Bonjour

Je suis envahi de diverses fenetres naviSearch, SystemDoctore... depuis plusieurs jours.

J'ai trouvé sur le forum, ce qu'il faut poster pour que quelqu'un puisse essayer de m'aider.

D'avance merci pour votre aide.

Voici, les résultats de Hijackthis, IA et Blacklight

HIJACKTHIS
------------
Logfile of HijackThis v1.99.1
Scan saved at 16:58:53, on 07/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\WINDOWS\system32\3Com_DMI\3CDMINIC.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\CA\eTrust PestPatrol\PPActiveDetection.exe
C:\WINDOWS\system32\bca2kcpan.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\WIDCOMM\LOGICI~1\BTSTAC~1.EXE
C:\Program Files\Microsoft ActiveSync\WCESMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Spam-Aware\saapp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\FREEDO~1\fdm.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\YAYA\LOCALS~1\Temp\Rar$EX00.656\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_BAND_SEARCHBAR_HTML
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 213.155.209.204:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\PROGRA~1\eoRezo\EoAdv\EOREZO~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll
O3 - Toolbar: (no name) - {BCBF738C-4891-4B9A-959A-C6BF7F608C3A} - (no file)
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust PestPatrol\PPActiveDetection.exe"
O4 - HKLM\..\Run: [BCA2000] %SystemRoot%\system32\bca2kcpan.exe
O4 - HKLM\..\Run: [EoEngine] "C:\Program Files\eoRezo\EoEngine.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [eDonkey2000] "C:\Program Files\eDonkey2000\edonkey2000.exe" -t
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spam-Aware] "C:\Program Files\Spam-Aware\saapp.exe"
O4 - Startup: Eurobarre.lnk = C:\Program Files\eurobarre\eb.exe
O4 - Global Startup: Avast! Protection Résidente.lnk = C:\Program Files\Alwil Software\Avast4\ashDisp.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Download with Go!Zilla - file://C:\Program Files\Go!Zilla\download-with-gozilla.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
O8 - Extra context menu item: Open with Scansoft PDF Converter 3.0 - res://C:\Program Files\ScanSoft\OmniPage15.0\PDFConverter3\IEShellExt.dll /100
O8 - Extra context menu item: Personnaliser - C:\Program Files\PROMT98\promtie4\options.htm
O8 - Extra context menu item: Rechercher sur Internet - C:\Program Files\PROMT98\promtie4\search.htm
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Traduire - C:\Program Files\PROMT98\promtie4\translat.htm
O8 - Extra context menu item: Traduire dans WebView - C:\Program Files\PROMT98\promtie4\webview.htm
O8 - Extra context menu item: Traduire la page - C:\Program Files\PROMT98\promtie4\page.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger le site avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Télécharger les tous avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT98\promtie4\promtie5.htm
O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT98\promtie4\promtie5.htm
O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT98\promtie4\options.htm
O9 - Extra 'Tools' menuitem: Personnalisez traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT98\promtie4\options.htm
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {2EF3FB47-7B1E-4536-BA4D-51427BD45DFA} (PIXACO Drag and Drop upload plugin) - http://www.pixaco.fr/static/downlo [...] upload.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://yannickforignon.spaces.msn. [...] nPUpld.cab
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.fr/downloa [...] ofupld.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn. [...] tPkMSN.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.extrafilm.fr/net/Import/ImageUploader3.cab
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn. [...] gWXMSN.cab
O16 - DPF: {AD7A67A5-5461-4B6B-A9C5-09DD071527F5} (MCLPhoto_Upload.PhotoUpload) - http://auchan.fujifilmnet.com/MCLPhoto.CAB
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://register3.valueactive.com/5 [...] lashAX.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll
O20 - Winlogon Notify: LBTServ - C:\Program Files\Fichiers communs\Logitech\Bluetooth\lbtserv.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: 3Com DMI Agent (3ComDMIService) - 3Com Corporation - C:\WINDOWS\system32\3Com_DMI\3CDMINIC.EXE
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe


IA
--
*** Répertoires ***

Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 5C72-418F

R‚pertoire de C:\Program Files\Fichiers communs

02/06/2006 10:46 <REP> .
02/06/2006 10:46 <REP> ..
10/07/2006 15:52 <REP> ACD Systems
03/03/2006 14:30 <REP> Adobe
03/09/2005 08:57 <REP> Adobe Systems Shared
07/09/2005 19:36 <REP> Agfa
25/06/2006 11:18 <REP> Ahead
06/01/2006 16:30 <REP> Borland Shared
20/10/2005 20:43 <REP> Copernic
02/09/2005 13:48 <REP> DESIGNER
13/03/2006 18:46 <REP> DirectX
12/09/2005 14:41 <REP> Gibinsoft Shared
14/11/2005 09:17 <REP> InstallShield
30/01/2006 23:50 <REP> InterVideo
21/12/2005 11:08 <REP> Java
30/01/2006 21:49 <REP> Logitech
19/06/2006 09:49 <REP> Microsoft Shared
01/09/2005 13:50 <REP> MSSoap
05/11/2005 10:38 <REP> NSV
01/09/2005 14:42 <REP> ODBC
14/11/2005 14:29 <REP> Real
04/09/2005 11:44 <REP> Scanner
02/06/2006 10:46 <REP> ScanSoft Shared
01/09/2005 13:51 <REP> Services
01/09/2005 14:42 <REP> SpeechEngines
13/04/2006 10:05 <REP> System
22/03/2006 14:17 <REP> Teleca Shared
25/06/2006 12:03 <REP> Ulead Systems
19/02/2006 10:48 <REP> Wise Installation Wizard
14/11/2005 14:29 <REP> xing shared
0 fichier(s) 0 octets
30 R‚p(s) 40ÿ267ÿ558ÿ912 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 5C72-418F

R‚pertoire de C:\Program Files

04/08/2006 22:00 <REP> .
04/08/2006 22:00 <REP> ..
04/08/2006 19:08 <REP> 3com
24/12/2005 14:00 <REP> ACD Systems
15/01/2006 15:37 <REP> Adobe
07/09/2005 19:36 <REP> Agfa
23/03/2006 16:30 <REP> Ahead
26/06/2006 10:25 <REP> aida_32_3942
01/09/2005 15:14 <REP> Alwil Software
15/12/2005 10:21 <REP> Antares
10/09/2005 22:01 <REP> ASUS
22/10/2005 20:18 <REP> AvantGo
06/09/2005 11:52 <REP> AvantGo Connect
15/05/2006 08:11 <REP> AviSynth 2.5
05/03/2006 12:45 <REP> babidyxp
12/05/2006 12:47 <REP> BitComet
14/05/2006 13:32 <REP> BitComet Toolbar
04/09/2005 11:44 <REP> CA
25/04/2006 18:12 <REP> Canon
04/03/2006 09:25 <REP> CasinoOnNet
19/02/2006 09:16 <REP> CCleaner
29/01/2006 20:08 <REP> CDRWIN
15/12/2005 18:54 <REP> ColiPoste
06/09/2005 11:52 <REP> Common Files
01/09/2005 13:50 <REP> ComPlus Applications
03/09/2005 13:54 <REP> CONEXANT
20/10/2005 20:43 <REP> Copernic Agent
12/03/2006 13:00 <REP> CopyToDVD
21/02/2006 11:56 <REP> Creative
30/06/2006 14:35 <REP> DART Karaoke Studio CDG
11/01/2006 16:26 <REP> Developer One
01/01/2006 14:37 <REP> DFX
12/06/2006 12:33 <REP> DIFX
07/01/2006 11:37 <REP> Digalo
22/09/2005 12:14 <REP> Digidesign
22/09/2005 10:12 <REP> directx
24/03/2006 13:40 <REP> Disc2Phone
04/07/2006 09:47 <REP> DivX
05/05/2006 19:14 <REP> DivX ThE LaUncHeR
06/06/2006 19:17 <REP> Dnote Software
19/04/2006 10:29 <REP> DVD Decrypter
08/11/2005 11:48 <REP> DVD Shrink
14/02/2006 12:23 <REP> DVDCoverPrint
12/03/2006 14:02 <REP> DVDFab Platinum
23/01/2006 15:30 <REP> EBP
08/08/2006 07:45 <REP> eDonkey2000
15/09/2005 08:17 <REP> Elaborate Bytes
08/08/2006 08:23 <REP> eoRezo
15/05/2006 08:10 <REP> eRightSoft
25/04/2006 18:41 <REP> eurobarre
22/09/2005 19:19 <REP> fdjeux
02/06/2006 10:46 <REP> Fichiers communs
15/12/2005 11:05 <REP> FLAC
25/04/2006 12:18 <REP> Fraunhofer IIS
24/12/2005 13:03 <REP> Free Audio Pack
30/05/2006 09:44 <REP> Free Download Manager
03/01/2006 10:10 <REP> FunScreenz-Bliss
03/01/2006 10:08 <REP> FunScreenz-Botanical
12/09/2005 14:41 <REP> GiPo@Utilities
05/12/2005 18:20 <REP> Go!Zilla
08/12/2005 09:56 <REP> GoldWave
30/04/2006 08:36 <REP> Google
27/09/2005 17:59 <REP> Happy Note!
14/11/2005 09:19 <REP> Hemera
19/09/2005 11:05 <REP> Hercules
25/07/2006 15:39 <REP> Hexacto Games
03/09/2005 13:53 <REP> HighMAT CD Writing Wizard
06/01/2006 21:54 <REP> Hypercube Transcoder
21/11/2005 12:01 <REP> Illustrate
30/09/2005 10:18 <REP> ImageServer
17/07/2006 11:29 <REP> IncrediMail
05/05/2006 21:30 8ÿ359 INSTALL.LOG
14/10/2005 08:31 <REP> Intel
16/06/2006 19:46 <REP> Internet Explorer
25/06/2006 11:40 <REP> InterVideo
16/11/2005 18:02 <REP> iPod
16/11/2005 18:02 <REP> iTunes
27/10/2005 10:47 <REP> IZArc
21/12/2005 11:09 <REP> Java
06/07/2006 13:44 <REP> LD-Anime
24/12/2005 13:10 <REP> LitexMedia
30/01/2006 21:49 <REP> Logitech
14/03/2006 09:57 <REP> LucasArts
12/12/2005 18:40 <REP> MEDION
03/06/2006 14:45 <REP> memDOC
01/09/2005 15:49 <REP> Messenger
15/07/2006 13:43 <REP> Microsoft
06/06/2006 19:17 <REP> Microsoft ActiveSync
14/05/2006 20:32 <REP> Microsoft AutoRoute
01/09/2005 13:52 <REP> microsoft frontpage
14/05/2006 20:29 <REP> Microsoft Office
14/04/2006 14:55 <REP> Microsoft SQL Server
22/03/2006 13:54 <REP> Microsoft Visual Studio
14/04/2006 14:49 <REP> Microsoft Visual Studio 8
22/03/2006 13:57 <REP> Microsoft Works
23/11/2005 16:22 <REP> Microsoft.NET
08/05/2006 11:07 <REP> Morgan
31/07/2006 18:18 <REP> Movie Collection
01/09/2005 14:49 <REP> Movie Maker
23/03/2006 19:40 <REP> MP3Gain
03/01/2006 14:42 <REP> MSI
01/09/2005 13:50 <REP> MSN
01/09/2005 13:50 <REP> MSN Gaming Zone
28/06/2006 15:49 <REP> MSN Messenger
30/01/2006 23:50 <REP> MSXML 4.0
31/01/2006 17:20 <REP> Musicalis
12/02/2006 20:17 <REP> Native Instruments
16/11/2005 11:07 <REP> NaturalReader
06/01/2006 19:57 <REP> NCH Swift Sound
25/06/2006 18:58 <REP> NeoDivx Suite
05/05/2006 19:37 <REP> neodivx2006
23/03/2006 12:35 <REP> Nero
15/04/2006 20:48 <REP> NetMeeting
08/09/2005 18:47 <REP> Netropa
25/07/2006 10:58 <REP> OfficeUpdate11
21/01/2006 21:18 <REP> Ontrack
10/11/2005 17:15 <REP> OpenOffice.org 2.0
13/04/2006 10:05 <REP> Outlook Express
14/02/2006 12:20 <REP> Oxilog
02/10/2003 19:39 1ÿ021ÿ952 PcSetup.exe
12/03/2006 13:00 1ÿ101 pcsetup.log
18/06/2006 19:07 <REP> Pentax
30/09/2005 10:18 <REP> PhotoDeluxe HE 3.0
27/10/2005 12:21 <REP> Pinnacle
30/06/2005 17:28 486ÿ917 Pocket Hack Master 2005.2577.CAB
30/06/2005 17:28 235 Pocket Hack Master 2005.INI
12/11/2004 13:28 9ÿ326 Pocket Hack Master.ico
30/06/2005 17:28 545ÿ811 Pocket Mechanic.2577.CAB
13/07/2005 17:47 545ÿ280 Pocket Mechanic.exe
17/10/2003 14:54 1ÿ078 Pocket Mechanic.ico
30/06/2005 17:28 215 Pocket Mechanic.INI
13/11/2005 20:29 <REP> PocketDivx
31/01/2006 17:21 <REP> PowerISO
02/09/2005 08:52 <REP> PowerQuest
31/01/2006 17:21 <REP> pqDVD
14/06/2006 14:16 <REP> Prassi PrimoDVD 2.0 (English)
10/06/2006 20:09 <REP> PROMT98
04/09/2005 14:11 <REP> PyGrenouille
07/01/2006 21:07 <REP> QuickTime
27/10/2005 10:57 <REP> RAR Password Cracker
03/09/2005 10:42 <REP> RAW Image Task
14/11/2005 14:29 <REP> Real
16/01/2006 13:16 <REP> Resco
24/07/2006 22:24 <REP> Ripp-it_AM
01/11/2005 14:08 <REP> SAGEM
02/06/2006 10:46 <REP> ScanSoft
01/09/2005 13:50 <REP> Services en ligne
03/01/2006 14:42 <REP> Setup Files
08/04/2006 19:05 <REP> Sierra On-Line
03/08/2006 09:50 <REP> Singles2
05/11/2005 10:25 <REP> Skype
25/06/2006 12:05 <REP> SmartSound Software
22/01/2006 19:06 <REP> Sony Ericsson
17/07/2006 11:46 <REP> Spam-Aware
07/04/2006 11:38 <REP> Spybot - Search & Destroy
11/12/2005 14:59 <REP> Steinberg
30/11/2005 10:58 <REP> Syncrosoft
13/11/2005 17:55 <REP> TestLAB 2003 Express
23/12/2005 19:25 <REP> TestLAB 2003 Pro
16/11/2005 17:09 <REP> TextAloud
12/09/2005 19:51 <REP> Thomson
16/09/2005 13:56 <REP> Timeworks
04/09/2005 16:04 <REP> Torrent Search
24/07/2006 16:52 <REP> TuneUp Utilities 2006
30/04/2006 13:53 <REP> UIU
25/06/2006 12:03 <REP> Ulead Systems
28/09/2001 17:00 164ÿ864 UNWISE.EXE
03/09/2005 10:02 <REP> USB Product Driver v2.15r006
30/06/2006 14:27 <REP> vanBasco's Karaoke Player
21/01/2006 21:20 <REP> VBW
06/05/2006 08:48 <REP> ViaMichelin
10/10/2005 09:47 <REP> VideoLAN
19/09/2005 08:27 <REP> VOB
13/02/2006 17:11 <REP> VoipStunt.com
12/03/2006 13:00 <REP> vso
12/03/2006 12:59 <REP> vso_loc
07/08/2006 12:33 <REP> VVSN
01/08/2006 09:38 <REP> WebMediaPlayer
03/09/2005 10:11 <REP> WIDCOMM
31/07/2006 10:52 <REP> Winamp
08/05/2006 11:07 <REP> WinASPI
07/01/2006 20:29 <REP> Windows Installer Clean Up
14/11/2005 09:16 <REP> Windows Media Components
11/12/2005 18:27 <REP> Windows Media Connect
11/12/2005 18:27 <REP> Windows Media Connect 2
05/07/2006 15:21 <REP> Windows Media Player
01/09/2005 14:48 <REP> Windows NT
06/09/2005 11:29 <REP> WinFast
21/11/2005 11:53 <REP> WinISO
02/12/2005 14:04 <REP> WinRAR
05/05/2006 19:36 <REP> x264
01/09/2005 13:52 <REP> xerox
03/06/2006 14:46 <REP> X-Fonter
05/12/2005 14:28 <REP> Xi
15/05/2006 08:53 <REP> Xilisoft
04/09/2005 17:45 <REP> XP Codec Pack
08/05/2006 11:06 <REP> XviD
25/07/2006 15:38 <REP> Yahoo!
22/09/2005 12:22 <REP> YAMAHA
11 fichier(s) 2ÿ785ÿ138 octets
188 R‚p(s) 40ÿ267ÿ546ÿ624 octets libres

*** Fichiers ***

Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 5C72-418F
Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 5C72-418F
Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 5C72-418F


BLACKLIGHT
-------------
08/07/06 17:02:50 [Info]: BlackLight Engine 1.0.42 initialized
08/07/06 17:02:50 [Info]: OS: 5.1 build 2600 (Service Pack 2)
08/07/06 17:02:51 [Note]: 7019 4
08/07/06 17:02:51 [Note]: 7005 0
08/07/06 17:02:54 [Note]: 7006 0
08/07/06 17:02:54 [Note]: 7011 1992
08/07/06 17:02:54 [Note]: 7026 0
08/07/06 17:02:54 [Note]: 7026 0
08/07/06 17:02:54 [Note]: 7024 3
08/07/06 17:02:54 [Info]: Hidden process: C:\windows\system32\jolqshe.exe
08/07/06 17:02:54 [Note]: FSRAW library version 1.7.1019
08/07/06 17:03:53 [Note]: 4020 89789 6488064
08/07/06 17:03:53 [Note]: 4018 89789 6488064
08/07/06 17:03:53 [Note]: 4020 89789 6488064
08/07/06 17:03:53 [Note]: 4018 89789 6488064
08/07/06 17:03:53 [Note]: 4013 93152
08/07/06 17:03:53 [Note]: 4020 89789 6488064
08/07/06 17:03:53 [Note]: 4018 89789 6488064
08/07/06 17:03:53 [Note]: 4013 93152
08/07/06 17:03:53 [Note]: 4020 89789 6488064
08/07/06 17:03:53 [Note]: 4018 89789 6488064
08/07/06 17:03:53 [Note]: 4020 89789 6488064
08/07/06 17:03:53 [Note]: 4018 89789 6488064
08/07/06 17:03:53 [Note]: 4020 89789 6488064
08/07/06 17:03:53 [Note]: 4018 89789 6488064
08/07/06 17:03:53 [Note]: 4020 89789 6488064
08/07/06 17:03:53 [Note]: 4018 89789 6488064
08/07/06 17:03:53 [Note]: 4020 89789 6488064
08/07/06 17:03:53 [Note]: 4018 89789 6488064
08/07/06 17:03:53 [Note]: 4020 89789 6488064
08/07/06 17:03:53 [Note]: 4018 89789 6488064
08/07/06 17:03:53 [Note]: 4020 89789 6488064
08/07/06 17:03:53 [Note]: 4018 89789 6488064
08/07/06 17:03:53 [Note]: 4020 89789 6488064
08/07/06 17:03:53 [Note]: 4018 89789 6488064
08/07/06 17:03:53 [Note]: 4020 89789 6488064
08/07/06 17:03:53 [Note]: 4018 89789 6488064
08/07/06 17:06:16 [Info]: Hidden file: c:\WINDOWS\system32\jolqshe.dat
08/07/06 17:06:16 [Note]: 10002 1
08/07/06 17:06:17 [Info]: Hidden file: C:\windows\system32\jolqshe.exe
08/07/06 17:06:17 [Note]: 10002 1
08/07/06 17:06:17 [Info]: Hidden file: c:\WINDOWS\system32\jolqshe_nav.dat
08/07/06 17:06:17 [Note]: 10002 1
08/07/06 17:06:18 [Info]: Hidden file: c:\WINDOWS\system32\jolqshe_navps.dat
08/07/06 17:06:18 [Note]: 10002 1
08/07/06 17:06:21 [Info]: Hidden file: c:\WINDOWS\Prefetch\JOLQSHE.EXE-1FA15CF5.pf
08/07/06 17:06:21 [Note]: 10002 1
08/07/06 22:09:13 [Note]: 7007 0



Merci.
Merci.

Bonjour

Une partie de la procédure se déroulera sans avoir accès à internet, prière d'imprimer ces instructions, ou de les coller dans un fichier texte, pour lecture durant cette désinfection.
Les manipulations sont à faire sans interruption et dans l'ordre.
Si tu ne comprends pas quelque chose, demande des explications avant de commencer.

Télécharge Brute Force Uninstaller (de Merijn)
http://www.merijn.org/files/bfu.zip
Créé un nouveau dossier directement sur le C:\ et nomme-le BFU. Décompresse le fichier téléchargé dans ce nouveau dossier (C:\BFU)

Ouvre le Bloc-note et copie-colle les lignes en bleu ci-dessous

RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\jolqshe
RegDelValue HKLM\Software\Microsoft\Windows\CurrentVersion\Run|jolqshe
FileDelete %SYSDIR%\jolqshe_navps.dat
FileDelete %SYSDIR%\jolqshe_nav.dat
FileDelete %SYSDIR%\jolqshe.dat
FileDelete %SYSDIR%\jolqshe.exe

SystemEmptyTempFolder
SystemEmptyRecycleBin

FileDelete C:\egd.txt
SystemRun regedit|/e C:\egd.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"|0F8[/b]; tu verras un écran avec choix de démarrages apparaître. Utilisant les flèches du clavier, choisis "Mode Sans Échec" et valide avec "Entrée". Choisis ton compte usuel, et non Administrateur.

Démarre le "Brute Force Uninstaller" en double-cliquant BFU.exe (du dossier C:\BFU)

- Clique sur le petit dossier jaune, à la droite de la boîte Scriptline to execute, et double-clique sur :

Fixme.bfu

- Dans la boîte "Scriptline to execute", tu devrais maintenant voir ceci : C:\BFU\Fixme.bfu

Clique sur Execute et laisse-le faire son travail.

Attendre que Complete script execution apparaîsse et clique sur OK.
Clique Exit pour fermer le programme BFU.

Redémarre normalement.

Poste le rapport situé ici
C:\egd.txt avec un nouveau hijackThis.