Lenteur sous Internet Explorer

morgan24 -  
Bonjour,
J'ai depuis plusieurs mois mon pc qui est très lent sous Internet Explorer, les pages sont très lentes à télécharger. J'ai bien peur que celà vienne d'un virus. Comment puis je résoudre ce problème ?
Merci d'avance
Configuration: Windows XP
Internet Explorer 6.0

40 réponses

Résumé de la discussion

Problème central : un ordinateur sous Windows XP et Internet Explorer 6 présente une lenteur marquée lors du chargement des pages et des risques de virus. Plusieurs réponses proposent des mesures techniques, notamment la mise à jour d'IE, l'exécution d'outils de détection et de suppression, et l’analyse des rapports avec HijackThis, ComboFix ou UsbFix. Les échanges évoquent des infections multiples, des fichiers et autoruns persistants, et des résultats de scans qui montrent des éléments à nettoyer ou à surveiller. En dernier lieu, certains échanges indiquent des rapports de nettoyage répétés et des suppressions d’autorun et d’éléments persistants, sans conclusion commune sur l’état actuel et l’efficacité des mesures.

Bobot (l’IA à votre service)
  1. Destrio5 Modérateur
    Salut,

    - Télécharge HijackThis V 2.02 (HijackThis Installer) :
    http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

    - Fais un double-clic sur HJTInstall.exe afin de lancer l'installation

    - Clique sur Install ensuite sur I Accept

    - Clique sur Do a scan system and save log file

    - Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse.
    1. morgan24 Auteur
      Ok, merci pour votre réponse, ci dessous le résultat :

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 22:18:27, on 09/10/2008
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\System32\alg.exe
      C:\WINDOWS\system32\RUNDLL32.EXE
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\Program Files\Google\Google Talk\googletalk.exe
      C:\Program Files\MSN Messenger\usnsvc.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Controle virus\Trend Micro\HijackThis\HijackThis.exe
      C:\WINDOWS\system32\wbem\wmiprvse.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.fr/?gws_rd=ssl
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.files-ftp.com/~unicorni/phpBB2/index.php
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O4 - HKLM\..\Run: [HB Kernel] RUNDLL32.EXE C:\WINDOWS\system32\HBKrnl.dll,DllRegisterServer
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - HKLM\..\Policies\Explorer\Run: [MSDWG32] LYLoadbr.exe
      O4 - HKLM\..\Policies\Explorer\Run: [MSDCG32 ] LYLeador.exe
      O4 - HKLM\..\Policies\Explorer\Run: [MSDOG32] LYLoador.exe
      O4 - HKLM\..\Policies\Explorer\Run: [MSDSG32] LYLoadar.exe
      O4 - HKLM\..\Policies\Explorer\Run: [MSDMG32] LYLoadmr.exe
      O4 - HKLM\..\Policies\Explorer\Run: [MSDHG32] LYLoadhr.exe
      O4 - HKLM\..\Policies\Explorer\Run: [MSDQG32] LYLoadqr.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O14 - IERESET.INF: START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php
      O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
      O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
      O20 - AppInit_DLLs: msosmhfp02.dll,msosdrop01.dll,msosdohs01.dll
      O23 - Service: 3AB3475E - Unknown owner - C:\WINDOWS\system32\58790406.EXE (file missing)
      O23 - Service: 4545E29B - Unknown owner - C:\WINDOWS\system32\9A7976F5.EXE
      1. Destrio5 Modérateur
        C'est une blague ?

        ---> Installe Antivir :
        http://www.commentcamarche.net/telecharger/telecharger 55 antivir

        - Télécharge et installe MalwareByte's Anti-Malware :
        http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

        - Mets-le à jour

        - Redémarre en mode sans échec (Recommandé) :
        https://blog.sosordi.net/

        - Choisis ta session habituelle

        - Fais un scan complet avec MalwareByte's Anti-Malware

        - Supprime tout ce que le logiciel trouve, enregistre le rapport

        - Redémarre en mode normal et poste le rapport ici

        Tutorial :
        https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
        1. morgan24 Auteur
          Bjr,
          J'ai donc suivi vos instructions, pour ce qui concerne l'antivirus je l'ai supprimé car impossible de me servir de mon pc, une fenetre en permanence me trouve des probs et ça dur plusieurs heures, obligé de le virer !!!

          Voici le rapport :
          Malwarebytes' Anti-Malware 1.28
          Version de la base de données: 1248
          Windows 5.1.2600 Service Pack 2

          10/10/2008 12:19:13
          mbam-log-2008-10-10 (12-19-03).txt

          Type de recherche: Examen complet (C:\|)
          Eléments examinés: 101243
          Temps écoulé: 1 hour(s), 18 minute(s), 47 second(s)

          Processus mémoire infecté(s): 0
          Module(s) mémoire infecté(s): 0
          Clé(s) du Registre infectée(s): 7
          Valeur(s) du Registre infectée(s): 7
          Elément(s) de données du Registre infecté(s): 1
          Dossier(s) infecté(s): 0
          Fichier(s) infecté(s): 50

          Processus mémoire infecté(s):
          (Aucun élément nuisible détecté)

          Module(s) mémoire infecté(s):
          (Aucun élément nuisible détecté)

          Clé(s) du Registre infectée(s):
          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msfpfis64 (Spyware.OnlineGames) -> No action taken.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tqat.exe (Security.Hijack) -> No action taken.
          HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\fpids32 (Rootkit.Agent) -> No action taken.
          HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\fpids32 (Rootkit.Agent) -> No action taken.
          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fpids32 (Rootkit.Agent) -> No action taken.
          HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msfpfis64 (Rootkit.Agent) -> No action taken.
          HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\msfpfis64 (Rootkit.Agent) -> No action taken.

          Valeur(s) du Registre infectée(s):
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msdcg32 (Spyware.OnlineGames) -> No action taken.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msdwg32 (Spyware.OnLineGames) -> No action taken.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msdog32 (Spyware.OnLineGames) -> No action taken.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msdsg32 (Spyware.OnLineGames) -> No action taken.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msdmg32 (Spyware.OnLineGames) -> No action taken.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msdhg32 (Spyware.OnLineGames) -> No action taken.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msdqg32 (Spyware.OnLineGames) -> No action taken.

          Elément(s) de données du Registre infecté(s):
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> No action taken.

          Dossier(s) infecté(s):
          (Aucun élément nuisible détecté)

          Fichier(s) infecté(s):
          C:\Documents and Settings\Morgan\Local Settings\Temp\tmp3.tmp (Spyware.OnLineGames) -> No action taken.
          C:\Documents and Settings\Morgan\Local Settings\Temp\tmp4.tmp (Spyware.OnLineGames) -> No action taken.
          C:\Documents and Settings\Morgan\Local Settings\Temp\tmp6.tmp (Spyware.OnLineGames) -> No action taken.
          C:\Documents and Settings\Morgan\Local Settings\Temp\tmp7.tmp (Spyware.OnLineGames) -> No action taken.
          C:\Documents and Settings\Morgan\Local Settings\Temp\tmp8.tmp (Spyware.OnLineGames) -> No action taken.
          C:\Documents and Settings\Morgan\Local Settings\Temp\tmp8D.tmp (Spyware.OnLineGames) -> No action taken.
          C:\Documents and Settings\Morgan\Local Settings\Temp\tmp9.tmp (Spyware.OnLineGames) -> No action taken.
          C:\Documents and Settings\Morgan\Local Settings\Temp\tmpA.tmp (Spyware.OnLineGames) -> No action taken.
          C:\Documents and Settings\Morgan\Local Settings\Temp\tmpC.tmp (Spyware.OnLineGames) -> No action taken.
          C:\Documents and Settings\Morgan\Local Settings\Temp\tmpD.tmp (Spyware.OnLineGames) -> No action taken.
          C:\Documents and Settings\Morgan\Local Settings\Temp\tmpE.tmp (Spyware.OnLineGames) -> No action taken.
          C:\Documents and Settings\Morgan\Local Settings\Temporary Internet Files\Content.IE5\CXINK9QZ\e47e57844ef30ab4[1].exe (Trojan.Downloader) -> No action taken.
          C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP121\A0074330.DLL (Trojan.Downloader) -> No action taken.
          C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP144\A0088347.EXE (Trojan.Downloader) -> No action taken.
          C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP150\A0092366.EXE (Trojan.Downloader) -> No action taken.
          C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP162\A0104459.exe (Trojan.Downloader) -> No action taken.
          C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP162\A0104460.EXE (Trojan.Downloader) -> No action taken.
          C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP162\A0104548.exe (Spyware.OnlineGames) -> No action taken.
          C:\WINDOWS\AVPSrv.exE (Spyware.OnlineGames) -> No action taken.
          C:\WINDOWS\DbgHlp32.exe (Spyware.OnlineGames) -> No action taken.
          C:\WINDOWS\edzeypsa.exe (Spyware.OnlineGames) -> No action taken.
          C:\WINDOWS\fmsbbqi.exe (Spyware.OnlineGames) -> No action taken.
          C:\WINDOWS\Kvsc3.exE (Spyware.OnlineGames) -> No action taken.
          C:\WINDOWS\LotusHlp.exe (Spyware.OnlineGames) -> No action taken.
          C:\WINDOWS\mppds.EXE (Spyware.OnlineGames) -> No action taken.
          C:\WINDOWS\msccrt.exe (Spyware.OnlineGames) -> No action taken.
          C:\WINDOWS\NAVMon32.exE (Spyware.OnlineGames) -> No action taken.
          C:\WINDOWS\PTSShell.exe (Spyware.OnlineGames) -> No action taken.
          C:\WINDOWS\tciocp32.exe (Spyware.OnlineGames) -> No action taken.
          C:\WINDOWS\upxdnd.exe (Spyware.OnlineGames) -> No action taken.
          C:\WINDOWS\WINSvr32.exE (Spyware.OnlineGames) -> No action taken.
          C:\WINDOWS\system32\k120808504313.exe (Spyware.OnlineGames) -> No action taken.
          C:\WINDOWS\system32\k120808538013.exe (Spyware.OnlineGames) -> No action taken.
          C:\WINDOWS\system32\k120811257810.exe (Spyware.OnlineGames) -> No action taken.
          C:\WINDOWS\system32\msosdohs00.dll (Spyware.OnLineGames) -> No action taken.
          C:\WINDOWS\system32\msosdohs01.dll (Spyware.OnLineGames) -> No action taken.
          C:\WINDOWS\system32\n1223585501k.exe (Trojan.Downloader) -> No action taken.
          C:\WINDOWS\system32\n1223585527k.exe (Trojan.Downloader) -> No action taken.
          C:\WINDOWS\system32\n1223585549k.exe (Trojan.Downloader) -> No action taken.
          C:\WINDOWS\system32\n1223585570k.exe (Trojan.Downloader) -> No action taken.
          C:\WINDOWS\system32\n1223585600k.exe (Trojan.Downloader) -> No action taken.
          C:\WINDOWS\system32\n1223585623k.exe (Trojan.Downloader) -> No action taken.
          C:\WINDOWS\system32\msosdrop00.dll (Spyware.OnlineGames) -> No action taken.
          C:\WINDOWS\system32\msosmhfp00.dll (Spyware.OnlineGames) -> No action taken.
          C:\WINDOWS\fmbiost.exe (Spyware.OnlineGames) -> No action taken.
          C:\WINDOWS\WSockDrv32.exe (Trojan.Agent) -> No action taken.
          C:\WINDOWS\system32\msosomec.dll (Spyware.OnLineGames) -> No action taken.
          C:\WINDOWS\msosomec.exe (Spyware.OnLineGames) -> No action taken.
          C:\WINDOWS\system32\drivers\msosfpids32.sys (Rootkit.Agent) -> No action taken.
          C:\WINDOWS\system32\drivers\msosmsfpfis64.sys (Rootkit.Agent) -> No action taken.

          Il semblerait que mon pc soit un peu visité !!! C'est quoi ce OnlineGames, je ne suis jamais sur ce genre de site !!
          4. Destrio5 Modérateur
            Tu vas me faire un scan avec ComboFix.

            ---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
            http://download.bleepingcomputer.com/sUBs/ComboFix.exe

            /!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

            ---> Double-clique sur Combofix.exe
            Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
            Accepte en cliquant sur "Oui"

            ---> Mets-le en langue française F
            Tape sur la touche 1 (Yes) pour démarrer le scan.

            /!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

            En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

            Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

            /!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

            Note : Le rapport se trouve également là : C:\ComboFix\Combofix.txt
            1. morgan24 Auteur
              Ci dessous le rapport :

              ComboFix 08-10-09.06 - Morgan 2008-10-10 13:09:30.1 - NTFSx86
              Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.115 [GMT 2:00]
              Lancé depuis: C:\Documents and Settings\Morgan\Mes documents\Mes fichiers reçus\ComboFix.exe
              * Un nouveau point de restauration a été créé

              [COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
              .

              (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
              .

              C:\_uninsep.bat
              C:\Autorun.inf
              C:\WINDOWS\cmdbcs.exe
              C:\WINDOWS\dndsioc.exe
              C:\WINDOWS\dxtmechk
              C:\WINDOWS\mfchlp32.exe
              C:\WINDOWS\msimms32.exe
              C:\WINDOWS\SHAProc.exe
              C:\WINDOWS\system32\k12076774728.exe
              C:\WINDOWS\system32\k12080245446.exe
              C:\WINDOWS\system32\k12080245468.exe
              C:\WINDOWS\system32\k120808505323.exe
              C:\WINDOWS\system32\k120808505523.exe
              C:\WINDOWS\system32\k120808538312.exe
              C:\WINDOWS\system32\k120808538413.exe
              C:\WINDOWS\system32\k120808538416.exe
              C:\WINDOWS\system32\llk1205697395.h
              C:\WINDOWS\system32\llk1207677454.h
              C:\WINDOWS\system32\llk1207677457.h
              C:\WINDOWS\system32\llk1207943048.h
              C:\WINDOWS\system32\llk1208024531.h
              C:\WINDOWS\system32\llk1208024532.h
              C:\WINDOWS\system32\llk1208085363.h
              C:\WINDOWS\system32\llk1208085365.h
              C:\WINDOWS\system32\llk1208110503.h
              C:\WINDOWS\system32\llk1208110505.h
              C:\WINDOWS\system32\llk1208110645.h
              C:\WINDOWS\system32\llk1208112564.h
              C:\WINDOWS\system32\llk1208112565.h
              C:\WINDOWS\system32\msosdohs.dat
              C:\WINDOWS\system32\msosdrop.dat
              C:\WINDOWS\system32\msosdrop01.dll
              C:\WINDOWS\system32\msosmhfp.dat
              C:\WINDOWS\system32\msosmhfp01.dll
              C:\WINDOWS\system32\msosmhfp02.dll
              C:\WINDOWS\system32\REGKEY.hiv
              C:\WINDOWS\Update.dat

              .
              ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
              .

              -------\Legacy_DOHS
              -------\Legacy_DROP
              -------\Legacy_FPIDS32
              -------\Legacy_HBKERNEL
              -------\Legacy_MHFP
              -------\Legacy_MSFPFIS64
              -------\Service_dohs
              -------\Service_drop
              -------\Service_HBKernel
              -------\Service_mhfp

              ((((((((((((((((((((((((((((( Fichiers créés du 2008-09-10 au 2008-10-10 ))))))))))))))))))))))))))))))))))))
              .

              2008-10-09 22:41 . 2008-10-09 22:41 <REP> d-------- C:\Documents and Settings\Morgan\Application Data\Malwarebytes
              2008-10-09 22:41 . 2008-10-09 22:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
              2008-10-09 22:41 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
              2008-10-09 22:41 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
              2008-10-09 22:17 . 2008-10-09 22:41 <REP> d-------- C:\Program Files\Controle virus
              2008-10-07 13:27 . 2008-10-07 13:27 268 --ah----- C:\sqmdata19.sqm
              2008-10-07 13:27 . 2008-10-07 13:27 244 --ah----- C:\sqmnoopt19.sqm
              2008-10-07 09:31 . 2008-10-07 09:31 268 --ah----- C:\sqmdata18.sqm
              2008-10-07 09:31 . 2008-10-07 09:31 244 --ah----- C:\sqmnoopt18.sqm
              2008-10-06 10:44 . 2008-10-06 10:44 268 --ah----- C:\sqmdata17.sqm
              2008-10-06 10:44 . 2008-10-06 10:44 244 --ah----- C:\sqmnoopt17.sqm
              2008-10-05 22:54 . 2008-10-05 22:54 268 --ah----- C:\sqmdata16.sqm
              2008-10-05 22:54 . 2008-10-05 22:54 244 --ah----- C:\sqmnoopt16.sqm
              2008-09-26 08:32 . 2008-09-26 08:32 <REP> d-------- C:\Program Files\Panda Security
              2008-09-26 08:32 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
              2008-09-21 12:46 . 2008-09-21 12:46 268 --ah----- C:\sqmdata15.sqm
              2008-09-21 12:46 . 2008-09-21 12:46 244 --ah----- C:\sqmnoopt15.sqm
              2008-09-17 20:24 . 2008-09-17 20:24 <REP> d-------- C:\Program Files\Fichiers communs\Vbox
              2008-09-17 20:24 . 2008-09-18 09:11 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
              2008-09-17 20:18 . 1998-10-07 13:08 327,168 --a------ C:\WINDOWS\IsUn040c.exe

              .
              (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
              .
              2008-09-18 09:18 --------- d-----w C:\Program Files\eMule
              2008-09-18 07:03 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
              .

              ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
              .
              .
              *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
              REGEDIT4

              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]

              [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
              "{00A1A824-D7A2-456A-AE04-EB9ABF822FE4}"= "C:\DOCUME~1\Morgan\LOCALS~1\Temp\k120832782519ow.dll" [2008-04-16 17120]

              [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.lnk]
              path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk
              backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

              [HKLM\~\startupfolder\C:^Documents and Settings^Morgan^Menu Démarrer^Programmes^Démarrage^GigaTribe.lnk]
              path=C:\Documents and Settings\Morgan\Menu Démarrer\Programmes\Démarrage\GigaTribe.lnk
              backup=C:\WINDOWS\pss\GigaTribe.lnkStartup

              [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioDeck]
              -ra------ 2007-08-09 16:48 528384 C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe

              [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
              --a------ 2007-11-21 04:12 3297280 C:\Program Files\Google\Google Talk\googletalk.exe

              [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
              --a------ 2007-01-19 13:55 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

              [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
              --a------ 2008-05-06 10:42 202088 C:\Program Files\TomTom HOME 2\HOMERunner.exe

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
              "%windir%\\system32\\sessmgr.exe"=
              "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
              "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
              "C:\\Program Files\\MSN Messenger\\livecall.exe"=
              "C:\\Program Files\\eMule\\eMule.exe"=

              R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544]
              R2 SBKUPNT;SBKUPNT;C:\WINDOWS\system32\Drivers\SBKUPNT.SYS [2001-07-13 14976]
              S2 3AB3475E;3AB3475E;C:\WINDOWS\system32\58790406.EXE [ ]
              S2 4545E29B;4545E29B;C:\WINDOWS\system32\9A7976F5.EXE [ ]
              S3 OEM FVNETusb (AR)(R);OEM FVNETusb (AR)(R) Service for WLAN USB Adapter (AR);C:\WINDOWS\system32\DRIVERS\vnetusbr.sys [2002-10-04 90240]

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{38771b70-1555-11dd-a49a-0040f480db44}]
              \Shell\Auto\command - E:\auto.exe
              \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3dbc2bd0-dff9-11dc-a428-806d6172696f}]
              \Shell\Auto\command - E:\auto.exe
              \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3df72850-f82b-11dc-a46d-0040f480db44}]
              \Shell\Auto\command - E:\auto.exe
              \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4567d270-5c2e-11dd-a50f-0040f480db44}]
              \Shell\Auto\command - auto.exe
              \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47e6a8a0-3e27-11dd-a4e2-0040f480db44}]
              \Shell\Auto\command - E:\auto.exe
              \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{50cb44b0-2457-11dd-a4a4-0040f480db44}]
              \Shell\Auto\command - auto.exe
              \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{63bc61be-6219-11dd-a51d-0040f480db44}]
              \Shell\Auto\command - F:\auto.exe
              \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8627d8e3-395a-11dd-a4d9-0040f480db44}]
              \Shell\Auto\command - E:\auto.exe
              \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9772b821-e5f1-11dc-a438-0040f480db44}]
              \Shell\AutoRun\command - F:\ReadMe.exe

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9772b822-e5f1-11dc-a438-0040f480db44}]
              \Shell\Auto\command - auto.exe
              \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ac11e4a0-8883-11dd-a563-0040f480db44}]
              \Shell\Auto\command - F:\auto.exe
              \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af94d950-3930-11dd-a4d6-0040f480db44}]
              \Shell\Auto\command - F:\auto.exe
              \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b87ed030-e07e-11dc-a42e-0040f480db44}]
              \Shell\Auto\command - auto.exe
              \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bc7abf00-8801-11dd-a561-0040f480db44}]
              \Shell\Auto\command - F:\auto.exe
              \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d3ee7cf1-2047-11dd-a4a3-0040f480db44}]
              \Shell\Auto\command - E:\auto.exe
              \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e20deb60-eb77-11dc-a444-0040f480db44}]
              \Shell\Auto\command - E:\auto.exe
              \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe
              .
              - - - - ORPHELINS SUPPRIMES - - - -

              MSConfigStartUp-aebdgzfe - C:\WINDOWS\edzeypsa.exe
              MSConfigStartUp-AVPSrv - C:\WINDOWS\AVPSrv.exE
              MSConfigStartUp-cmdbcs - C:\WINDOWS\cmdbcs.exe
              MSConfigStartUp-DbgHlp32 - C:\WINDOWS\DbgHlp32.exe
              MSConfigStartUp-dndsioc - C:\WINDOWS\dndsioc.exe
              MSConfigStartUp-fmbiost - C:\WINDOWS\fmbiost.exe
              MSConfigStartUp-fmsbbqi - C:\WINDOWS\fmsbbqi.exe
              MSConfigStartUp-HB Kernel - C:\WINDOWS\system32\HBKrnl.dll
              MSConfigStartUp-Kvsc3 - C:\WINDOWS\Kvsc3.exE
              MSConfigStartUp-LotusHlp - C:\WINDOWS\LotusHlp.exe
              MSConfigStartUp-mfchlp32 - C:\WINDOWS\mfchlp32.exe
              MSConfigStartUp-mppds - C:\WINDOWS\mppds.EXE
              MSConfigStartUp-msccrt - C:\WINDOWS\msccrt.exe
              MSConfigStartUp-MsIMMs32 - C:\WINDOWS\MsIMMs32.exE
              MSConfigStartUp-msosomec - C:\WINDOWS\msosomec.exe
              MSConfigStartUp-NAVMon32 - C:\WINDOWS\NAVMon32.exE
              MSConfigStartUp-NVDispDrv - C:\WINDOWS\NVDispDRV.EXE
              MSConfigStartUp-PTSShell - C:\WINDOWS\PTSShell.exe
              MSConfigStartUp-SHAProc - C:\WINDOWS\SHAProc.exe
              MSConfigStartUp-tciocp32 - C:\WINDOWS\tciocp32.exe
              MSConfigStartUp-upxdnd - C:\WINDOWS\upxdnd.exe
              MSConfigStartUp-WINSvr32 - C:\WINDOWS\WINSvr32.exE
              MSConfigStartUp-WSockDrv32 - C:\WINDOWS\vprfsg.exe

              .
              ------- Examen supplémentaire -------
              .
              FireFox -: Profile - C:\Documents and Settings\Morgan\Application Data\Mozilla\Firefox\Profiles\vryftxyb.default\
              FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fr/
              .

              **************************************************************************

              catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
              Rootkit scan 2008-10-10 13:13:07
              Windows 5.1.2600 Service Pack 2 NTFS

              Recherche de processus cachés ...

              Recherche d'éléments en démarrage automatique cachés ...

              Recherche de fichiers cachés ...

              Scan terminé avec succès
              Fichiers cachés: 0

              **************************************************************************
              .
              ------------------------ Autres processus actifs ------------------------
              .
              C:\WINDOWS\system32\wscntfy.exe
              .
              **************************************************************************
              .
              Heure de fin: 2008-10-10 13:15:00 - La machine a redémarré
              ComboFix-quarantined-files.txt 2008-10-10 11:14:56

              Avant-CF: 79 804 813 312 octets libres
              Après-CF: 80,120,328,192 octets libres

              219
              1. Destrio5 Modérateur
                /!\ Seul morgan24 peut suivre cette procédure /!\

                1/

                ---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.

                ---> Copie le texte ci-dessous par sélection puis Ctrl+C :

                KillAll::

                File::
                C:\DOCUME~1\Morgan\LOCALS~1\Temp\k120832782519ow.dll
                F:\ReadMe.exe
                E:\auto.exe
                F:\auto.exe

                DirLook::
                C:\Program Files\Controle virus

                Driver::
                3AB3475E
                4545E29B

                Registry::
                [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
                "{00A1A824-D7A2-456A-AE04-EB9ABF822FE4}"=-
                [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{38771b70-1555-11dd-a49a-0040f480db44}]
                [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3dbc2bd0-dff9-11dc-a428-806d6172696f}]
                [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3df72850-f82b-11dc-a46d-0040f480db44}]
                [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4567d270-5c2e-11dd-a50f-0040f480db44}]
                [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47e6a8a0-3e27-11dd-a4e2-0040f480db44}]
                [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{50cb44b0-2457-11dd-a4a4-0040f480db44}]
                [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{63bc61be-6219-11dd-a51d-0040f480db44}]
                [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8627d8e3-395a-11dd-a4d9-0040f480db44}]
                [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9772b821-e5f1-11dc-a438-0040f480db44}]
                [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9772b822-e5f1-11dc-a438-0040f480db44}]
                [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ac11e4a0-8883-11dd-a563-0040f480db44}]
                [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af94d950-3930-11dd-a4d6-0040f480db44}]
                [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b87ed030-e07e-11dc-a42e-0040f480db44}]
                [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bc7abf00-8801-11dd-a561-0040f480db44}]
                [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d3ee7cf1-2047-11dd-a4a3-0040f480db44}]
                [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e20deb60-eb77-11dc-a444-0040f480db44}]

                ---> Colle la sélection dans le bloc-notes

                ---> Enregistre ce fichier sur le bureau (Impératif)

                ---> Nom du fichier : CFScript
                ---> Type du fichier : tous les fichiers
                ---> Clique sur Enregistrer
                ---> Quitte le bloc-notes

                2/

                ---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
                http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

                [*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

                [*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
                Ne touche à rien tant que le scan n'est pas terminé.

                [*] Une fois le scan achevé, un rapport va s'afficher : poste-le

                [*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt
                1. morgan24 Auteur
                  Bonjour et encore merci pour votre aide, ci dessous le rapport :

                  ComboFix 08-10-10.09 - Morgan 2008-10-11 11:55:48.2 - NTFSx86
                  Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.116 [GMT 2:00]
                  Lancé depuis: C:\Documents and Settings\Morgan\Mes documents\Mes fichiers reçus\ComboFix.exe
                  Commutateurs utilisés :: C:\Documents and Settings\Morgan\Bureau\CFScript.txt
                  * Un nouveau point de restauration a été créé

                  [COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]

                  FILE ::
                  C:\DOCUME~1\Morgan\LOCALS~1\Temp\k120832782519ow.dll
                  E:\auto.exe
                  F:\auto.exe
                  F:\ReadMe.exe
                  .

                  (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                  .

                  .
                  ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
                  .

                  -------\Legacy_3AB3475E
                  -------\Legacy_4545E29B
                  -------\Service_3AB3475E
                  -------\Service_4545E29B

                  ((((((((((((((((((((((((((((( Fichiers créés du 2008-09-11 au 2008-10-11 ))))))))))))))))))))))))))))))))))))
                  .

                  2008-10-09 22:41 . 2008-10-09 22:41 <REP> d-------- C:\Documents and Settings\Morgan\Application Data\Malwarebytes
                  2008-10-09 22:41 . 2008-10-09 22:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                  2008-10-09 22:41 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
                  2008-10-09 22:41 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                  2008-10-09 22:17 . 2008-10-09 22:41 <REP> d-------- C:\Program Files\Controle virus
                  2008-10-07 13:27 . 2008-10-07 13:27 268 --ah----- C:\sqmdata19.sqm
                  2008-10-07 13:27 . 2008-10-07 13:27 244 --ah----- C:\sqmnoopt19.sqm
                  2008-10-07 09:31 . 2008-10-07 09:31 268 --ah----- C:\sqmdata18.sqm
                  2008-10-07 09:31 . 2008-10-07 09:31 244 --ah----- C:\sqmnoopt18.sqm
                  2008-10-06 10:44 . 2008-10-06 10:44 268 --ah----- C:\sqmdata17.sqm
                  2008-10-06 10:44 . 2008-10-06 10:44 244 --ah----- C:\sqmnoopt17.sqm
                  2008-10-05 22:54 . 2008-10-05 22:54 268 --ah----- C:\sqmdata16.sqm
                  2008-10-05 22:54 . 2008-10-05 22:54 244 --ah----- C:\sqmnoopt16.sqm
                  2008-09-26 08:32 . 2008-09-26 08:32 <REP> d-------- C:\Program Files\Panda Security
                  2008-09-26 08:32 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
                  2008-09-21 12:46 . 2008-09-21 12:46 268 --ah----- C:\sqmdata15.sqm
                  2008-09-21 12:46 . 2008-09-21 12:46 244 --ah----- C:\sqmnoopt15.sqm
                  2008-09-17 20:24 . 2008-09-17 20:24 <REP> d-------- C:\Program Files\Fichiers communs\Vbox
                  2008-09-17 20:24 . 2008-09-18 09:11 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
                  2008-09-17 20:18 . 1998-10-07 13:08 327,168 --a------ C:\WINDOWS\IsUn040c.exe

                  .
                  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  2008-09-18 09:18 --------- d-----w C:\Program Files\eMule
                  2008-09-18 07:03 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
                  .

                  (((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
                  .

                  ---- Directory of C:\Program Files\Controle virus ----

                  2008-10-09 22:41 8936 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\unins000.dat
                  2008-10-09 22:41 13753 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\unins000.msg
                  2008-10-09 22:40 688816 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\unins000.exe
                  2008-10-09 22:18 3013 --a------ C:\Program Files\Controle virus\Trend Micro\HijackThis\hijackthis.log
                  2008-10-09 22:17 396288 --a------ C:\Program Files\Controle virus\Trend Micro\HijackThis\HijackThis.exe
                  2008-09-10 00:04 78000 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\zlib.dll
                  2008-09-10 00:04 495280 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\vbalsgrid6.ocx
                  2008-09-10 00:03 73392 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\mbamext.dll
                  2008-09-10 00:03 61104 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\mbam.dll
                  2008-09-10 00:03 44720 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\ssubtmr6.dll
                  2008-09-10 00:03 380080 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\mbam-dor.exe
                  2008-09-10 00:03 372400 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\mbamtrayctrl.exe
                  2008-09-10 00:03 1253040 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\mbam.exe
                  2008-09-10 00:03 110256 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\mbamservice.exe
                  2008-09-09 23:52 10835 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\changes.rtf
                  2008-08-19 13:21 4117 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\license.txt
                  2008-08-18 17:03 11622 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\polish.lng
                  2008-08-04 14:58 8141 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\chineseTR.lng
                  2008-08-01 11:03 8045 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\chineseSI.lng
                  2008-07-30 20:33 11960 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\turkish.lng
                  2008-07-26 11:58 11599 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\slovak.lng
                  2008-07-23 21:10 21793 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\mbam.chm
                  2008-07-11 16:26 12876 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\spanish.lng
                  2008-07-09 12:35 13558 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\german.lng
                  2008-07-04 02:58 11779 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\russian.lng
                  2008-07-03 12:10 13924 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\albanian.lng
                  2008-07-01 16:47 11593 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\norwegian.lng
                  2008-06-29 16:29 12542 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\bulgarian.lng
                  2008-06-25 01:49 11551 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\czech.lng
                  2008-06-15 15:04 12345 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\portuguesePT.lng
                  2008-05-17 12:09 11624 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\finnish.lng
                  2008-04-14 20:50 11898 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\danish.lng
                  2008-03-13 21:09 12672 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\romanian.lng
                  2008-03-05 18:57 12174 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\swedish.lng
                  2008-03-04 22:05 12595 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\catalan.lng
                  2008-03-04 22:03 13019 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\italian.lng
                  2008-03-04 21:57 13353 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\french.lng
                  2008-03-04 21:56 12255 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\dutch.lng
                  2008-03-04 21:56 12245 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\portugueseBR.lng
                  2008-03-04 01:28 11205 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\slovenian.lng
                  2008-03-03 19:39 12048 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\hungarian.lng
                  2008-03-03 08:03 12114 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\serbian.lng
                  2008-03-02 21:33 11232 --a------ C:\Program Files\Controle virus\Malwarebytes' Anti-Malware\Languages\english.lng

                  ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  .
                  *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                  REGEDIT4

                  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]

                  [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.lnk]
                  path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk
                  backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

                  [HKLM\~\startupfolder\C:^Documents and Settings^Morgan^Menu Démarrer^Programmes^Démarrage^GigaTribe.lnk]
                  path=C:\Documents and Settings\Morgan\Menu Démarrer\Programmes\Démarrage\GigaTribe.lnk
                  backup=C:\WINDOWS\pss\GigaTribe.lnkStartup

                  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioDeck]
                  -ra------ 2007-08-09 16:48 528384 C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe

                  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
                  --a------ 2007-11-21 04:12 3297280 C:\Program Files\Google\Google Talk\googletalk.exe

                  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
                  --a------ 2007-01-19 13:55 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

                  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
                  --a------ 2008-05-06 10:42 202088 C:\Program Files\TomTom HOME 2\HOMERunner.exe

                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                  "%windir%\\system32\\sessmgr.exe"=
                  "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
                  "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
                  "C:\\Program Files\\MSN Messenger\\livecall.exe"=
                  "C:\\Program Files\\eMule\\eMule.exe"=

                  R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544]
                  R2 SBKUPNT;SBKUPNT;C:\WINDOWS\system32\Drivers\SBKUPNT.SYS [2001-07-13 14976]
                  R3 OEM FVNETusb (AR)(R);OEM FVNETusb (AR)(R) Service for WLAN USB Adapter (AR);C:\WINDOWS\system32\DRIVERS\vnetusbr.sys [2002-10-04 90240]
                  .

                  **************************************************************************

                  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                  Rootkit scan 2008-10-11 11:58:33
                  Windows 5.1.2600 Service Pack 2 NTFS

                  Recherche de processus cachés ...

                  Recherche d'éléments en démarrage automatique cachés ...

                  Recherche de fichiers cachés ...

                  Scan terminé avec succès
                  Fichiers cachés: 0

                  **************************************************************************
                  .
                  ------------------------ Autres processus actifs ------------------------
                  .
                  C:\WINDOWS\system32\wscntfy.exe
                  .
                  **************************************************************************
                  .
                  Heure de fin: 2008-10-11 12:00:12 - La machine a redémarré
                  ComboFix-quarantined-files.txt 2008-10-11 10:00:09
                  ComboFix2.txt 2008-10-10 11:15:01

                  Avant-CF: 80 189 964 288 octets libres
                  Après-CF: 80,197,976,064 octets libres

                  148
                  2. morgan24 Auteur
                    Voilà :

                    Logfile of Trend Micro HijackThis v2.0.2
                    Scan saved at 13:40, on 11/10/2008
                    Platform: Windows XP SP2 (WinNT 5.01.2600)
                    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
                    Boot mode: Normal

                    Running processes:
                    C:\WINDOWS\System32\smss.exe
                    C:\WINDOWS\system32\winlogon.exe
                    C:\WINDOWS\system32\services.exe
                    C:\WINDOWS\system32\lsass.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\WINDOWS\system32\spoolsv.exe
                    C:\WINDOWS\system32\wscntfy.exe
                    C:\Program Files\MSN Messenger\msnmsgr.exe
                    C:\WINDOWS\system32\wuauclt.exe
                    C:\WINDOWS\explorer.exe
                    C:\Program Files\internet explorer\iexplore.exe
                    C:\Program Files\Google\Google Talk\googletalk.exe
                    C:\Program Files\Controle virus\Trend Micro\HijackThis\HijackThis.exe

                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O14 - IERESET.INF: START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php
                    O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
                    O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
                    1. Destrio5 Modérateur
                      ---> Installe Antivir, fais un scan complet et poste le rapport.
                      1. morgan24 Auteur
                        Bonjour,

                        Depuis hier, je poste le rapport sur commentcamarche et je ne le vois pas apparaitre !!! Arrivez vous à lire mon rapport ?
                        1. Destrio5 Modérateur
                          A mon avis, il est bloqué au grenier, envoie-le sur destrio5@free.fr
                          1. morgan24 Auteur
                            Je viens de refaire un scan :

                            Avira AntiVir Personal
                            Report file date: dimanche 12 octobre 2008 15:57

                            Scanning for 1677110 virus strains and unwanted programs.

                            Licensed to: Avira AntiVir PersonalEdition Classic
                            Serial number: 0000149996-ADJIE-0001
                            Platform: Windows XP
                            Windows version: (Service Pack 2) [5.1.2600]
                            Boot mode: Normally booted
                            Username: SYSTEM
                            Computer name: UNICORNI-4529C1

                            Version information:
                            BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00
                            AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 08:57:53
                            AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
                            LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
                            LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
                            ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
                            ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:54:15
                            ANTIVIR2.VDF : 7.0.7.12 4066816 Bytes 08/10/2008 12:43:37
                            ANTIVIR3.VDF : 7.0.7.28 120320 Bytes 11/10/2008 12:41:54
                            Engineversion : 8.1.1.35
                            AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21
                            AESCRIPT.DLL : 8.1.0.76 319867 Bytes 11/10/2008 12:43:57
                            AESCN.DLL : 8.1.0.23 119156 Bytes 10/07/2008 12:44:49
                            AERDL.DLL : 8.1.1.2 438644 Bytes 11/10/2008 12:43:56
                            AEPACK.DLL : 8.1.2.3 364918 Bytes 11/10/2008 12:43:53
                            AEOFFICE.DLL : 8.1.0.25 196986 Bytes 11/10/2008 12:43:51
                            AEHEUR.DLL : 8.1.0.59 1438071 Bytes 11/10/2008 12:43:49
                            AEHELP.DLL : 8.1.0.15 115063 Bytes 10/07/2008 12:44:48
                            AEGEN.DLL : 8.1.0.36 315764 Bytes 11/10/2008 12:43:42
                            AEEMU.DLL : 8.1.0.7 430452 Bytes 31/07/2008 08:33:21
                            AECORE.DLL : 8.1.1.11 172406 Bytes 11/10/2008 12:43:40
                            AEBB.DLL : 8.1.0.1 53617 Bytes 10/07/2008 12:44:48
                            AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
                            AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
                            AVREP.DLL : 8.0.0.2 98344 Bytes 11/10/2008 12:43:39
                            AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
                            AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
                            AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
                            SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
                            SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
                            NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
                            RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
                            RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37

                            Configuration settings for the scan:
                            Jobname..........................: Complete system scan
                            Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
                            Logging..........................: low
                            Primary action...................: interactive
                            Secondary action.................: ignore
                            Scan master boot sector..........: on
                            Scan boot sector.................: on
                            Boot sectors.....................: C:,
                            Process scan.....................: on
                            Scan registry....................: on
                            Search for rootkits..............: off
                            Scan all files...................: Intelligent file selection
                            Scan archives....................: on
                            Recursion depth..................: 20
                            Smart extensions.................: on
                            Macro heuristic..................: on
                            File heuristic...................: medium

                            Start of the scan: dimanche 12 octobre 2008 15:57

                            The scan of running processes will be started
                            Scan process 'avscan.exe' - '1' Module(s) have been scanned
                            Scan process 'avcenter.exe' - '1' Module(s) have been scanned
                            Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
                            Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
                            Scan process 'alg.exe' - '1' Module(s) have been scanned
                            Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
                            Scan process 'avguard.exe' - '1' Module(s) have been scanned
                            Scan process 'googletalk.exe' - '1' Module(s) have been scanned
                            Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
                            Scan process 'avgnt.exe' - '1' Module(s) have been scanned
                            Scan process 'sched.exe' - '1' Module(s) have been scanned
                            Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
                            Scan process 'explorer.exe' - '1' Module(s) have been scanned
                            Scan process 'svchost.exe' - '1' Module(s) have been scanned
                            Scan process 'svchost.exe' - '1' Module(s) have been scanned
                            Scan process 'svchost.exe' - '1' Module(s) have been scanned
                            Scan process 'svchost.exe' - '1' Module(s) have been scanned
                            Scan process 'svchost.exe' - '1' Module(s) have been scanned
                            Scan process 'lsass.exe' - '1' Module(s) have been scanned
                            Scan process 'services.exe' - '1' Module(s) have been scanned
                            Scan process 'winlogon.exe' - '1' Module(s) have been scanned
                            Scan process 'csrss.exe' - '1' Module(s) have been scanned
                            Scan process 'smss.exe' - '1' Module(s) have been scanned
                            23 processes with 23 modules were scanned

                            Starting master boot sector scan:
                            Master boot sector HD0
                            [INFO] No virus was found!

                            Start scanning boot sectors:
                            Boot sector 'C:\'
                            [INFO] No virus was found!

                            Starting to scan the registry.
                            The registry was scanned ( '39' files ).

                            Starting the file scan:

                            Begin scan in 'C:\'
                            C:\pagefile.sys
                            [WARNING] The file could not be opened!
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS1028.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0093224.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS1035.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0093519.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS1044.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0095103.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS1051.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0095757.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS1069.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0098969.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS1070.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0099083.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS1071.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0099195.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS1075.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0101109.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS1114.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0105620.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS1125.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0106245.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS1126.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0106400.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS1128.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0106455.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS285.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0133212.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS372.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0145566.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS373.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0145649.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS374.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0145688.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS381.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0146466.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS396.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0149728.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS406.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0153282.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS407.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0153337.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS424.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> W0290656.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS445.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0166376.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS455.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0168178.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS462.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0171465.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS463.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0172167.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS468.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0176167.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS471.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0177273.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS478.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0178756.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS479.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0179756.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS480.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0180757.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS483.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0182813.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS491.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0184447.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS492.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0184501.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS503.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0185914.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS505.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0186123.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS522.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0190476.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS545.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0000091.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS554.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0000971.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS557.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0002157.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS577.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0008645.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS585.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0010160.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS586.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0011010.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS590.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0012394.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS603.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0015649.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS644.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0025038.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS645.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0025179.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS660.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0031959.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS735.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0038190.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS736.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0038335.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS740.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0039250.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS741.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0039430.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS748.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0042569.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS756.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0043162.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS783.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0046753.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS784.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0046826.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS820.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0051834.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS862.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0061273.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS869.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0062602.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS876.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0062919.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS878.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0064060.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS923.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0073515.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS925.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0074585.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS938.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0076030.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS948.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0077725.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS953.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0078146.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS960.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0078682.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\FS964.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> A0079014.CPY
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\Disk E\Nouveau dossier\Ancien disque dur 1\Disque local (E)\_RESTORE\ARCHIVE\RG1107801402.CAB
                            [0] Archive type: CAB (Microsoft)
                            --> SYSTEM.DAT
                            [WARNING] No further files can be extracted from this archive. The archive will be closed
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105037.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '49231fc4.qua'!
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105038.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '49231fc5.qua'!
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105039.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '484b3db6.qua'!
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105040.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '49231fc6.qua'!
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105041.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '484b3db7.qua'!
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105042.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '49231fc8.qua'!
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105043.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '49231fc7.qua'!
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105044.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '484b3db8.qua'!
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105045.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '484b3db9.qua'!
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105046.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '49231fca.qua'!
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105047.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '484b3dbb.qua'!
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105048.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '49231fc9.qua'!
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105049.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '484b3dba.qua'!
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105050.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '49231fcc.qua'!
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105051.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '484b3dbd.qua'!
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105052.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '49231fce.qua'!
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105053.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '49231fcb.qua'!
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105054.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '484b3dbc.qua'!
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105055.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '49231fcd.qua'!
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105056.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '484b3dbf.qua'!
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105057.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '49231fb0.qua'!
                            C:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP166\A0105058.exe
                            [DETECTION] Is the TR/Dropper.Gen Trojan
                            [NOTE] The file was moved to '484b3dbe.qua'!

                            End of the scan: dimanche 12 octobre 2008 18:07
                            Used time: 2:10:07 Hour(s)

                            The scan has been done completely.

                            3895 Scanning directories
                            247238 Files were scanned
                            22 viruses and/or unwanted programs were found
                            0 Files were classified as suspicious:
                            0 files were deleted
                            0 files were repaired
                            22 files were moved to quarantine
                            0 files were renamed
                            1 Files cannot be scanned
                            247215 Files not concerned
                            5135 Archives were scanned
                            69 Warnings
                            22 Notes
                            1. Destrio5 Modérateur
                              ---> Mets à jour Internet Explorer :
                              http://www.microsoft.com/downloads/details.aspx?FamilyId=9AE91EBE-3385-447C-8A30-081805B2F90B&displaylang=fr

                              ---> Poste un nouveau rapport HijackThis.
                              1. morgan24 Auteur
                                Bonsoir et merci pour votre aide.

                                Je rentre d'un long voyage et je n'ai pas pu vous répondre plus tôt. Ma femme a utilisé le pc pendant mon absence et il rame toujours autant sous IE. J'avais essayé d'installer la derniere version d'IE, et impossible de l'utiliser !!!
                                Je crois qu'il faut tout reprendre depsuis le début, sniffff

                                Merci pour votre aide
                                1. Destrio5 Modérateur
                                  - Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

                                  - Double-clique sur RSIT.exe afin de lancer le programme.

                                  - Clique sur Continue à l'écran Disclaimer.

                                  - Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

                                  - Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

                                  Note : Les rapports sont sauvegardés dans le dossier C:\rsit.
                                  1. morgan24 Auteur
                                    Ok, voici les rapports :

                                    Logfile of random's system information tool 1.04 (written by random/random)
                                    Run by Morgan at 2008-11-10 08:51:49
                                    Microsoft Windows XP Professionnel Service Pack 2
                                    System drive C: has 69 GB (59%) free of 117 GB
                                    Total RAM: 255 MB (14% free)

                                    Logfile of Trend Micro HijackThis v2.0.2
                                    Scan saved at 08:52, on 10/11/2008
                                    Platform: Windows XP SP2 (WinNT 5.01.2600)
                                    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
                                    Boot mode: Normal

                                    Running processes:
                                    C:\WINDOWS\System32\smss.exe
                                    C:\WINDOWS\system32\winlogon.exe
                                    C:\WINDOWS\system32\services.exe
                                    C:\WINDOWS\system32\lsass.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\WINDOWS\System32\svchost.exe
                                    C:\WINDOWS\Explorer.EXE
                                    C:\WINDOWS\system32\spoolsv.exe
                                    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                                    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
                                    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
                                    C:\WINDOWS\system32\LVCOMSX.EXE
                                    C:\Program Files\Logitech\Video\LogiTray.exe
                                    C:\Program Files\MSN Messenger\msnmsgr.exe
                                    C:\Program Files\Google\Google Talk\googletalk.exe
                                    C:\Program Files\OpenOffice.org 3\program\soffice.exe
                                    C:\Program Files\OpenOffice.org 3\program\soffice.bin
                                    C:\Program Files\Logitech\Video\FxSvr2.exe
                                    C:\Program Files\MSN Messenger\usnsvc.exe
                                    C:\WINDOWS\system32\wuauclt.exe
                                    C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
                                    C:\Program Files\eMule\emule.exe
                                    C:\Program Files\Microsoft ActiveSync\WCESMgr.exe
                                    C:\Documents and Settings\Morgan\Mes documents\Pocket_PC My Documents\Center.exe
                                    C:\Program Files\internet explorer\iexplore.exe
                                    C:\Program Files\internet explorer\iexplore.exe
                                    C:\Program Files\internet explorer\iexplore.exe
                                    C:\Documents and Settings\Morgan\Local Settings\Temporary Internet Files\Content.IE5\GHU7W9AB\RSIT[1].exe
                                    C:\Program Files\Controle virus\Trend Micro\HijackThis\Morgan.exe

                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                                    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                                    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                                    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                                    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
                                    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
                                    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
                                    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                                    O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
                                    O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
                                    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
                                    O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
                                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                                    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                                    O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
                                    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
                                    O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
                                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                    O14 - IERESET.INF: START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php
                                    O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
                                    O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                                    O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                                    • 1
                                    • 2

                                    Discussions similaires

                                    FOTOSE (allemagne)
                                    lix

                                    13 réponses
                                    ATTENTION : escroquerie à la carte bleue !!
                                    dvrg

                                    80 réponses