Virus micro antivirus 2008

Résolu
maryline2108 -  
Bonjour,

J'ai besoin d'aide.... J'ai été infecté par le Virus Micro AV.... je suis perdue je ne c pas comment faire. J'ai McAffee comment anti virus mais il ne la pas supprimé...
JE vous remercie par avance pour votre aide.

Une débutante en anti virus.

Maryline
Configuration: Windows XP
Firefox 3.0.1

40 réponses

Résumé de la discussion

Une utilisatrice signale une infection par le virus MicroAV sur Windows XP (Firefox 3.0.1) malgré McAfee, et cherche des solutions efficaces pour nettoyer le système. Des utilisateurs proposent FindyKill en mode sécurité et des rapports à poster, puis Malwarebytes Anti-Malware avec redémarrage en mode sans échec, et enfin des analyses via Avira et HijackThis. D'autres conseils préconisent la suppression de composants McAfee via sc delete McAfeeFramework, l'élimination d'outils non fiables comme ComboFix et Tools Cleaner, puis l'usage de rapports pour orienter la décontamination. En cas de doute, la discussion souligne l'importance de sauvegarder les rapports et de redémarrer en mode sans échec pour éviter de compromettre les outils de détection.

Bobot (l’IA à votre service)
  1. Destrio5 Modérateur
    Salut,

    - Télécharge HijackThis V 2.02 (HijackThis Installer) :
    http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

    - Fais un double-clic sur HJTInstall.exe afin de lancer l'installation

    - Clique sur Install ensuite sur I Accept

    - Clique sur Do a scan system and save log file

    - Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse.
    1. maryline2108
      Merci pour votre réponse rapide.
      J'ai voulu installer votre logiciel et il me met que ce n'est pas un Win32 valide.
      Au secours.......
      1. Destrio5 Modérateur
        Bagle peut-être.

        --> Télécharge FindyKill sur ton bureau :
        http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe

        --> Lance l'installation avec les paramètres par defaut

        --> Double-clique sur le raccourci FindyKill sur ton bureau

        --> Au menu principal, choisis l'option 1 (Recherche)

        --> Poste le rapport FindyKill.txt

        Note : le rapport FindyKill.txt est sauvegardé à la racine du disque.
        1. maryline2108
          Voici le resultat

          ----------------- FindyKill V3.095 ------------------

          * User : FAMILY DOLLARD Platform : Windows XP
          * Emplacement : C:\Program Files\FindyKill\FindyKill.exe
          * Outils Mis a jours le 20/09/08 par Chiquitine29
          * Recherche effectuée à 12:34:47 le 20/09/2008

          ----------------- *** Recherche *** ------------------

          »»»» Presence des fichiers dans C:

          »»»» Presence des fichiers dans C:\WINDOWS

          »»»» Presence des fichiers dans C:\WINDOWS\Prefetch

          Present ! - C:\WINDOWS\Prefetch\SETUP.EXE-13EB2E3D.pf
          Present ! - C:\WINDOWS\Prefetch\KEYGEN.EXE-321E87CE.pf

          »»»» Presence des fichiers dans C:\WINDOWS\system32

          »»»» Presence des fichiers dans C:\WINDOWS\system32\drivers

          »»»» Presence des fichiers dans C:\Documents and Settings\FAMILY DOLLARD\Application Data

          »»»» Presence des fichiers dans C:\DOCUME~1\FAMILY~1\LOCALS~1\Temp

          »»»» Registre :

          ! REG.EXE VERSION 3.0

          HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
          ATIPTA REG_SZ "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
          RTHDCPL REG_SZ RTHDCPL.EXE
          Alcmtr REG_SZ ALCMTR.EXE
          SynTPLpr REG_SZ C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
          SynTPEnh REG_SZ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
          LtMoh REG_SZ C:\Program Files\ltmoh\Ltmoh.exe
          AGRSMMSG REG_SZ AGRSMMSG.exe
          THotkey REG_SZ C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
          Tvs REG_SZ C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
          TPSMain REG_SZ TPSMain.exe
          SmoothView REG_SZ C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
          PadTouch REG_SZ C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
          DLA REG_SZ C:\WINDOWS\System32\DLA\DLACTRLW.EXE
          CFSServ.exe REG_SZ CFSServ.exe -NoClient
          OpwareSE2 REG_SZ "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
          ShStatEXE REG_SZ "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
          McAfeeUpdaterUI REG_SZ "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
          \YUR145.exe REG_SZ C:\Windows\system32\YUR145.exe
          \YUR146.exe REG_SZ C:\Windows\system32\YUR146.exe
          \YUR147.exe REG_SZ C:\Windows\system32\YUR147.exe
          \YUR148.exe REG_SZ C:\Windows\system32\YUR148.exe
          ANTIVIRUS REG_SZ C:\Program Files\MicroAV\MicroAV.exe
          \YUR3.exe REG_SZ C:\Windows\system32\YUR3.exe
          \YUR4.exe REG_SZ C:\Windows\system32\YUR4.exe
          \YUR6.exe REG_SZ C:\Windows\system32\YUR6.exe
          \YUR7.exe REG_SZ C:\Windows\system32\YUR7.exe
          BM2bcfe9d1 REG_SZ Rundll32.exe "C:\WINDOWS\system32\owvkgyyb.dll",s
          28fcda4d REG_SZ rundll32.exe "C:\WINDOWS\system32\qjqshldq.dll",b

          HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

          ! REG.EXE VERSION 3.0

          HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
          CTFMON.EXE REG_SZ C:\WINDOWS\system32\ctfmon.exe
          msnmsgr REG_SZ "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
          \YUR3.exe REG_SZ C:\Windows\system32\YUR3.exe
          \YUR4.exe REG_SZ C:\Windows\system32\YUR4.exe
          \YUR6.exe REG_SZ C:\Windows\system32\YUR6.exe
          \YUR7.exe REG_SZ C:\Windows\system32\YUR7.exe
          ANTIVIRUS REG_SZ C:\Program Files\MicroAV\MicroAV.exe

          »»»» Presence d infections dans Support amovible :

          ----------- ! Recherche realisée avec success ! -----------
          2. Destrio5 Modérateur
            --> Branche tes disques amovibles à ton PC (clefs USB, disque dur externe, etc...) sans les ouvrir

            --> Double-clique sur le raccourci FindyKill sur ton bureau

            --> Au menu principal, choisis l'option 2 (Suppression)

            /!\ Il y aura 2 redémarrages, laisse travailler l'outil jusqu'à l'apparition du message "nettoyage effectué" /!\

            --> Ensuite, poste le rapport FindyKill.txt

            Note : le rapport FindyKill.txt est sauvegardé à la racine du disque.
            1. maryline2108
              je ne possede que une cle USB c un ordi portable... ca va qd meme
              désolée pour c question qui peuvent paraitre bête...
              2. maryline2108
                CA Y EST JE PEUX A NOUVEAU ACCEDER AU SITE MAIS TJRS LES MM PROBLEMES...
                fichier quality porn + MicroAV + Best zoo Pern..
                je galere que faire....
                je recommence findykill ?

                Merci d'avance
                1. Destrio5 Modérateur
                  - Télécharge et installe MalwareByte's Anti-Malware :
                  http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

                  - Mets-le à jour

                  - Redémarre en mode sans échec (Recommandé) :
                  https://www.malekal.com/demarrer-windows-mode-sans-echec/

                  - Choisis ta session habituelle

                  - Fais un scan complet avec MalwareByte's Anti-Malware

                  - Supprime tout ce que le logiciel trouve, enregistre le rapport

                  - Redémarre en mode normal et poste le rapport ici
                  1. maryline2108
                    Bjr

                    Voila le resultat en sachant que plus rien n'apparait son mon ordi
                    Dois-je faire encore quelque chose? Quel anti virus pour pu que ca m'arrive ?

                    Malwarebytes' Anti-Malware 1.28
                    Version de la base de données: 1182
                    Windows 5.1.2600 Service Pack 3

                    21/09/2008 07:29:54
                    mbam-log-2008-09-21 (07-29-54).txt

                    Type de recherche: Examen complet (C:\|)
                    Eléments examinés: 82337
                    Temps écoulé: 3 hour(s), 46 minute(s), 25 second(s)

                    Processus mémoire infecté(s): 0
                    Module(s) mémoire infecté(s): 2
                    Clé(s) du Registre infectée(s): 17
                    Valeur(s) du Registre infectée(s): 42
                    Elément(s) de données du Registre infecté(s): 2
                    Dossier(s) infecté(s): 1
                    Fichier(s) infecté(s): 27

                    Processus mémoire infecté(s):
                    (Aucun élément nuisible détecté)

                    Module(s) mémoire infecté(s):
                    C:\WINDOWS\system32\urqRIxur.dll (Trojan.Vundo.H) -> Delete on reboot.
                    C:\WINDOWS\system32\nnnkHbXN.dll (Trojan.Vundo) -> Delete on reboot.

                    Clé(s) du Registre infectée(s):
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{09c72999-5c10-41a3-a524-24661d942003} (Trojan.Vundo.H) -> Delete on reboot.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\nnnkhbxn (Trojan.Vundo.H) -> Delete on reboot.
                    HKEY_CLASSES_ROOT\CLSID\{09c72999-5c10-41a3-a524-24661d942003} (Trojan.Vundo.H) -> Delete on reboot.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7e97de64-94b9-4ecf-9c15-4dde0cad4f15} (Trojan.Vundo.H) -> Delete on reboot.
                    HKEY_CLASSES_ROOT\CLSID\{7e97de64-94b9-4ecf-9c15-4dde0cad4f15} (Trojan.Vundo.H) -> Delete on reboot.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\MicroAV (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.

                    Valeur(s) du Registre infectée(s):
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\28fcda4d (Trojan.Vundo.H) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{09c72999-5c10-41a3-a524-24661d942003} (Trojan.Vundo) -> Delete on reboot.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur145.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur146.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur147.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur148.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yura.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurd.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurb.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur4.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur5.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur6.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur7.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yure.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurf.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur2.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur3.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur23.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur24.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur25.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur26.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yura.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurd.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurb.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur4.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur5.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur6.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur7.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yure.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurf.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur2.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur3.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur23.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur24.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur25.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur26.exe (Trojan.Agent) -> Quarantined and deleted successfully.

                    Elément(s) de données du Registre infecté(s):
                    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\urqrixur -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\urqrixur -> Delete on reboot.

                    Dossier(s) infecté(s):
                    C:\Program Files\MicroAV (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.

                    Fichier(s) infecté(s):
                    C:\WINDOWS\system32\nnnkHbXN.dll (Trojan.Vundo.H) -> Delete on reboot.
                    C:\WINDOWS\system32\urqRIxur.dll (Trojan.Vundo.H) -> Delete on reboot.
                    C:\WINDOWS\system32\ruxIRqru.ini (Trojan.Vundo.H) -> Delete on reboot.
                    C:\WINDOWS\system32\ruxIRqru.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\aaflnjre.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\erjnlfaa.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
                    C:\System Volume Information\_restore{7C613A87-BF99-4606-961B-887F813D12F7}\RP43\A0015129.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                    C:\System Volume Information\_restore{7C613A87-BF99-4606-961B-887F813D12F7}\RP45\A0016191.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                    C:\System Volume Information\_restore{7C613A87-BF99-4606-961B-887F813D12F7}\RP45\A0017184.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\nnnnMExV.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\qjqshldq.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
                    C:\Program Files\MicroAV\MicroAV.exe (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
                    C:\Program Files\MicroAV\MicroAV.ooo (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
                    C:\Program Files\MicroAV\MicroAV0.dat (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
                    C:\Program Files\MicroAV\MicroAV1.dat (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\YUR145.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\YUR146.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\YUR147.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\YUR148.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\YUR25.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\YUR26.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\system32\tdssservers.dat (Trojan.Agent) -> Quarantined and deleted successfully.
                    C:\WINDOWS\BM2bcfe9d1.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
                    C:\WINDOWS\BM2bcfe9d1.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
                    C:\x (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    C:\Documents and Settings\FAMILY DOLLARD\Bureau\BEST ZOO PORN.url (Rogue.Link) -> Quarantined and deleted successfully.
                    C:\Documents and Settings\FAMILY DOLLARD\Bureau\QUALITY PORN.url (Rogue.Link) -> Quarantined and deleted successfully.
                    1. Destrio5 Modérateur
                      ---> Relance MBAM, va dans Quarantaine et supprime tout

                      ---> Fais ceci :

                      - Télécharge HijackThis V 2.02 (HijackThis Installer) :
                      http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

                      - Fais un double-clic sur HJTInstall.exe afin de lancer l'installation

                      - Clique sur Install ensuite sur I Accept

                      - Clique sur Do a scan system and save log file

                      - Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse.
                      1. maryline2108
                        Voici la reponse

                        Logfile of Trend Micro HijackThis v2.0.2
                        Scan saved at 11:30:38, on 21/09/2008
                        Platform: Windows XP SP3 (WinNT 5.01.2600)
                        MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                        Boot mode: Normal

                        Running processes:
                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\Ati2evxx.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\system32\Ati2evxx.exe
                        C:\WINDOWS\Explorer.EXE
                        C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
                        C:\WINDOWS\system32\spoolsv.exe
                        C:\WINDOWS\system32\acs.exe
                        C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\Program Files\McAfee\Common Framework\FrameworkService.exe
                        C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
                        C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
                        C:\WINDOWS\system32\wscntfy.exe
                        C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                        C:\WINDOWS\RTHDCPL.EXE
                        C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
                        C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                        C:\Program Files\ltmoh\Ltmoh.exe
                        C:\WINDOWS\AGRSMMSG.exe
                        C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
                        C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
                        C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
                        C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
                        C:\WINDOWS\System32\DLA\DLACTRLW.EXE
                        C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
                        C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
                        C:\Program Files\McAfee\Common Framework\UdaterUI.exe
                        C:\WINDOWS\system32\ctfmon.exe
                        C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                        C:\Program Files\McAfee\Common Framework\McTray.exe
                        C:\WINDOWS\system32\TPSBattM.exe
                        C:\Program Files\Mozilla Firefox\firefox.exe
                        C:\Program Files\LimeWire\LimeWire.exe
                        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.6play.fr/m6#/choisir-par-genre
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                        O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
                        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                        O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                        O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                        O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
                        O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                        O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
                        O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
                        O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                        O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
                        O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
                        O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
                        O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
                        O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
                        O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
                        O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
                        O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
                        O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
                        O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
                        O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
                        O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
                        O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
                        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                        O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                        O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                        O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                        O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
                        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
                        O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                        O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                        O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
                        O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://maryline2108.spaces.live.com/PhotoUpload/MsnPUpld.cab
                        O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
                        O23 - Service: Service de configuration Atheros (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
                        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                        O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
                        O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
                        O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
                        O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
                        O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
                        1. Destrio5 Modérateur
                          ---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
                          http://download.bleepingcomputer.com/sUBs/ComboFix.exe

                          /!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

                          ---> Double-clique sur Combofix.exe
                          Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
                          Accepte en cliquant sur "Oui"

                          ---> Mets-le en langue française F
                          Tape sur la touche 1 (Yes) pour démarrer le scan.

                          /!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

                          En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

                          Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

                          /!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

                          Note : Le rapport se trouve également là : C:\ComboFix.txt
                          1. maryline2108
                            voici la réponse

                            ComboFix 08-09-20.05 - FAMILY DOLLARD 2008-09-21 12:38:31.1 - NTFSx86
                            Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.192 [GMT 2:00]
                            Lancé depuis: C:\Documents and Settings\FAMILY DOLLARD\Bureau\ComboFix.exe
                            * Un nouveau point de restauration a été créé

                            [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
                            .

                            (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                            .

                            C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
                            C:\InfoSat.txt
                            C:\WINDOWS\temp\perflib_perfdata_1cc.dat

                            .
                            ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
                            .

                            -------\Legacy_TDSSSERV

                            ((((((((((((((((((((((((((((( Fichiers créés du 2008-08-21 au 2008-09-21 ))))))))))))))))))))))))))))))))))))
                            .

                            2008-09-21 11:30 . 2008-09-21 11:30 <REP> d-------- C:\Program Files\Trend Micro
                            2008-09-20 22:59 . 2008-09-20 22:59 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
                            2008-09-20 22:17 . 2008-09-20 22:17 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                            2008-09-20 22:17 . 2008-09-20 22:17 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Malwarebytes
                            2008-09-20 22:17 . 2008-09-20 22:17 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                            2008-09-20 22:17 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
                            2008-09-20 22:17 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                            2008-09-20 18:23 . 2008-09-20 18:27 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
                            2008-09-20 18:23 . 2008-09-20 20:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
                            2008-09-20 18:17 . 2008-09-20 18:17 <REP> d-------- C:\Program Files\Lavasoft
                            2008-09-20 18:17 . 2008-09-20 18:19 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
                            2008-09-20 18:16 . 2008-09-20 18:16 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
                            2008-09-20 16:48 . 2008-09-20 17:33 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
                            2008-09-20 16:46 . 2008-09-20 16:48 <REP> d-------- C:\Program Files\Trojan Remover
                            2008-09-20 16:46 . 2008-09-20 16:46 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Simply Super Software
                            2008-09-20 16:46 . 2008-09-20 16:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Simply Super Software
                            2008-09-20 16:46 . 2006-05-25 15:52 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll
                            2008-09-20 16:46 . 2003-02-02 20:06 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
                            2008-09-20 16:46 . 2005-08-26 01:50 77,312 --a------ C:\WINDOWS\system32\ztvunace26.dll
                            2008-09-20 16:46 . 2002-03-06 01:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
                            2008-09-20 16:46 . 2006-06-19 13:01 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll
                            2008-09-20 16:42 . 2008-09-20 16:42 65 --a------ C:\WINDOWS\system32\28fcc8c3
                            2008-09-20 16:34 . 2008-08-28 19:46 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS
                            2008-09-20 16:34 . 2008-08-28 14:34 <REP> d-------- C:\Documents and Settings\Administrateur\Voisinage r‚seau
                            2008-09-20 16:34 . 2005-12-09 08:55 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
                            2008-09-20 16:34 . 2008-08-28 19:46 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
                            2008-09-20 16:34 . 2008-08-28 19:46 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
                            2008-09-20 16:34 . 2008-08-28 19:46 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
                            2008-09-20 16:34 . 2008-08-28 19:46 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
                            2008-09-20 16:34 . 2005-12-12 12:16 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
                            2008-09-20 16:34 . 2008-08-28 19:46 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\toshiba
                            2008-09-20 16:34 . 2005-12-09 12:22 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec
                            2008-09-20 16:34 . 2008-08-28 19:46 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sonic
                            2008-09-20 16:34 . 2008-09-20 16:34 <REP> d-------- C:\Documents and Settings\Administrateur
                            2008-09-20 12:33 . 2008-09-20 14:04 <REP> d-------- C:\Program Files\FindyKill
                            2008-09-20 12:07 . 2008-09-20 12:07 97,280 --a------ C:\WINDOWS\system32\owvkgyyb.dll
                            2008-09-20 12:06 . 2008-09-20 12:06 257,536 --a------ C:\WINDOWS\system32\jkkiIbYs.dll.vir
                            2008-09-19 20:34 . 2008-09-19 20:34 <REP> d-------- C:\Program Files\Windows Media Connect 2
                            2008-09-19 20:27 . 2008-09-19 20:27 <REP> d-------- C:\WINDOWS\system32\LogFiles
                            2008-09-19 20:27 . 2008-09-19 20:30 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF
                            2008-09-19 19:56 . 2008-09-21 10:47 <REP> d-------- C:\QUARANTINE
                            2008-09-19 13:39 . 2008-09-19 13:39 <REP> d--h----- C:\WINDOWS\PIF
                            2008-09-19 12:52 . 2008-09-19 12:55 <REP> d-------- C:\Program Files\PhotoFiltre
                            2008-09-18 14:44 . 2008-09-18 14:45 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
                            2008-09-18 13:50 . 2008-09-18 14:38 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\AdobeUM
                            2008-09-18 13:30 . 2008-09-18 13:30 <REP> d-------- C:\Program Files\Alice
                            2008-09-18 13:29 . 2008-09-18 13:29 268 --ah----- C:\sqmdata02.sqm
                            2008-09-18 13:29 . 2008-09-18 13:29 244 --ah----- C:\sqmnoopt02.sqm
                            2008-09-18 13:23 . 2008-09-18 13:23 268 --ah----- C:\sqmdata01.sqm
                            2008-09-18 13:23 . 2008-09-18 13:23 244 --ah----- C:\sqmnoopt01.sqm
                            2008-09-16 10:18 . 2008-09-16 10:18 268 --ah----- C:\sqmdata00.sqm
                            2008-09-16 10:18 . 2008-09-16 10:18 244 --ah----- C:\sqmnoopt00.sqm
                            2008-09-12 17:24 . 2008-09-12 17:24 <REP> d-------- C:\Program Files\Fichiers communs\Cisco Systems
                            2008-09-12 17:24 . 2008-09-12 17:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
                            2008-09-12 17:24 . 2006-12-19 15:06 1,495,552 --a------ C:\WINDOWS\system32\epoPGPsdk.dll
                            2008-09-12 17:24 . 2006-12-19 15:06 280 --a------ C:\WINDOWS\system32\epoPGPsdk.dll.sig
                            2008-09-12 17:23 . 2008-09-12 17:24 <REP> d-------- C:\Program Files\McAfee
                            2008-09-12 17:23 . 2008-09-12 17:23 <REP> d-------- C:\Program Files\Fichiers communs\McAfee
                            2008-09-12 17:23 . 2007-02-22 20:50 170,408 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
                            2008-09-12 17:23 . 2006-11-30 08:50 72,264 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
                            2008-09-12 17:23 . 2006-11-30 08:50 64,360 --a------ C:\WINDOWS\system32\drivers\mfeapfk.sys
                            2008-09-12 17:23 . 2006-11-30 08:50 52,136 --a------ C:\WINDOWS\system32\drivers\mfetdik.sys
                            2008-09-12 17:23 . 2006-11-30 08:50 34,152 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
                            2008-09-06 13:59 . 2008-09-12 16:38 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Canon
                            2008-09-06 12:00 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\system32\fr
                            2008-09-06 12:00 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\system32\bits
                            2008-09-06 12:00 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\l2schemas
                            2008-09-06 11:56 . 2008-09-06 12:01 <REP> d-------- C:\WINDOWS\ServicePackFiles
                            2008-09-06 11:48 . 2008-09-06 11:48 <REP> d-------- C:\WINDOWS\EHome
                            2008-09-03 15:13 . 2008-09-03 15:13 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Media Player Classic
                            2008-09-03 15:11 . 2008-09-03 15:11 <REP> d-------- C:\Program Files\K-Lite Codec Pack
                            2008-09-03 14:41 . 2008-09-03 14:41 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\divx_3.22b
                            2008-09-01 14:34 . 2008-06-23 18:28 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
                            2008-09-01 14:34 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
                            2008-09-01 14:34 . 2007-03-08 07:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
                            2008-09-01 14:34 . 2008-06-23 18:28 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
                            2008-09-01 14:34 . 2008-06-23 18:28 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
                            2008-09-01 14:34 . 2008-06-23 18:28 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
                            2008-09-01 14:34 . 2008-06-23 18:28 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
                            2008-09-01 14:34 . 2008-06-23 18:28 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
                            2008-09-01 14:34 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
                            2008-09-01 14:33 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\system32\fr-fr
                            2008-09-01 14:26 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll
                            2008-08-31 03:21 . 2008-08-31 03:21 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
                            2008-08-30 13:44 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll
                            2008-08-30 13:44 . 2008-07-18 22:07 210,976 --a------ C:\WINDOWS\system32\muweb.dll
                            2008-08-30 13:44 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui
                            2008-08-29 19:03 . 2008-08-29 19:03 <REP> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
                            2008-08-29 19:02 . 2005-05-06 22:00 140,288 --a------ C:\WINDOWS\system32\CNMLM7J.DLL
                            2008-08-29 19:02 . 2008-04-13 20:45 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
                            2008-08-29 19:02 . 2008-04-13 20:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
                            2008-08-29 19:02 . 2008-04-13 20:45 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
                            2008-08-29 19:02 . 2005-05-06 22:00 8,704 --a------ C:\WINDOWS\system32\CNMVS7J.DLL
                            2008-08-29 15:21 . 2008-08-29 15:21 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\ScanSoft
                            2008-08-29 15:21 . 2008-08-29 15:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SSScanWizard
                            2008-08-29 15:21 . 2008-08-29 15:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir
                            2008-08-29 15:21 . 2008-08-29 15:21 532 --a------ C:\WINDOWS\MAXLINK.INI
                            2008-08-29 15:20 . 2008-08-29 15:20 <REP> d-------- C:\Program Files\ScanSoft
                            2008-08-29 15:20 . 2008-08-29 15:21 <REP> d-------- C:\Program Files\Fichiers communs\ScanSoft Shared
                            2008-08-29 15:12 . 2008-09-10 22:40 <REP> d-------- C:\WINDOWS\CAVTemp
                            2008-08-29 15:11 . 2008-08-29 15:11 <REP> d--h----- C:\WINDOWS\system32\CanonMP Uninstaller Information
                            2008-08-29 15:11 . 2008-08-29 15:11 <REP> d--h----- C:\CanonMP
                            2008-08-29 15:11 . 2005-08-04 03:46 221,184 --a------ C:\WINDOWS\system32\CNCC170.DLL
                            2008-08-29 15:11 . 2005-05-30 12:46 139,264 --a------ C:\WINDOWS\system32\CNCL170.DLL
                            2008-08-29 15:11 . 2005-08-04 03:46 69,632 --a------ C:\WINDOWS\system32\CNCI170.DLL
                            2008-08-29 15:11 . 2005-08-04 03:47 49,152 --a------ C:\WINDOWS\system32\cncisco.dll
                            2008-08-29 15:09 . 2008-08-29 15:12 <REP> d-------- C:\Program Files\Canon
                            2008-08-29 15:03 . 2001-08-17 21:56 7,552 --a------ C:\WINDOWS\system32\drivers\SONYPVU1.SYS
                            2008-08-29 15:03 . 2001-08-17 21:56 7,552 --a--c--- C:\WINDOWS\system32\dllcache\sonypvu1.sys
                            2008-08-29 14:29 . 2008-08-29 14:29 <REP> d-------- C:\Program Files\Windows Live Favorites
                            2008-08-29 14:28 . 2008-08-29 14:29 <REP> d-------- C:\Program Files\Windows Live Toolbar
                            2008-08-29 14:27 . 2008-08-30 00:04 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Contacts
                            2008-08-29 14:27 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
                            2008-08-29 14:26 . 2008-08-29 14:26 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
                            2008-08-29 14:25 . 2008-08-29 14:25 <REP> d----c--- C:\WINDOWS\system32\DRVSTORE
                            2008-08-29 14:21 . 2008-08-31 03:04 <REP> d-------- C:\Program Files\Windows Live
                            2008-08-29 14:21 . 2008-08-29 14:23 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
                            2008-08-29 14:20 . 2008-08-29 14:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
                            2008-08-28 18:05 . 2008-05-08 16:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
                            2008-08-28 18:03 . 2008-04-11 21:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
                            2008-08-28 18:03 . 2008-05-01 16:36 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
                            2008-08-28 17:14 . 2004-08-04 00:38 327,168 --------- C:\WINDOWS\system32\drivers\ati2mtaa.sys
                            2008-08-28 16:57 . 2008-09-21 12:34 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\LimeWire
                            2008-08-28 16:56 . 2008-08-28 16:57 <REP> d-------- C:\Program Files\LimeWire
                            2008-08-28 16:50 . 2008-08-28 16:50 0 --a------ C:\WINDOWS\nsreg.dat

                            .
                            (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                            .
                            2008-08-28 18:18 --------- d-----w C:\Program Files\TOSHIBA
                            2008-08-28 18:17 --------- d-----w C:\Program Files\Synaptics
                            2008-08-28 18:16 --------- d---a-w C:\Program Files\Offre Wanadoo
                            2008-08-28 18:16 --------- d-----w C:\Program Files\Sonic
                            2008-08-28 18:16 --------- d-----w C:\Program Files\Services en ligne
                            2008-08-28 18:16 --------- d-----w C:\Program Files\Realtek
                            2008-08-28 18:14 --------- d-----w C:\Program Files\Microsoft.NET
                            2008-08-28 18:13 --------- d-----w C:\Program Files\microsoft frontpage
                            2008-08-28 18:13 --------- d-----w C:\Program Files\ltmoh
                            2008-08-28 18:12 --------- d-----w C:\Program Files\Java
                            2008-08-28 18:12 --------- d-----w C:\Program Files\InterVideo
                            2008-08-28 18:06 --------- d-----w C:\Program Files\Fichiers communs\Java
                            2008-08-28 18:06 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
                            2008-08-28 18:06 --------- d-----w C:\Program Files\ATI Technologies
                            2008-08-28 17:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\SBSI
                            2008-08-28 13:57 --------- d-----w C:\Program Files\Symantec
                            2008-08-28 13:39 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
                            2008-08-28 13:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
                            2008-08-28 13:22 --------- d--h--w C:\Program Files\InstallShield Installation Information
                            2008-08-28 12:32 17,801 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
                            2008-08-28 12:32 --------- d-----w C:\Program Files\Atheros
                            2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
                            2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll
                            2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
                            2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
                            2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
                            2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
                            2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
                            2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
                            2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
                            2008-07-18 20:08 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
                            2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
                            2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
                            2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
                            2008-06-24 16:12 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll
                            2008-06-23 16:28 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
                            .

                            ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                            .
                            .
                            *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                            REGEDIT4

                            [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                            "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
                            "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
                            "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]

                            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                            "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
                            "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-15 98394]
                            "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-15 688218]
                            "LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2005-05-19 188416]
                            "THotkey"="C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe" [2005-12-08 352256]
                            "Tvs"="C:\Program Files\TOSHIBA\Tvs\TvsTray.exe" [2005-11-30 73728]
                            "SmoothView"="C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe" [2005-05-17 118784]
                            "PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [2005-08-30 1077328]
                            "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-08-01 122940]
                            "OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
                            "ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2007-02-22 112216]
                            "McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 136768]
                            "TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2008-09-15 920144]
                            "RTHDCPL"="RTHDCPL.EXE" [2005-11-10 C:\WINDOWS\RTHDCPL.exe]
                            "AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 C:\WINDOWS\agrsmmsg.exe]
                            "TPSMain"="TPSMain.exe" [2005-08-03 C:\WINDOWS\system32\TPSMain.exe]
                            "CFSServ.exe"="CFSServ.exe" [BU]

                            [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                            "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

                            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                            "VIDC.YV12"= yv12vfw.dll

                            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TDSSserv.sys]
                            @=""

                            [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                            "%windir%\\system32\\sessmgr.exe"=
                            "C:\\Program Files\\Messenger\\msmsgs.exe"=
                            "C:\\Program Files\\LimeWire\\LimeWire.exe"=
                            "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                            "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                            "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                            "C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=

                            .
                            Contenu du dossier 'Tâches planifiées'
                            .
                            .
                            ------- Examen supplémentaire -------
                            .
                            FireFox -: Profile - C:\Documents and Settings\FAMILY DOLLARD\Application Data\Mozilla\Firefox\Profiles\6lmz0wdh.default\
                            FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
                            FF -: plugin - C:\Program Files\Java\jre1.5.0_04\bin\NPJava11.dll
                            FF -: plugin - C:\Program Files\Java\jre1.5.0_04\bin\NPJava12.dll
                            FF -: plugin - C:\Program Files\Java\jre1.5.0_04\bin\NPJava13.dll
                            FF -: plugin - C:\Program Files\Java\jre1.5.0_04\bin\NPJava14.dll
                            FF -: plugin - C:\Program Files\Java\jre1.5.0_04\bin\NPJava32.dll
                            FF -: plugin - C:\Program Files\Java\jre1.5.0_04\bin\NPJPI150_04.dll
                            FF -: plugin - C:\Program Files\Java\jre1.5.0_04\bin\NPOJI610.dll
                            FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
                            FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
                            .

                            **************************************************************************

                            catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                            Rootkit scan 2008-09-21 12:43:50
                            Windows 5.1.2600 Service Pack 3 NTFS

                            Recherche de processus cachés ...

                            Recherche d'éléments en démarrage automatique cachés ...

                            Recherche de fichiers cachés ...

                            Scan terminé avec succès
                            Fichiers cachés: 0

                            **************************************************************************
                            .
                            ------------------------ Autres processus actifs ------------------------
                            .
                            C:\WINDOWS\system32\ati2evxx.exe
                            C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
                            C:\WINDOWS\system32\ati2evxx.exe
                            C:\WINDOWS\system32\acs.exe
                            C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
                            C:\Program Files\McAfee\Common Framework\FrameworkService.exe
                            C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
                            C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
                            C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
                            C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
                            C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
                            C:\Program Files\McAfee\Common Framework\Mctray.exe
                            C:\WINDOWS\system32\TPSBattM.exe
                            C:\WINDOWS\system32\wscntfy.exe
                            .
                            **************************************************************************
                            .
                            Heure de fin: 2008-09-21 12:48:34 - La machine a redémarré
                            ComboFix-quarantined-files.txt 2008-09-21 10:48:25

                            Avant-CF: 55ÿ989ÿ051ÿ392 octets libres
                            Après-CF: 55,961,808,896 octets libres

                            275 --- E O F --- 2008-09-20 15:53:01
                            1. Destrio5 Modérateur
                              /!\ Seul maryline2108 peut suivre cette procédure /!\

                              1/

                              ---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.

                              ---> Copie le texte ci-dessous par sélection puis Ctrl+C :

                              KillAll::

                              File::
                              C:\WINDOWS\system32\tdssinit.dll
                              C:\WINDOWS\system32\drivers\TDSSjcxe.sys
                              C:\WINDOWS\system32\drivers\tdsserv.sys
                              C:\WINDOWS\system32\tdssadw.dll
                              C:\WINDOWS\system32\TDSSerrors.log
                              C:\WINDOWS\system32\tdssl.dll
                              C:\WINDOWS\system32\tdssmain.dll
                              C:\WINDOWS\system32\tdssservers.dat
                              C:\WINDOWS\system32\epoPGPsdk.dll.sig
                              C:\WINDOWS\system32\epoPGPsdk.dll
                              C:\WINDOWS\system32\jkkiIbYs.dll.vir
                              C:\WINDOWS\system32\owvkgyyb.dll

                              Registry::
                              [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TDSSserv.sys]

                              ---> Colle la sélection dans le bloc-notes

                              ---> Enregistre ce fichier sur le bureau (Impératif)

                              ---> Nom du fichier : CFScript
                              ---> Type du fichier : tous les fichiers
                              ---> Clique sur Enregistrer
                              ---> Quitte le bloc-notes

                              2/

                              ---> Redémarre en mode sans échec

                              ---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
                              http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

                              [*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

                              [*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
                              Ne touche à rien tant que le scan n'est pas terminé.

                              [*] Une fois le scan achevé, un rapport va s'afficher : poste-le

                              [*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt
                              1. maryline2108
                                voila le resultat

                                ComboFix 08-09-20.05 - FAMILY DOLLARD 2008-09-21 13:22:10.2 - NTFSx86 MINIMAL
                                Lancé depuis: C:\Documents and Settings\FAMILY DOLLARD\Bureau\ComboFix.exe
                                Commutateurs utilisés :: C:\Documents and Settings\FAMILY DOLLARD\Bureau\CFScript.txt

                                [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

                                FILE ::
                                C:\WINDOWS\system32\drivers\tdsserv.sys
                                C:\WINDOWS\system32\drivers\TDSSjcxe.sys
                                C:\WINDOWS\system32\epoPGPsdk.dll
                                C:\WINDOWS\system32\epoPGPsdk.dll.sig
                                C:\WINDOWS\system32\jkkiIbYs.dll.vir
                                C:\WINDOWS\system32\owvkgyyb.dll
                                C:\WINDOWS\system32\tdssadw.dll
                                C:\WINDOWS\system32\TDSSerrors.log
                                C:\WINDOWS\system32\tdssinit.dll
                                C:\WINDOWS\system32\tdssl.dll
                                C:\WINDOWS\system32\tdssmain.dll
                                C:\WINDOWS\system32\tdssservers.dat
                                .

                                (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                                .

                                C:\WINDOWS\system32\epoPGPsdk.dll
                                C:\WINDOWS\system32\epoPGPsdk.dll.sig
                                C:\WINDOWS\system32\jkkiIbYs.dll.vir
                                C:\WINDOWS\system32\owvkgyyb.dll

                                .
                                ((((((((((((((((((((((((((((( Fichiers créés du 2008-08-21 au 2008-09-21 ))))))))))))))))))))))))))))))))))))
                                .

                                2008-09-21 11:30 . 2008-09-21 11:30 <REP> d-------- C:\Program Files\Trend Micro
                                2008-09-20 22:59 . 2008-09-20 22:59 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
                                2008-09-20 22:17 . 2008-09-20 22:17 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                                2008-09-20 22:17 . 2008-09-20 22:17 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Malwarebytes
                                2008-09-20 22:17 . 2008-09-20 22:17 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                                2008-09-20 22:17 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
                                2008-09-20 22:17 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                                2008-09-20 18:23 . 2008-09-20 18:27 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
                                2008-09-20 18:23 . 2008-09-20 20:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
                                2008-09-20 18:17 . 2008-09-20 18:17 <REP> d-------- C:\Program Files\Lavasoft
                                2008-09-20 18:17 . 2008-09-20 18:19 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
                                2008-09-20 18:16 . 2008-09-20 18:16 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
                                2008-09-20 16:48 . 2008-09-20 17:33 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
                                2008-09-20 16:46 . 2008-09-20 16:48 <REP> d-------- C:\Program Files\Trojan Remover
                                2008-09-20 16:46 . 2008-09-20 16:46 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Simply Super Software
                                2008-09-20 16:46 . 2008-09-20 16:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Simply Super Software
                                2008-09-20 16:46 . 2006-05-25 15:52 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll
                                2008-09-20 16:46 . 2003-02-02 20:06 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
                                2008-09-20 16:46 . 2005-08-26 01:50 77,312 --a------ C:\WINDOWS\system32\ztvunace26.dll
                                2008-09-20 16:46 . 2002-03-06 01:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
                                2008-09-20 16:46 . 2006-06-19 13:01 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll
                                2008-09-20 16:42 . 2008-09-20 16:42 65 --a------ C:\WINDOWS\system32\28fcc8c3
                                2008-09-20 16:34 . 2008-08-28 19:46 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS
                                2008-09-20 16:34 . 2008-08-28 14:34 <REP> d-------- C:\Documents and Settings\Administrateur\Voisinage r‚seau
                                2008-09-20 16:34 . 2005-12-09 08:55 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
                                2008-09-20 16:34 . 2008-08-28 19:46 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
                                2008-09-20 16:34 . 2008-08-28 19:46 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
                                2008-09-20 16:34 . 2008-08-28 19:46 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
                                2008-09-20 16:34 . 2008-08-28 19:46 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
                                2008-09-20 16:34 . 2005-12-12 12:16 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
                                2008-09-20 16:34 . 2008-08-28 19:46 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\toshiba
                                2008-09-20 16:34 . 2005-12-09 12:22 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec
                                2008-09-20 16:34 . 2008-08-28 19:46 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sonic
                                2008-09-20 16:34 . 2008-09-20 16:34 <REP> d-------- C:\Documents and Settings\Administrateur
                                2008-09-20 12:33 . 2008-09-20 14:04 <REP> d-------- C:\Program Files\FindyKill
                                2008-09-19 20:34 . 2008-09-19 20:34 <REP> d-------- C:\Program Files\Windows Media Connect 2
                                2008-09-19 20:27 . 2008-09-19 20:27 <REP> d-------- C:\WINDOWS\system32\LogFiles
                                2008-09-19 20:27 . 2008-09-19 20:30 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF
                                2008-09-19 19:56 . 2008-09-21 10:47 <REP> d-------- C:\QUARANTINE
                                2008-09-19 13:39 . 2008-09-19 13:39 <REP> d--h----- C:\WINDOWS\PIF
                                2008-09-19 12:52 . 2008-09-19 12:55 <REP> d-------- C:\Program Files\PhotoFiltre
                                2008-09-18 14:44 . 2008-09-18 14:45 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
                                2008-09-18 13:50 . 2008-09-18 14:38 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\AdobeUM
                                2008-09-18 13:30 . 2008-09-18 13:30 <REP> d-------- C:\Program Files\Alice
                                2008-09-18 13:29 . 2008-09-18 13:29 268 --ah----- C:\sqmdata02.sqm
                                2008-09-18 13:29 . 2008-09-18 13:29 244 --ah----- C:\sqmnoopt02.sqm
                                2008-09-18 13:23 . 2008-09-18 13:23 268 --ah----- C:\sqmdata01.sqm
                                2008-09-18 13:23 . 2008-09-18 13:23 244 --ah----- C:\sqmnoopt01.sqm
                                2008-09-16 10:18 . 2008-09-16 10:18 268 --ah----- C:\sqmdata00.sqm
                                2008-09-16 10:18 . 2008-09-16 10:18 244 --ah----- C:\sqmnoopt00.sqm
                                2008-09-12 17:24 . 2008-09-12 17:24 <REP> d-------- C:\Program Files\Fichiers communs\Cisco Systems
                                2008-09-12 17:24 . 2008-09-12 17:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
                                2008-09-12 17:23 . 2008-09-12 17:24 <REP> d-------- C:\Program Files\McAfee
                                2008-09-12 17:23 . 2008-09-12 17:23 <REP> d-------- C:\Program Files\Fichiers communs\McAfee
                                2008-09-12 17:23 . 2007-02-22 20:50 170,408 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
                                2008-09-12 17:23 . 2006-11-30 08:50 72,264 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
                                2008-09-12 17:23 . 2006-11-30 08:50 64,360 --a------ C:\WINDOWS\system32\drivers\mfeapfk.sys
                                2008-09-12 17:23 . 2006-11-30 08:50 52,136 --a------ C:\WINDOWS\system32\drivers\mfetdik.sys
                                2008-09-12 17:23 . 2006-11-30 08:50 34,152 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
                                2008-09-06 13:59 . 2008-09-12 16:38 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Canon
                                2008-09-06 12:00 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\system32\fr
                                2008-09-06 12:00 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\system32\bits
                                2008-09-06 12:00 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\l2schemas
                                2008-09-06 11:56 . 2008-09-06 12:01 <REP> d-------- C:\WINDOWS\ServicePackFiles
                                2008-09-06 11:48 . 2008-09-06 11:48 <REP> d-------- C:\WINDOWS\EHome
                                2008-09-03 15:13 . 2008-09-03 15:13 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Media Player Classic
                                2008-09-03 15:11 . 2008-09-03 15:11 <REP> d-------- C:\Program Files\K-Lite Codec Pack
                                2008-09-03 14:41 . 2008-09-03 14:41 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\divx_3.22b
                                2008-09-01 14:34 . 2008-06-23 18:28 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
                                2008-09-01 14:34 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
                                2008-09-01 14:34 . 2007-03-08 07:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
                                2008-09-01 14:34 . 2008-06-23 18:28 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
                                2008-09-01 14:34 . 2008-06-23 18:28 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
                                2008-09-01 14:34 . 2008-06-23 18:28 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
                                2008-09-01 14:34 . 2008-06-23 18:28 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
                                2008-09-01 14:34 . 2008-06-23 18:28 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
                                2008-09-01 14:34 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
                                2008-09-01 14:33 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\system32\fr-fr
                                2008-09-01 14:26 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll
                                2008-08-31 03:21 . 2008-08-31 03:21 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
                                2008-08-30 13:44 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll
                                2008-08-30 13:44 . 2008-07-18 22:07 210,976 --a------ C:\WINDOWS\system32\muweb.dll
                                2008-08-30 13:44 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui
                                2008-08-29 19:03 . 2008-08-29 19:03 <REP> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
                                2008-08-29 19:02 . 2005-05-06 22:00 140,288 --a------ C:\WINDOWS\system32\CNMLM7J.DLL
                                2008-08-29 19:02 . 2008-04-13 20:45 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
                                2008-08-29 19:02 . 2008-04-13 20:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
                                2008-08-29 19:02 . 2008-04-13 20:45 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
                                2008-08-29 19:02 . 2005-05-06 22:00 8,704 --a------ C:\WINDOWS\system32\CNMVS7J.DLL
                                2008-08-29 15:21 . 2008-08-29 15:21 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\ScanSoft
                                2008-08-29 15:21 . 2008-08-29 15:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SSScanWizard
                                2008-08-29 15:21 . 2008-08-29 15:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir
                                2008-08-29 15:21 . 2008-08-29 15:21 532 --a------ C:\WINDOWS\MAXLINK.INI
                                2008-08-29 15:20 . 2008-08-29 15:20 <REP> d-------- C:\Program Files\ScanSoft
                                2008-08-29 15:20 . 2008-08-29 15:21 <REP> d-------- C:\Program Files\Fichiers communs\ScanSoft Shared
                                2008-08-29 15:12 . 2008-09-10 22:40 <REP> d-------- C:\WINDOWS\CAVTemp
                                2008-08-29 15:11 . 2008-08-29 15:11 <REP> d--h----- C:\WINDOWS\system32\CanonMP Uninstaller Information
                                2008-08-29 15:11 . 2008-08-29 15:11 <REP> d--h----- C:\CanonMP
                                2008-08-29 15:11 . 2005-08-04 03:46 221,184 --a------ C:\WINDOWS\system32\CNCC170.DLL
                                2008-08-29 15:11 . 2005-05-30 12:46 139,264 --a------ C:\WINDOWS\system32\CNCL170.DLL
                                2008-08-29 15:11 . 2005-08-04 03:46 69,632 --a------ C:\WINDOWS\system32\CNCI170.DLL
                                2008-08-29 15:11 . 2005-08-04 03:47 49,152 --a------ C:\WINDOWS\system32\cncisco.dll
                                2008-08-29 15:09 . 2008-08-29 15:12 <REP> d-------- C:\Program Files\Canon
                                2008-08-29 15:03 . 2001-08-17 21:56 7,552 --a------ C:\WINDOWS\system32\drivers\SONYPVU1.SYS
                                2008-08-29 15:03 . 2001-08-17 21:56 7,552 --a--c--- C:\WINDOWS\system32\dllcache\sonypvu1.sys
                                2008-08-29 14:29 . 2008-08-29 14:29 <REP> d-------- C:\Program Files\Windows Live Favorites
                                2008-08-29 14:28 . 2008-08-29 14:29 <REP> d-------- C:\Program Files\Windows Live Toolbar
                                2008-08-29 14:27 . 2008-08-30 00:04 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Contacts
                                2008-08-29 14:27 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
                                2008-08-29 14:26 . 2008-08-29 14:26 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
                                2008-08-29 14:25 . 2008-08-29 14:25 <REP> d----c--- C:\WINDOWS\system32\DRVSTORE
                                2008-08-29 14:21 . 2008-08-31 03:04 <REP> d-------- C:\Program Files\Windows Live
                                2008-08-29 14:21 . 2008-08-29 14:23 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
                                2008-08-29 14:20 . 2008-08-29 14:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
                                2008-08-28 18:05 . 2008-05-08 16:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
                                2008-08-28 18:03 . 2008-04-11 21:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
                                2008-08-28 18:03 . 2008-05-01 16:36 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
                                2008-08-28 17:14 . 2004-08-04 00:38 327,168 --------- C:\WINDOWS\system32\drivers\ati2mtaa.sys
                                2008-08-28 16:57 . 2008-09-21 13:12 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\LimeWire
                                2008-08-28 16:56 . 2008-08-28 16:57 <REP> d-------- C:\Program Files\LimeWire
                                2008-08-28 16:50 . 2008-08-28 16:50 0 --a------ C:\WINDOWS\nsreg.dat
                                2008-08-28 16:48 . 2008-06-14 19:33 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys
                                2008-08-28 16:48 . 2008-06-14 19:33 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
                                2008-08-28 16:44 . 2008-07-18 22:10 45,768 --a------ C:\WINDOWS\system32\wups2.dll
                                2008-08-28 16:44 . 2008-07-18 22:10 38,088 --a------ C:\WINDOWS\system32\wucltui.dll.mui

                                .
                                (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                                .
                                2008-08-28 18:18 --------- d-----w C:\Program Files\TOSHIBA
                                2008-08-28 18:17 --------- d-----w C:\Program Files\Synaptics
                                2008-08-28 18:16 --------- d---a-w C:\Program Files\Offre Wanadoo
                                2008-08-28 18:16 --------- d-----w C:\Program Files\Sonic
                                2008-08-28 18:16 --------- d-----w C:\Program Files\Services en ligne
                                2008-08-28 18:16 --------- d-----w C:\Program Files\Realtek
                                2008-08-28 18:14 --------- d-----w C:\Program Files\Microsoft.NET
                                2008-08-28 18:13 --------- d-----w C:\Program Files\microsoft frontpage
                                2008-08-28 18:13 --------- d-----w C:\Program Files\ltmoh
                                2008-08-28 18:12 --------- d-----w C:\Program Files\Java
                                2008-08-28 18:12 --------- d-----w C:\Program Files\InterVideo
                                2008-08-28 18:06 --------- d-----w C:\Program Files\Fichiers communs\Java
                                2008-08-28 18:06 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
                                2008-08-28 18:06 --------- d-----w C:\Program Files\ATI Technologies
                                2008-08-28 17:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\SBSI
                                2008-08-28 13:57 --------- d-----w C:\Program Files\Symantec
                                2008-08-28 13:39 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
                                2008-08-28 13:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
                                2008-08-28 13:22 --------- d--h--w C:\Program Files\InstallShield Installation Information
                                2008-08-28 12:32 17,801 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
                                2008-08-28 12:32 --------- d-----w C:\Program Files\Atheros
                                2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
                                .

                                ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                                .
                                .
                                *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                                REGEDIT4

                                [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
                                "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
                                "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]

                                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
                                "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-15 98394]
                                "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-15 688218]
                                "LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2005-05-19 188416]
                                "THotkey"="C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe" [2005-12-08 352256]
                                "Tvs"="C:\Program Files\TOSHIBA\Tvs\TvsTray.exe" [2005-11-30 73728]
                                "SmoothView"="C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe" [2005-05-17 118784]
                                "PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [2005-08-30 1077328]
                                "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-08-01 122940]
                                "OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
                                "ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2007-02-22 112216]
                                "McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 136768]
                                "TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2008-09-15 920144]
                                "MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2008-04-14 172544]
                                "RTHDCPL"="RTHDCPL.EXE" [2005-11-10 C:\WINDOWS\RTHDCPL.exe]
                                "AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 C:\WINDOWS\agrsmmsg.exe]
                                "TPSMain"="TPSMain.exe" [2005-08-03 C:\WINDOWS\system32\TPSMain.exe]
                                "CFSServ.exe"="CFSServ.exe" [BU]

                                [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                                "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

                                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                                "VIDC.YV12"= yv12vfw.dll

                                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                                "%windir%\\system32\\sessmgr.exe"=
                                "C:\\Program Files\\Messenger\\msmsgs.exe"=
                                "C:\\Program Files\\LimeWire\\LimeWire.exe"=
                                "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                                "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                                "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                                "C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=

                                .
                                Contenu du dossier 'Tâches planifiées'
                                .

                                **************************************************************************

                                catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                                Rootkit scan 2008-09-21 13:32:29
                                Windows 5.1.2600 Service Pack 3 NTFS

                                Recherche de processus cachés ...

                                Recherche d'éléments en démarrage automatique cachés ...

                                Recherche de fichiers cachés ...

                                Scan terminé avec succès
                                Fichiers cachés: 0

                                **************************************************************************
                                .
                                Heure de fin: 2008-09-21 13:39:07 - La machine a redémarré
                                ComboFix-quarantined-files.txt 2008-09-21 11:38:55
                                ComboFix2.txt 2008-09-21 10:48:36

                                Avant-CF: 55ÿ964ÿ999ÿ680 octets libres
                                Après-CF: 55,952,515,072 octets libres

                                237 --- E O F --- 2008-09-20 15:53:01
                                2. maryline2108
                                  VOILA LE RESULTAT

                                  Logfile of Trend Micro HijackThis v2.0.2
                                  Scan saved at 16:40:49, on 21/09/2008
                                  Platform: Windows XP SP3 (WinNT 5.01.2600)
                                  MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                                  Boot mode: Normal

                                  Running processes:
                                  C:\WINDOWS\System32\smss.exe
                                  C:\WINDOWS\system32\winlogon.exe
                                  C:\WINDOWS\system32\services.exe
                                  C:\WINDOWS\system32\lsass.exe
                                  C:\WINDOWS\system32\Ati2evxx.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\WINDOWS\System32\svchost.exe
                                  C:\WINDOWS\system32\Ati2evxx.exe
                                  C:\WINDOWS\Explorer.EXE
                                  C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
                                  C:\WINDOWS\system32\spoolsv.exe
                                  C:\WINDOWS\system32\acs.exe
                                  C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
                                  C:\WINDOWS\System32\svchost.exe
                                  C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
                                  C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
                                  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                                  C:\WINDOWS\RTHDCPL.EXE
                                  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
                                  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                                  C:\Program Files\ltmoh\Ltmoh.exe
                                  C:\WINDOWS\AGRSMMSG.exe
                                  C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
                                  C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
                                  C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
                                  C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
                                  C:\WINDOWS\System32\DLA\DLACTRLW.EXE
                                  C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
                                  C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
                                  C:\WINDOWS\system32\ctfmon.exe
                                  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                                  C:\WINDOWS\system32\TPSBattM.exe
                                  C:\Program Files\LimeWire\LimeWire.exe
                                  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                                  C:\Program Files\Mozilla Firefox\firefox.exe

                                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.6play.fr/m6#/choisir-par-genre
                                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                                  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                                  O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
                                  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                                  O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                                  O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
                                  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                                  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
                                  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                                  O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
                                  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
                                  O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
                                  O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
                                  O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
                                  O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
                                  O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
                                  O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
                                  O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
                                  O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
                                  O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
                                  O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
                                  O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
                                  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                                  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                                  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                                  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                                  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                                  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                                  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                                  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                                  O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                                  O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                                  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
                                  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                                  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                                  O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                                  O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                                  O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                                  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                                  O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
                                  O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://maryline2108.spaces.live.com/PhotoUpload/MsnPUpld.cab
                                  O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
                                  O23 - Service: Service de configuration Atheros (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
                                  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                                  O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
                                  O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
                                  O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
                                  O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
                                  O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
                                  1. maryline2108
                                    qd j'allume mon PC une fenetre s'ouvre
                                    UdaterUl.exe - Composant introuvable car epoPGPSDK.dll est introuvable.
                                    .....Kesako ?
                                    1. Destrio5 Modérateur
                                      C'est McAfee, tu devrais le virer et installer Antivir à la place.
                                      • 1
                                      • 2

                                      Discussions similaires

                                      Impossible d'être entendu avec casque-micro Nintendo switch
                                      kardeyo

                                      3 réponses
                                      Comment obtenir le caractère µ sur le clavier Androïd
                                      marsupilami1947

                                      4 réponses
                                      Softonic,est-ce un virus ?
                                      techmel1

                                      6 réponses
                                      Chrome://newtab
                                      Nova

                                      14 réponses
                                      Désinstaller Softonic
                                      Diguimette

                                      5 réponses