\System32\Drivers\Capt905c.sys [Service & Quality Technology.]
"Tones" = C:\WINDOWS\System32\DRIVERS\HSF_TONE.sys [Conexant]
"V124" = C:\WINDOWS\System32\DRIVERS\HSF_V124.sys [Conexant]
"winachsf" = C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys [Conexant Systems, Inc.]

Protocol Filters Scan
application/octet-stream = {1E66F26B-79EE-11D2-8710-00C04F79ED0D} () []
application/x-complus = {1E66F26B-79EE-11D2-8710-00C04F79ED0D} () []
application/x-msdownload = {1E66F26B-79EE-11D2-8710-00C04F79ED0D} () []
Class Install Handler = {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} () []
deflate = {8f6b0360-b80d-11d0-a9b3-006097942311} () []
gzip = {8f6b0360-b80d-11d0-a9b3-006097942311} () []
lzdhtml = {8f6b0360-b80d-11d0-a9b3-006097942311} () []
text/webviewhtml = {733AC4CB-F1A4-11d0-B951-00A0C90312E1} () []

Hosts Scan
LOCALHOST mapping = 1

IE Scan
IERESET.INF missing Signature="$CHICAGO$"
IERESET.INF missing AdvancedINF=2.5,"You need a new version of advpack.dll"
IERESET.INF missing AddReg=RestoreHomePage.reg
IERESET.INF missing HKCU,"Software\Microsoft\Internet Explorer\Main","Start Page",0,%START_PAGE_URL%
IERESET.INF missing HKLM,"Software\Microsoft\Internet Explorer\Main","Default_Page_URL",0,%START_PAGE_URL%
IERESET.INF missing HKLM,"Software\Microsoft\Internet Explorer\Main","Default_Search_URL",0,%SEARCH_PAGE_URL%
IERESET.INF missing HKLM,"Software\Microsoft\Internet Explorer\Main","Search Page",0,%SEARCH_PAGE_URL%
IERESET.INF missing HKLM,"Software\Microsoft\Internet Explorer\Main\UrlTemplate","1",0,"www.%s.com"
IERESET.INF missing HKLM,"Software\Microsoft\Internet Explorer\Main\UrlTemplate","2",0,"www.%s.org"
IERESET.INF missing HKLM,"Software\Microsoft\Internet Explorer\Main\UrlTemplate","3",0,"www.%s.net"
IERESET.INF missing HKLM,"Software\Microsoft\Internet Explorer\Main\UrlTemplate","4",0,"www.%s.edu"
IERESET.INF missing HKCU,"Software\Microsoft\Internet Explorer\Main","Search Page",0,%SEARCH_PAGE_URL%
IERESET.INF missing HKCU,"Software\Microsoft\Internet Explorer\SearchUrl","Provider",0,""
IERESET.INF missing HKLM,"Software\Microsoft\Internet Explorer\Search","SearchAssistant",0,"https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm"
IERESET.INF missing HKLM,"Software\Microsoft\Internet Explorer\Search","CustomizeSearch",0,"https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm"
IERESET.INF missing HKLM,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\SafeSites",%SAFESITE_VALUE%,0,"https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89*"
IERESET.INF missing HKLM,"Software\Microsoft\Internet Explorer\Main\UrlTemplate","5"
IERESET.INF missing HKLM,"Software\Microsoft\Internet Explorer\Main\UrlTemplate","6"
IERESET.INF missing HKLM,"Software\Microsoft\Internet Explorer\Main\UrlTemplate","7"
IERESET.INF missing HKLM,"Software\Microsoft\Internet Explorer\Main\UrlTemplate","8"
IERESET.INF missing HKLM,"Software\Microsoft\Internet Explorer\Main\UrlTemplate","9"
IERESET.INF missing HKCU,"Software\Microsoft\Internet Explorer\Main","AutoSearch"
IERESET.INF missing SEARCH_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
IERESET.INF missing AddReg=RestoreBrowserSettings.reg
IERESET.INF missing DelReg=DeleteTemplates.reg or DelReg=DeleteTemplates.reg, DeleteAutosearch.reg
IERESET.INF missing START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome" or START_PAGE_URL="https://www.msn.com/fr-fr/"
IERESET.INF missing SAFESITE_VALUE="https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fhome.microsoft.com%2faccess%2fallinone.asp%3f" or SAFESITE_VALUE="ie.search.msn.com"
IERESET.INF missing MS_START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome" or MS_START_PAGE_URL="https://www.msn.com/fr-fr/"
URLSearchHook = {08C06D61-F1F3-4799-86F8-BE1A89362C85} () [] HIJACK WARNING!
URLSearchHook = {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} () [] HIJACK WARNING!

WinSock2 Scan
Protocol Entry 000000000001 = C:\Program Files\Controle Parental\bin\lsp.dll []

et après, je suis allée sur MSN, dans la boite mail, et là... About: Blank qui ne s"est pas ouvert, juste inscrit en bas dans la barre des taches...

J'ai peur que ça ne soit pas fini...

@lydia03par ailleurs, dans mes messageries orange, on me signale beaucoup de messages indesirables

@lydia03mais par contre, on dirait que je n'ai plus de pub intempestives

@lydia03ca c'est normal on en a tous !

OK

Voici le rapport hijackthis :

Logfile of HijackThis v1.99.1
Scan saved at 14:38:44, on 16/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Controle Parental\bin\optproxy.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\Explorer.EXE
C:\ATI-CPanel\atiptaxx.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Mes Tirages Photo\TiragesPhoto.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\LogProtect\LogProtect.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\LogProtect\lpwchdg.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: _URLHandler - {86005BD2-D46B-448F-8232-BF29E10BC5A5} - C:\PROGRA~1\MESTIR~1\MYPHOT~1.DLL
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - c:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [MesTiragesPhoto] C:\Program Files\Mes Tirages Photo\TiragesPhoto.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [LogProtect] "C:\Program Files\LogProtect\LogProtect.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\Broderbund\PrintMaster\PMremind.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?248cba23f08849ad85db31cb2c74d23f
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?248cba23f08849ad85db31cb2c74d23f
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O12 - Plugin for .fpx: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O12 - Plugin for .ivr: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Control Parental (OPTENET_FILTER) - Contrôle Parental - C:\Program Files\Controle Parental\bin\optproxy.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

quant au scan en ligne, j'y vais de ce pas...

voici le scan bitdefender :

BitDefender Online Scanner

Rapport d'analyse généré à: Mon, Jul 16, 2007 - 16:02:47

Voie d'analyse: A:\;C:\;D:\;E:\;

Statistiques

Temps
01:12:10

Fichiers
251678

Directoires
10292

Secteurs de boot
2

Archives
9316

Paquets programmes
11628

Résultats

Virus identifiés
1

Fichiers infectés
2

Fichiers suspects
0

Avertissements
0

Désinfectés
0

Fichiers effacés
2

Info sur les moteurs

Définition virus
672315

Version des moteurs
AVCORE v1.0 (build 2410) (i386) (Jun 12 2007 21:08:27)

Analyse des plugins
14

Archive des plugins
38

Unpack des plugins
6

E-mail plugins
6

Système plugins
1

Paramètres d'analyse

Première action
Désinfecté

Seconde Action
Supprimé

Heuristique
Oui

Acceptez les avertissements
Oui

Extensions analysées
*;

Excludez les extensions

Analyse d'emails
Oui

Analyse des Archives
Oui

Analyser paquets programmes
Oui

Analyse des fichiers
Oui

Analyse de boot
Oui

Fichier analysé
Statut

C:\System Volume Information\_restore{F532DE27-933A-4B91-8B6E-495361FD6A80}\RP439\A0304187.exe=>(NSIS o)=>zlib_nsis0001
Infecté par: Trojan.Hotbar.A

C:\System Volume Information\_restore{F532DE27-933A-4B91-8B6E-495361FD6A80}\RP439\A0304187.exe=>(NSIS o)=>zlib_nsis0001
Echec de la désinfection

C:\System Volume Information\_restore{F532DE27-933A-4B91-8B6E-495361FD6A80}\RP439\A0304187.exe=>(NSIS o)=>zlib_nsis0001
Supprimé

C:\System Volume Information\_restore{F532DE27-933A-4B91-8B6E-495361FD6A80}\RP439\A0304187.exe=>(NSIS o)
Echec de la mise à jour

C:\System Volume Information\_restore{F532DE27-933A-4B91-8B6E-495361FD6A80}\RP441\A0311251.exe=>(NSIS o)=>zlib_nsis0001
Infecté par: Trojan.Hotbar.A

C:\System Volume Information\_restore{F532DE27-933A-4B91-8B6E-495361FD6A80}\RP441\A0311251.exe=>(NSIS o)=>zlib_nsis0001
Echec de la désinfection

C:\System Volume Information\_restore{F532DE27-933A-4B91-8B6E-495361FD6A80}\RP441\A0311251.exe=>(NSIS o)=>zlib_nsis0001
Supprimé

C:\System Volume Information\_restore{F532DE27-933A-4B91-8B6E-495361FD6A80}\RP441\A0311251.exe=>(NSIS o)
Echec de la mise à jour

je passe à ce que tu viens de m'envoyer

voici le rapport navilog :

Search Navipromo version 2.0.5 commencé le 16/07/2007 à 16:13:51,37

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Poster ce rapport sur le forum pour le faire analyser !!!
!!! Ne pas lancer la partie désinfection sans l'avis d'un spécialiste !!!

Fix lancé depuis C:\Program Files\navilog1
Mise a jour le 01.07.2007 a 12h00 by IL-MAFIOSO

Executé en mode normal

*** Recherche Programmes installes ***

*** Recherche dossiers dans C:\WINDOWS ***

*** Recherche dossiers dans C:\Program Files ***

*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***

*** Recherche dossiers dans C:\Documents and Settings\chez nous\Application Data ***

*** Recherche avec BlackLight Engine/F-secure ***
BlackLight Engine est un produit de F-secure, pour + d'infos :
https://www.f-secure.com/en

F-SECURE BLACKLIGHT ROOTKIT ELIMINATOR
======================================

Copyright 2005-2006 F-Secure Corporation. All rights reserved.
This is a beta version. It will expire on 1st of October, 2007.
Version information: 2.2.1064.

[+] Started on 07/16/07 at 16:13:52.
[+] Initializing ...
[+] Starting scan, press Ctrl-C to abort.
[+] Scanning for hidden items ..................................................................................................
[+] Scan complete.
[+] Summary: 0 hidden item(s) found, 0 scheduled for renaming.
[+] Exited on 07/16/07 at 16:24:34 (return code = 0).

*** Recherche fichiers ***

*** Recherche cles registre ***

Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs]

Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage]

Recherche Clé Magic Control

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:

2)Recherche Heuristique :
*
**
***
****
*****
******
*******
********

3)Recherche Certificats :

*** Analyse Terminé le 16/07/2007 à 16:24:54,50 ***

et je continue...

c'est quoi des "traces de surf "?