fenetre intempestive CiD

boujour a tous,
voilà j'ai toujour des pages de pub CiD qui apparaissent quand j'essaye de joué a counter strike condition zero et ca m'enerve plus k tout.
voilà le rapport de hijackthis
Logfile of HijackThis v1.99.1
Scan saved at 13:46:40, on 25/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\ups.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\OrangeHSS\Systray\SystrayApp.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\OrangeHSS\Launcher\Launcher.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\DAP\DAP.EXE
C:\Documents and Settings\emmanuel\Bureau\hijackthis\scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.games-fusion.net/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [FSASWREG] "C:\Program Files\Securitoo\Anti-Spyware\fsaswreg.exe"
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC 300NC PC Camera
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\OrangeHSS\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [orahssStartup] "C:\Program Files\OrangeHSS\Launcher\Launcher.exe" -appid connectivityapp
O4 - HKLM\..\Run: [amen ref cast two] C:\Documents and Settings\All Users\Application Data\Curb Move Amen Ref\Plan Ante.exe
O4 - HKCU\..\Run: [System Mechanic Popup Stopper] "C:\PROGRA~1\iolo\SYSTEM~1\PopupStopper.exe"
O4 - HKCU\..\Run: [iolo System Mechanic Utility Bar] C:\PROGRA~1\iolo\SYSTEM~1\SMUtilityBar.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [PF] "C:\Documents and Settings\emmanuel\PeerFactor.exe" 0
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\progra~1\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [enc shim] C:\DOCUME~1\emmanuel\APPLIC~1\CLOSET~1\Mix Lite Camp.exe
O4 - Startup: WKCALREM.LNK = C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolb [...] p=ZNfox000
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Service de lancement de WlanCfg (W

voilà d'abord le rapport de lopresearch
apport fait à 14:18:52,31 le 25/03/2007

Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 381B-1BEB

R‚pertoire de C:\Documents and Settings\Default User\Application Data

17/06/2003 14:22 <REP> InterTrust
17/06/2003 14:22 <REP> Adobe
17/06/2003 14:22 <REP> Identities
23/11/2002 01:09 62 desktop.ini
23/11/2002 01:08 <REP> Microsoft
23/11/2002 01:08 <REP> ..
23/11/2002 01:08 <REP> .
1 fichier(s) 62 octets
6 R‚p(s) 4718624768 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 381B-1BEB

R‚pertoire de C:\Documents and Settings\All Users\Application Data

19/03/2007 18:20 <REP> Curb Move Amen Ref
13/03/2007 19:45 <REP> Microsoft Help
20/02/2007 22:14 <REP> Google
14/02/2007 16:04 <REP> NVIDIA
26/01/2007 22:15 <REP> Emjysoft
14/01/2007 14:33 <REP> InstallShield
01/10/2006 15:00 <REP> BVRP Software
21/06/2006 22:12 <REP> SecuROM
20/06/2006 23:14 394 hpzinstall.log
06/06/2006 09:51 <REP> Bluetooth
04/06/2006 09:18 <REP> Windows Genuine Advantage
28/05/2006 11:35 1755 QTSBandwidthCache
27/05/2006 11:41 <REP> Messenger Plus!
26/05/2006 21:56 <REP> Apple Computer
21/05/2006 20:01 <REP> Metacafe
23/04/2006 15:30 <REP> Symantec
03/09/2005 20:18 <REP> Spybot - Search & Destroy
24/02/2005 19:11 <REP> OLYMPUS
24/02/2005 19:02 <REP> QuickTime
12/12/2004 11:05 <REP> nView_Profiles
21/08/2004 08:47 <REP> NFS Underground
27/02/2004 21:24 <REP> Broderbund Software
10/09/2003 13:51 <REP> ScanSoft
23/11/2002 01:09 62 desktop.ini
23/11/2002 01:08 <REP> Microsoft
23/11/2002 01:08 <REP> .
23/11/2002 01:08 <REP> ..
3 fichier(s) 2211 octets
24 R‚p(s) 4718624768 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 381B-1BEB

R‚pertoire de C:\Documents and Settings\emmanuel\Application Data

21/03/2007 13:32 <REP> DeepBurner
19/03/2007 22:01 <REP> Screenshot Sender
19/03/2007 18:19 <REP> Close Type
06/03/2007 17:36 <REP> SecuROM
26/02/2007 19:56 <REP> NetPumper
22/02/2007 21:17 <REP> Google
14/02/2007 14:23 <REP> SoftInform
14/02/2007 14:23 <REP> iNetFormFiller
14/02/2007 14:21 <REP> AdsCleaner
26/01/2007 22:15 <REP> Emjysoft
23/01/2007 20:01 <REP> Media Player Classic
13/01/2007 13:21 <REP> Leadertech
31/08/2006 20:42 <REP> G-Force
04/06/2006 09:06 <REP> Sun
28/05/2006 11:35 <REP> Apple Computer
21/05/2006 23:16 <REP> Azureus
21/05/2006 22:39 <REP> LimeWire
21/05/2006 20:01 <REP> MetaCafe
21/05/2006 19:25 <REP> Mozilla
14/05/2006 17:54 <REP> Wannadoo
23/04/2006 15:30 <REP> Symantec
13/02/2006 20:40 <REP> Opera
05/02/2006 16:04 <REP> RadLight Company
28/04/2005 17:48 <REP> fltk.org
21/02/2005 21:16 <REP> Real
15/01/2005 20:27 <REP> Ahead
02/11/2004 07:38 747 enigmarc.lua
12/05/2004 13:06 <REP> InterVideo
01/05/2004 19:38 <REP> Macromedia
21/02/2004 15:14 <REP> DVD Shrink
15/09/2003 18:35 <REP> Template
10/09/2003 19:17 <REP> MSN6
08/08/2003 15:28 <REP> ZapSpot
05/07/2003 13:25 <REP> Canon
27/06/2003 19:41 <REP> Help
21/06/2003 20:55 55816 GDIPFONTCACHEV1.DAT
21/06/2003 13:33 <REP> Arcsoft
17/06/2003 14:23 62 desktop.ini
17/06/2003 14:23 <REP> Microsoft
17/06/2003 14:23 <REP> Identities
17/06/2003 14:23 <REP> Adobe
17/06/2003 14:23 <REP> ..
17/06/2003 14:23 <REP> .
17/06/2003 14:23 <REP> InterTrust
3 fichier(s) 56625 octets
41 R‚p(s) 4718624768 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 381B-1BEB

R‚pertoire de C:\Documents and Settings\Invit‚\Application Data

19/09/2003 19:34 <REP> Canon
19/09/2003 19:33 <REP> ArcSoft
10/09/2003 13:51 <REP> ScanSoft
27/06/2003 12:27 62 desktop.ini
27/06/2003 12:27 <REP> Identities
27/06/2003 12:27 <REP> Microsoft
27/06/2003 12:27 <REP> InterTrust
27/06/2003 12:27 <REP> ..
27/06/2003 12:27 <REP> .
27/06/2003 12:27 <REP> Adobe
1 fichier(s) 62 octets
9 R‚p(s) 4718624768 octets libres
******************************************
Recherche des taches planifiées dans C:\WINDOWS\tasks

Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 381B-1BEB

R‚pertoire de C:\WINDOWS\Tasks

19/03/2007 18:20 276 AA933F59919CB7E9.job
05/10/2006 20:33 284 AppleSoftwareUpdate.job
23/04/2006 15:31 418 Symantec NetDetect.job
10/09/2003 19:47 298 Jeu de dames sur Internet.job
23/11/2002 01:14 <REP> ..
23/11/2002 01:14 <REP> .
01/01/2002 00:04 6 SA.DAT
01/01/1980 00:00 65 desktop.ini
6 fichier(s) 1ÿ347 octets
2 R‚p(s) 4ÿ718ÿ624ÿ768 octets libres

******************************************
Recherche dans Program files

Le dossier C:\Program Files\C2Media n'existe pas

*************** Fin du rapport ****************

et voivi enfin le rapport de clean
Rapport clean par Malekal_morte - http://www.malekal.com
Option 1, executee le 25/03/2007 a 14:20:00,46

*** Recherche de fichiers sur C:

*** Recherche des fichiers dans C:\WINDOWS\
C:\WINDOWS\update\ FOUND

*** Recherche des fichiers dans C:\WINDOWS\system32
C:\WINDOWS\impborl.dll FOUND

"C:\Program Files\Adverts\" FOUND
"C:\Program Files\DaemonTools_WhenUSave_Installer\" FOUND
"C:\Program Files\netpumper\" FOUND
"C:\Program Files\thriXXX\" FOUND
"C:\Program Files\Viewpoint\" FOUND
*** Fin du rapport !

voilà le rapport
Folder cleanup failed. C:\Documents and Settings\All Users\Application Data\Curb Move Amen Ref scheduled to be deleted on reboot.
C:\Documents and Settings\emmanuel\Application Data\Close Type moved successfully.
C:\WINDOWS\Tasks\AA933F59919CB7E9.job moved successfully.
File/Folder C:\Program Files\Adverts\" FOUND not found.
C:\Program Files\DaemonTools_WhenUSave_Installer moved successfully.
C:\Program Files\netpumper\ZM moved successfully.
C:\Program Files\netpumper moved successfully.
C:\Program Files\thriXXX\3D SexVilla\Logs moved successfully.
C:\Program Files\thriXXX\3D SexVilla moved successfully.
C:\Program Files\thriXXX moved successfully.
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03 moved successfully.
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02 moved successfully.
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01 moved successfully.
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00 moved successfully.
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Resources moved successfully.
C:\Program Files\Viewpoint\Viewpoint Experience Technology\DownloadedComponents moved successfully.
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents moved successfully.
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components moved successfully.
C:\Program Files\Viewpoint\Viewpoint Experience Technology moved successfully.
C:\Program Files\Viewpoint moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\impborl.dll
C:\WINDOWS\impborl.dll NOT unregistered.
C:\WINDOWS\impborl.dll moved successfully.
C:\WINDOWS\update moved successfully.

Created on 03/25/2007 15:24:16

voilà
Logfile of HijackThis v1.99.1
Scan saved at 16:47:01, on 25/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\ups.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\OrangeHSS\Systray\SystrayApp.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\OrangeHSS\Launcher\Launcher.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\emmanuel\Bureau\hijackthis\scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [FSASWREG] "C:\Program Files\Securitoo\Anti-Spyware\fsaswreg.exe"
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC 300NC PC Camera
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\OrangeHSS\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [orahssStartup] "C:\Program Files\OrangeHSS\Launcher\Launcher.exe" -appid connectivityapp
O4 - HKCU\..\Run: [System Mechanic Popup Stopper] "C:\PROGRA~1\iolo\SYSTEM~1\PopupStopper.exe"
O4 - HKCU\..\Run: [iolo System Mechanic Utility Bar] C:\PROGRA~1\iolo\SYSTEM~1\SMUtilityBar.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [PF] "C:\Documents and Settings\emmanuel\PeerFactor.exe" 0
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\progra~1\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: WKCALREM.LNK = C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe

pr linstant on diré k sa march mé je né po pu faire le scan en ligne psk je retrouve plu internet explorer merci

Salut Angeldark moi aussi j'ai un probleme avec les fenetres CID je ne sais pas comment j'ai chope ca mais bon...
Ca serait gentil si tu pouvais m'aider
voila les rapports que j'ai obtenu

Logfile of HijackThis v1.99.1
Scan saved at 17:22:47, on 25/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\VoipBuster.com\VoipBuster\VoipBuster.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\SAGEM WiFi manager\WLANUTL.exe
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\OZKANN~1.000\LOCALS~1\Temp\Répertoire temporaire 3 pour hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [tray user grid debug] C:\Documents and Settings\All Users\Application Data\bin cast tray user\CDROM LIVE.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [VoipBuster] "C:\Program Files\VoipBuster.com\VoipBuster\VoipBuster.exe" -nosplash -minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/bina [...] b56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{06F714DB-D112-4FE4-9E99-8A7D464B3510}: NameServer = 192.168.1.1,80.10.246.129
O17 - HKLM\System\CS1\Services\Tcpip\..\{06F714DB-D112-4FE4-9E99-8A7D464B3510}: NameServer = 192.168.1.1,80.10.246.129
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)






















































CONTENU DE LOPRESEARCH

Rapport fait à 17:00:08,26 le 25/05/2007

Le volume dans le lecteur C s'appelle PRESARIO
Le num‚ro de s‚rie du volume est 6E5D-F58B

R‚pertoire de C:\Documents and Settings\All Users\Application Data

15/05/2007 20:48 <REP> bin cast tray user
24/01/2007 13:14 <REP> Micro Application
27/12/2006 09:15 <REP> Macromedia
12/12/2006 18:19 <REP> Windows Live Toolbar
12/12/2006 18:02 <REP> Windows Genuine Advantage
26/09/2006 23:34 <REP> Google
25/04/2006 00:58 <REP> Adobe
25/04/2006 00:56 <REP> CyberLink
25/04/2006 00:55 <REP> InstallShield
25/04/2006 00:50 <REP> Sonic
25/04/2006 00:49 368 hpzinstall.log
25/04/2006 00:33 <REP> SBSI
27/10/2005 00:34 <REP> Microsoft
27/10/2005 00:34 <REP> ..
27/10/2005 00:34 <REP> .
23/11/2004 17:13 62 desktop.ini
2 fichier(s) 430 octets
14 R‚p(s) 272848908288 octets libres
Le volume dans le lecteur C s'appelle PRESARIO
Le num‚ro de s‚rie du volume est 6E5D-F58B

R‚pertoire de C:\Documents and Settings\Compaq_Propri‚taire

Le volume dans le lecteur C s'appelle PRESARIO
Le num‚ro de s‚rie du volume est 6E5D-F58B

R‚pertoire de C:\Documents and Settings\Default User\Application Data

18/09/2006 20:44 <REP> Real
27/10/2005 00:34 <REP> Microsoft
27/10/2005 00:34 <REP> Identities
27/10/2005 00:34 <REP> ..
27/10/2005 00:34 <REP> .
23/11/2004 17:13 62 desktop.ini
1 fichier(s) 62 octets
5 R‚p(s) 272848908288 octets libres
Le volume dans le lecteur C s'appelle PRESARIO
Le num‚ro de s‚rie du volume est 6E5D-F58B

R‚pertoire de C:\Documents and Settings\Ozkan\Application Data

01/02/2007 17:45 <REP> Nokia Multimedia Player
24/01/2007 13:38 <REP> InstallShield Installation Information
23/01/2007 20:27 <REP> InstallShield
19/01/2007 09:35 <REP> Help
18/01/2007 14:57 <REP> AdobeUM
15/01/2007 16:19 <REP> Sonic
07/01/2007 11:12 <REP> Template
06/01/2007 17:18 150 wklnhst.dat
04/01/2007 15:22 <REP> HPQ
04/01/2007 15:11 <REP> CyberLink
04/01/2007 13:59 <REP> Leadertech
03/01/2007 13:49 <REP> Sun
03/01/2007 13:49 <REP> Macromedia
03/01/2007 13:45 <REP> Adobe
03/01/2007 13:27 <REP> Google
02/01/2007 23:10 <REP> PC Suite
02/01/2007 23:09 62 desktop.ini
02/01/2007 23:09 <REP> Identities
02/01/2007 23:09 <REP> Microsoft
02/01/2007 23:09 <REP> ..
02/01/2007 23:09 <REP> .
02/01/2007 23:09 <REP> Real
2 fichier(s) 212 octets
20 R‚p(s) 272848908288 octets libres
Le volume dans le lecteur C s'appelle PRESARIO
Le num‚ro de s‚rie du volume est 6E5D-F58B

R‚pertoire de C:\Documents and Settings\ozkan.NOM-EB85C523610\Application Data

22/02/2007 16:00 <REP> CyberLink
18/02/2007 12:42 <REP> Template
18/02/2007 12:42 0 wklnhst.dat
16/02/2007 21:08 <REP> AdobeUM
04/02/2007 20:41 <REP> Adobe
04/02/2007 13:25 <REP> PC Suite
02/02/2007 18:18 <REP> Sun
02/02/2007 17:17 <REP> Macromedia
02/02/2007 17:17 <REP> Google
02/02/2007 17:15 62 desktop.ini
02/02/2007 17:15 <REP> Identities
02/02/2007 17:15 <REP> Microsoft
02/02/2007 17:15 <REP> Real
02/02/2007 17:15 <REP> .
02/02/2007 17:15 <REP> ..
2 fichier(s) 62 octets
13 R‚p(s) 272848908288 octets libres
Le volume dans le lecteur C s'appelle PRESARIO
Le num‚ro de s‚rie du volume est 6E5D-F58B

R‚pertoire de C:\Documents and Settings\ozkan.NOM-EB85C523610.000\Application Data

07/05/2007 18:31 <REP> Template
07/05/2007 13:11 <REP> Help
27/04/2007 17:35 <REP> Adobe
24/04/2007 17:27 364 wklnhst.dat
13/04/2007 13:55 <REP> VoipBuster
05/03/2007 11:00 <REP> CyberLink
03/03/2007 14:08 <REP> HPQ
02/03/2007 20:37 <REP> Sun
02/03/2007 16:38 <REP> Macromedia
02/03/2007 16:34 <REP> Google
02/03/2007 16:27 <REP> PC Suite
02/03/2007 16:27 62 desktop.ini
02/03/2007 16:27 <REP> Identities
02/03/2007 16:27 <REP> Microsoft
02/03/2007 16:27 <REP> Real
02/03/2007 16:27 <REP> .
02/03/2007 16:27 <REP> ..
2 fichier(s) 426 octets
15 R‚p(s) 272848904192 octets libres
******************************************
Recherche des taches planifiées dans C:\WINDOWS\tasks

Le volume dans le lecteur C s'appelle PRESARIO
Le num‚ro de s‚rie du volume est 6E5D-F58B

R‚pertoire de C:\WINDOWS\Tasks

15/05/2007 20:48 302 A6E3E2AD91909B19.job
27/10/2005 01:30 <REP> ..
27/10/2005 01:30 <REP> .
23/11/2004 16:29 6 SA.DAT
05/08/2004 13:00 65 desktop.ini
3 fichier(s) 373 octets
2 R‚p(s) 272ÿ848ÿ904ÿ192 octets libres

******************************************
Recherche dans Program files

Pas de dossiers relatifs à Lop
******************************************
Recherche d'infections connues


C:\WINDOWS\system32\csrss.exe Wareout possible ! faux-positif si csrss.exe !
*************** Fin du rapport ****************
Rapport fait à 17:23:35,81 le 25/05/2007

Le volume dans le lecteur C s'appelle PRESARIO
Le num‚ro de s‚rie du volume est 6E5D-F58B

R‚pertoire de C:\Documents and Settings\All Users\Application Data

15/05/2007 20:48 <REP> bin cast tray user
24/01/2007 13:14 <REP> Micro Application
27/12/2006 09:15 <REP> Macromedia
12/12/2006 18:19 <REP> Windows Live Toolbar
12/12/2006 18:02 <REP> Windows Genuine Advantage
26/09/2006 23:34 <REP> Google
25/04/2006 00:58 <REP> Adobe
25/04/2006 00:56 <REP> CyberLink
25/04/2006 00:55 <REP> InstallShield
25/04/2006 00:50 <REP> Sonic
25/04/2006 00:49 368 hpzinstall.log
25/04/2006 00:33 <REP> SBSI
27/10/2005 00:34 <REP> Microsoft
27/10/2005 00:34 <REP> ..
27/10/2005 00:34 <REP> .
23/11/2004 17:13 62 desktop.ini
2 fichier(s) 430 octets
14 R‚p(s) 272843227136 octets libres
Le volume dans le lecteur C s'appelle PRESARIO
Le num‚ro de s‚rie du volume est 6E5D-F58B

R‚pertoire de C:\Documents and Settings\Compaq_Propri‚taire

Le volume dans le lecteur C s'appelle PRESARIO
Le num‚ro de s‚rie du volume est 6E5D-F58B

R‚pertoire de C:\Documents and Settings\Default User\Application Data

18/09/2006 20:44 <REP> Real
27/10/2005 00:34 <REP> Microsoft
27/10/2005 00:34 <REP> Identities
27/10/2005 00:34 <REP> ..
27/10/2005 00:34 <REP> .
23/11/2004 17:13 62 desktop.ini
1 fichier(s) 62 octets
5 R‚p(s) 272843227136 octets libres
Le volume dans le lecteur C s'appelle PRESARIO
Le num‚ro de s‚rie du volume est 6E5D-F58B

R‚pertoire de C:\Documents and Settings\Ozkan\Application Data

01/02/2007 17:45 <REP> Nokia Multimedia Player
24/01/2007 13:38 <REP> InstallShield Installation Information
23/01/2007 20:27 <REP> InstallShield
19/01/2007 09:35 <REP> Help
18/01/2007 14:57 <REP> AdobeUM
15/01/2007 16:19 <REP> Sonic
07/01/2007 11:12 <REP> Template
06/01/2007 17:18 150 wklnhst.dat
04/01/2007 15:22 <REP> HPQ
04/01/2007 15:11 <REP> CyberLink
04/01/2007 13:59 <REP> Leadertech
03/01/2007 13:49 <REP> Sun
03/01/2007 13:49 <REP> Macromedia
03/01/2007 13:45 <REP> Adobe
03/01/2007 13:27 <REP> Google
02/01/2007 23:10 <REP> PC Suite
02/01/2007 23:09 62 desktop.ini
02/01/2007 23:09 <REP> Identities
02/01/2007 23:09 <REP> Microsoft
02/01/2007 23:09 <REP> ..
02/01/2007 23:09 <REP> .
02/01/2007 23:09 <REP> Real
2 fichier(s) 212 octets
20 R‚p(s) 272843223040 octets libres
Le volume dans le lecteur C s'appelle PRESARIO
Le num‚ro de s‚rie du volume est 6E5D-F58B

R‚pertoire de C:\Documents and Settings\ozkan.NOM-EB85C523610\Application Data

22/02/2007 16:00 <REP> CyberLink
18/02/2007 12:42 <REP> Template
18/02/2007 12:42 0 wklnhst.dat
16/02/2007 21:08 <REP> AdobeUM
04/02/2007 20:41 <REP> Adobe
04/02/2007 13:25 <REP> PC Suite
02/02/2007 18:18 <REP> Sun
02/02/2007 17:17 <REP> Macromedia
02/02/2007 17:17 <REP> Google
02/02/2007 17:15 62 desktop.ini
02/02/2007 17:15 <REP> Identities
02/02/2007 17:15 <REP> Microsoft
02/02/2007 17:15 <REP> Real
02/02/2007 17:15 <REP> .
02/02/2007 17:15 <REP> ..
2 fichier(s) 62 octets
13 R‚p(s) 272843223040 octets libres
Le volume dans le lecteur C s'appelle PRESARIO
Le num‚ro de s‚rie du volume est 6E5D-F58B

R‚pertoire de C:\Documents and Settings\ozkan.NOM-EB85C523610.000\Application Data

07/05/2007 18:31 <REP> Template
07/05/2007 13:11 <REP> Help
27/04/2007 17:35 <REP> Adobe
24/04/2007 17:27 364 wklnhst.dat
13/04/2007 13:55 <REP> VoipBuster
05/03/2007 11:00 <REP> CyberLink
03/03/2007 14:08 <REP> HPQ
02/03/2007 20:37 <REP> Sun
02/03/2007 16:38 <REP> Macromedia
02/03/2007 16:34 <REP> Google
02/03/2007 16:27 <REP> PC Suite
02/03/2007 16:27 62 desktop.ini
02/03/2007 16:27 <REP> Identities
02/03/2007 16:27 <REP> Microsoft
02/03/2007 16:27 <REP> Real
02/03/2007 16:27 <REP> .
02/03/2007 16:27 <REP> ..
2 fichier(s) 426 octets
15 R‚p(s) 272843223040 octets libres
******************************************
Recherche des taches planifiées dans C:\WINDOWS\tasks

Le volume dans le lecteur C s'appelle PRESARIO
Le num‚ro de s‚rie du volume est 6E5D-F58B

R‚pertoire de C:\WINDOWS\Tasks

15/05/2007 20:48 302 A6E3E2AD91909B19.job
27/10/2005 01:30 <REP> ..
27/10/2005 01:30 <REP> .
23/11/2004 16:29 6 SA.DAT
05/08/2004 13:00 65 desktop.ini
3 fichier(s) 373 octets
2 R‚p(s) 272ÿ843ÿ223ÿ040 octets libres

******************************************
Recherche dans Program files

Pas de dossiers relatifs à Lop
******************************************
Recherche d'infections connues


C:\WINDOWS\system32\csrss.exe Wareout possible ! faux-positif si csrss.exe !
*************** Fin du rapport ****************