Bonjour,

J'ai chopé un virus qui m'ouvre des fênetre en permanence avec affiché diffrents messages : par exemple :

"Message de SYSTEM à ALERT le 24/05/2007 16:46:40

STOP! WINDOWS REQUIRES IMMEDIATE ATTENTION.

Windows has found CRITICAL SYSTEM ERRORS.

Run Registry Repair from : http://fix64.com

FAILURE TO ACT NOW MAY LEAD TO DATA LOSS AND CORRUPTION "

Je poste le rapport Hijackthis! :

Logfile of HijackThis v1.99.1
Scan saved at 17:06:28, on 24/05/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Philips ToUcam Camera\VProperty.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\ECB-CLEO.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\Chantal\Bureau\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.s1s1s1search.com/sp2.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {B481206C-BDD1-B072-A0AB-91CB2BEC5CB3} - C:\WINDOWS\System32\kjxxexix.dll (file missing)
R3 - URLSearchHook: (no name) - {82AC1069-90E1-F346-8D99-D4E61DAD71F5} - C:\WINDOWS\System32\kjxxexix.dll (file missing)
O1 - Hosts: d-network.com
O1 - Hosts: .0.1 www.emusic.com
O1 - Hosts: s.com
O1 - Hosts: 0.0.1 www.kazaa-lite.com
O1 - Hosts: d-network.com
O1 - Hosts: .0.1 www.emusic.com
O1 - Hosts: x.org
O1 - Hosts: tium.org
O1 - Hosts: s.com
O1 - Hosts: 0.0.1 www.kazaa-lite.com
O1 - Hosts: d-network.com
O1 - Hosts: .0.1 www.emusic.com
O1 - Hosts: ag
O1 - Hosts: x.org
O1 - Hosts: tium.org
O1 - Hosts: s.com
O1 - Hosts: 0.0.1 www.kazaa-lite.com
O1 - Hosts: d-network.com
O1 - Hosts: .0.1 www.emusic.com
O1 - Hosts: www.mp3downloadcity.com
O1 - Hosts: .de
O1 - Hosts: ag
O1 - Hosts: x.org
O1 - Hosts: tium.org
O1 - Hosts: s.com
O1 - Hosts: 0.0.1 www.kazaa-lite.com
O1 - Hosts: d-network.com
O1 - Hosts: .0.1 www.emusic.com
O1 - Hosts: om
O1 - Hosts: www.mp3downloadcity.com
O1 - Hosts: .de
O1 - Hosts: ag
O1 - Hosts: x.org
O1 - Hosts: tium.org
O1 - Hosts: s.com
O1 - Hosts: 0.0.1 www.kazaa-lite.com
O1 - Hosts: 1 www.shareza.com
O1 - Hosts: org
O1 - Hosts: d-network.com
O1 - Hosts: .0.1 www.emusic.com
O1 - Hosts: om
O1 - Hosts: www.mp3downloadcity.com
O1 - Hosts: .de
O1 - Hosts: ag
O1 - Hosts: x.org
O1 - Hosts: tium.org
O1 - Hosts: .0.0.1 www.k-lite.de
O1 - Hosts: info
O1 - Hosts: s.com
O1 - Hosts: 0.0.1 www.kazaa-lite.com
O1 - Hosts: 1 www.shareza.com
O1 - Hosts: org
O1 - Hosts: d-network.com
O1 - Hosts: .0.1 www.emusic.com
O1 - Hosts: om
O1 - Hosts: www.mp3downloadcity.com
O1 - Hosts: .de
O1 - Hosts: 27.0.0.1 www.mp3-unlimited-downloads.com
O1 - Hosts: ag
O1 - Hosts: x.org
O1 - Hosts: tium.org
O1 - Hosts: .0.0.1 www.k-lite.de
O1 - Hosts: info
O1 - Hosts: s.com
O1 - Hosts: 0.0.1 www.kazaa-lite.com
O1 - Hosts: 1 www.shareza.com
O1 - Hosts: org
O1 - Hosts: d-network.com
O1 - Hosts: .0.1 www.emusic.com
O1 - Hosts: om
O1 - Hosts: 127.0.0
O1 - Hosts: 7.0.0.1 www.kazaa-download.de
O1 - Hosts: 127.0.0
O1 - Hosts: 27.0.0.1 www.kazaagold.com
O1 - Hosts: www.mp3downloadcity.com
O1 - Hosts: .de
O1 - Hosts: 27.0.0.1 www.mp3-unlimited-downloads.com
O1 - Hosts: ag
O1 - Hosts: x.org
O1 - Hosts: tium.org
O1 - Hosts: .0.0.1 www.k-lite.de
O1 - Hosts: info
O1 - Hosts: s.com
O1 - Hosts: 0.0.1 www.kazaa-lite.com
O1 - Hosts: 127.0.0.
O1 - Hosts: 127.0.0.
O1 - Hosts: 1 www.shareza.com
O1 - Hosts: org
O1 - Hosts: d-network.com
O1 - Hosts: .0.1 www.emusic.com
O1 - Hosts: om
O1 - Hosts: 127.0.0
O1 - Hosts: 7.0.0.1 www.kazaa-download.de
O1 - Hosts: 127.0.0
O1 - Hosts: 27.0.0.1 www.kazaagold.com
O1 - Hosts: www.mp3downloadcity.com
O1 - Hosts: .de
O1 - Hosts: 27.0.0.1 www.mp3-unlimited-downloads.com
O1 - Hosts: ag
O1 - Hosts: ww.xvidmovies.com
O1 - Hosts: x.org
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {222D352C-E3A2-D304-C990-F17497B1D4AB} - C:\WINDOWS\System32\ometffbb.dll (file missing)
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\System32\BhoECart.dll
O2 - BHO: (no name) - {3549E9DB-2574-426E-914E-851D9E8DBF88} - C:\WINDOWS\System32\guoapcwv.dll
O2 - BHO: (no name) - {519B77EC-EF09-EBFE-2C02-CBCE6BC9EFEF} - C:\WINDOWS\System32\rcm.dll (file missing)
O2 - BHO: (no name) - {742FEB7C-3BAD-5C5D-C105-2869C6F387F9} - C:\WINDOWS\System32\pzs.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {82AC1069-90E1-F346-8D99-D4E61DAD71F5} - C:\WINDOWS\System32\kjxxexix.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B481206C-BDD1-B072-A0AB-91CB2BEC5CB3} - C:\WINDOWS\System32\kjxxexix.dll (file missing)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {EE95B58B-AA73-9E40-C02D-4241E3269A82} - C:\DOCUME~1\Chantal\APPLIC~1\GLOBAL~1\Jugs Dupe.exe (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {821F87FF-8245-4972-9E28-732E92EC2F51} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s
O4 - HKLM\..\Run: [MS Unix Binary] msnq3insller.exe
O4 - HKLM\..\Run: [bIGjYFso0] C:\WINDOWS\fwethvb.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [The Heart Lite Download] C:\Documents and Settings\All Users\Application Data\chinacetheheart\RoadUser.exe
O4 - HKLM\..\Run: [ToUcamVProperty] C:\Program Files\Philips ToUcam Camera\VProperty.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [eCarteBleue-CLEO] "C:\Program Files\ECB-CLEO.exe" /dontopenmycards
O4 - HKLM\..\RunServices: [MS Unix Binary] msnq3insller.exe
O4 - HKLM\..\RunServices: [Windowfdgfds DLL fgfdg Verifier] winsecure.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MS Unix Binary] msnq3insller.exe
O4 - HKCU\..\Run: [Loio] "C:\WINDOWS\MBOLS~1\explorer.exe" -vt ndrv
O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"
O4 - HKCU\..\Run: [Ekr] C:\WINDOWS\W?nSxS\n?tepad.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\RunServices: [Smoking pot] poteux.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exe
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O4 - Global Startup: Reality Fusion GameCam SE.lnk = ?
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusea [...] xdm209YYFR
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O15 - Trusted Zone: http://*.billingnow.com
O15 - Trusted Zone: http://locator1.cdn.imagesrvr.com
O15 - Trusted Zone: http://*.reliablestats.com
O15 - Trusted Zone: http://*.winantispyware.com
O15 - Trusted Zone: http://*.winnanny.com
O15 - Trusted IP range: http://202.67.220.225
O15 - Trusted IP range: http://59.148.220.121
O15 - Trusted IP range: http://62.4.84.53
O15 - Trusted IP range: http://82.98.235.58
O15 - Trusted IP range: http://85.12.25.90
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O16 - DPF: {B3231E01-D1EA-4BF1-B872-CF21619704F3} (NMInstall Control) - http://a14.g.akamai.net/f/14/7141/ [...] EUROPE.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~2\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~2\MSGRAP~1.DLL
O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll
O20 - Winlogon Notify: cmqkfxyd - cmqkfxyd.dll (file missing)
O20 - Winlogon Notify: xxyxu - xxyxu.dll (file missing)
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe

Ca bloque à "recherche hosts"

En fait ça a marché :

SmitFraudFix v2.186

Rapport fait à 17:27:04,93, 24/05/2007
Executé à partir de C:\Documents and Settings\Chantal\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Philips ToUcam Camera\VProperty.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\ECB-CLEO.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Chantal


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Chantal\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Chantal\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte réseau virtuelle FreeBox USB #3 - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.54.252
DNS Server Search Order: 212.27.53.252

HKLM\SYSTEM\CCS\Services\Tcpip\..\{E50FF01D-A891-45D3-8D1B-ED72EA126F4B}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{E50FF01D-A891-45D3-8D1B-ED72EA126F4B}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS3\Services\Tcpip\..\{E50FF01D-A891-45D3-8D1B-ED72EA126F4B}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin


Est ce que je fais l'autre truc aussi finalement ?
Merci pour ton aide !

VundoFix V6.4.1

Checking Java version...

Java version is 1.5.0.5
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.8
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 17:48:40 24/05/2007

Listing files found while scanning....

C:\WINDOWS\qaz4.txt
C:\WINDOWS\system32\klxnqern.exe
C:\WINDOWS\system32\tweqmlgl.exe
C:\WINDOWS\system32\yyemmhxt.exe

Beginning removal...

Attempting to delete C:\WINDOWS\qaz4.txt
C:\WINDOWS\qaz4.txt Has been deleted!

Attempting to delete C:\WINDOWS\system32\klxnqern.exe
C:\WINDOWS\system32\klxnqern.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\tweqmlgl.exe
C:\WINDOWS\system32\tweqmlgl.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\yyemmhxt.exe
C:\WINDOWS\system32\yyemmhxt.exe Has been deleted!

Performing Repairs to the registry.
Done!

----------------------


Logfile of HijackThis v1.99.1
Scan saved at 01:13:21, on 25/05/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Philips ToUcam Camera\VProperty.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\ECB-CLEO.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Chantal\Bureau\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.s1s1s1search.com/sp2.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {B481206C-BDD1-B072-A0AB-91CB2BEC5CB3} - C:\WINDOWS\System32\kjxxexix.dll (file missing)
R3 - URLSearchHook: (no name) - {82AC1069-90E1-F346-8D99-D4E61DAD71F5} - C:\WINDOWS\System32\kjxxexix.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {222D352C-E3A2-D304-C990-F17497B1D4AB} - C:\WINDOWS\System32\ometffbb.dll (file missing)
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\System32\BhoECart.dll
O2 - BHO: (no name) - {3549E9DB-2574-426E-914E-851D9E8DBF88} - C:\WINDOWS\System32\guoapcwv.dll
O2 - BHO: (no name) - {519B77EC-EF09-EBFE-2C02-CBCE6BC9EFEF} - C:\WINDOWS\System32\rcm.dll (file missing)
O2 - BHO: (no name) - {742FEB7C-3BAD-5C5D-C105-2869C6F387F9} - C:\WINDOWS\System32\pzs.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {82AC1069-90E1-F346-8D99-D4E61DAD71F5} - C:\WINDOWS\System32\kjxxexix.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B481206C-BDD1-B072-A0AB-91CB2BEC5CB3} - C:\WINDOWS\System32\kjxxexix.dll (file missing)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {EE95B58B-AA73-9E40-C02D-4241E3269A82} - C:\DOCUME~1\Chantal\APPLIC~1\GLOBAL~1\Jugs Dupe.exe (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {821F87FF-8245-4972-9E28-732E92EC2F51} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s
O4 - HKLM\..\Run: [MS Unix Binary] msnq3insller.exe
O4 - HKLM\..\Run: [bIGjYFso0] C:\WINDOWS\fwethvb.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [The Heart Lite Download] C:\Documents and Settings\All Users\Application Data\chinacetheheart\RoadUser.exe
O4 - HKLM\..\Run: [ToUcamVProperty] C:\Program Files\Philips ToUcam Camera\VProperty.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [eCarteBleue-CLEO] "C:\Program Files\ECB-CLEO.exe" /dontopenmycards
O4 - HKLM\..\RunServices: [MS Unix Binary] msnq3insller.exe
O4 - HKLM\..\RunServices: [Windowfdgfds DLL fgfdg Verifier] winsecure.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MS Unix Binary] msnq3insller.exe
O4 - HKCU\..\Run: [Loio] "C:\WINDOWS\MBOLS~1\explorer.exe" -vt ndrv
O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"
O4 - HKCU\..\Run: [Ekr] C:\WINDOWS\W?nSxS\n?tepad.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\RunServices: [Smoking pot] poteux.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exe
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O4 - Global Startup: Reality Fusion GameCam SE.lnk = ?
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusea [...] xdm209YYFR
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O16 - DPF: {B3231E01-D1EA-4BF1-B872-CF21619704F3} (NMInstall Control) - http://a14.g.akamai.net/f/14/7141/ [...] EUROPE.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~2\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~2\MSGRAP~1.DLL
O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll
O20 - Winlogon Notify: cmqkfxyd - cmqkfxyd.dll (file missing)
O20 - Winlogon Notify: xxyxu - xxyxu.dll (file missing)
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe

"Chantal" - 2007-05-26 0:40:00 Service Pack 1
ComboFix 07-05.26.V - Running from: "C:\Documents and Settings\Chantal\Bureau\"


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


"C:\WINDOWS\system32\wtssu.exe"

Purity Folders:

C:\WINDOWS\SSTEM~1
C:\WINDOWS\WNSXS~1
C:\WINDOWS\MBOLS~1
C:\Program Files\SSEMBL~1
C:\DOCUME~1\Chantal\APPLIC~1\ICROSO~1.NET
C:\DOCUME~1\Chantal\MESDOC~1\SCURIT~1
C:\DOCUME~1\Chantal\MESDOC~1\DOBE~1



((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-26 ))))))))))))))))))))))))))))))))))


2007-05-25 02:09 <REP> d-------- C:\Program Files\Save
2007-05-24 17:48 <REP> d-------- C:\VundoFix Backups
2007-05-24 17:37 3,198 --a------ C:\WINDOWS\system32\tmp.reg
2007-05-19 19:47 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-05-19 19:47 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-05-19 02:16 98,816 --a------ C:\WINDOWS\system32\dmstyle.dll
2007-05-19 02:16 974,848 --a------ C:\WINDOWS\system32\dxdiag.exe
2007-05-19 02:16 83,968 --a------ C:\WINDOWS\system32\drivers\nabtsfec.sys
2007-05-19 02:16 80,896 --a------ C:\WINDOWS\system32\dpvsetup.exe
2007-05-19 02:16 8,192 --a------ C:\WINDOWS\system32\d3d8thk.dll
2007-05-19 02:16 797,184 --a------ C:\WINDOWS\system32\d3dim700.dll
2007-05-19 02:16 79,360 --a------ C:\WINDOWS\system32\dpwsockx.dll
2007-05-19 02:16 77,824 --a------ C:\WINDOWS\system32\dpmodemx.dll
2007-05-19 02:16 76,800 --a------ C:\WINDOWS\system32\dmscript.dll
2007-05-19 02:16 733,184 --a------ C:\WINDOWS\system32\qedwipes.dll
2007-05-19 02:16 723,968 --a------ C:\WINDOWS\system32\dpnet.dll
2007-05-19 02:16 7,424 --a------ C:\WINDOWS\system32\drivers\mskssrv.sys
2007-05-19 02:16 68,096 --a------ C:\WINDOWS\system32\dpnhupnp.dll
2007-05-19 02:16 64,512 --a------ C:\WINDOWS\system32\amstream.dll
2007-05-19 02:16 63,696 --a------ C:\WINDOWS\system32\dxdllreg.exe
2007-05-19 02:16 602,624 --a------ C:\WINDOWS\system32\dx7vb.dll
2007-05-19 02:16 58,368 --a------ C:\WINDOWS\system32\dmcompos.dll
2007-05-19 02:16 52,096 --a------ C:\WINDOWS\system32\drivers\msdv.sys
2007-05-19 02:16 5,504 --a------ C:\WINDOWS\system32\drivers\mstee.sys
2007-05-19 02:16 5,248 --a------ C:\WINDOWS\system32\drivers\mspclock.sys
2007-05-19 02:16 491,520 --a------ C:\WINDOWS\system32\dsdmoprp.dll
2007-05-19 02:16 48,512 --a------ C:\WINDOWS\system32\drivers\stream.sys
2007-05-19 02:16 470,528 --a------ C:\WINDOWS\system32\qdvd.dll
2007-05-19 02:16 47,104 --a------ C:\WINDOWS\system32\wstdecod.dll
2007-05-19 02:16 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2007-05-19 02:16 4,096 --a------ C:\WINDOWS\system32\drivers\swenum.sys
2007-05-19 02:16 381,952 --a------ C:\WINDOWS\system32\dsound.dll
2007-05-19 02:16 381,952 --a------ C:\WINDOWS\system32\dpvoice.dll
2007-05-19 02:16 354,816 --a------ C:\WINDOWS\system32\psisdecd.dll
2007-05-19 02:16 34,304 --a------ C:\WINDOWS\system32\mciqtz32.dll
2007-05-19 02:16 33,280 --a------ C:\WINDOWS\system32\dmloader.dll
2007-05-19 02:16 324,096 --a------ C:\WINDOWS\system32\mswebdvd.dll
2007-05-19 02:16 32,768 --a------ C:\WINDOWS\system32\dpnhpast.dll
2007-05-19 02:16 316,928 --a------ C:\WINDOWS\system32\qdv.dll
2007-05-19 02:16 3,072 --a------ C:\WINDOWS\system32\dpnlobby.dll
2007-05-19 02:16 3,072 --a------ C:\WINDOWS\system32\dpnaddr.dll
2007-05-19 02:16 292,864 --a------ C:\WINDOWS\system32\ddraw.dll
2007-05-19 02:16 28,160 --a------ C:\WINDOWS\system32\dplaysvr.exe
2007-05-19 02:16 27,136 --a------ C:\WINDOWS\system32\dmband.dll
2007-05-19 02:16 257,024 --a------ C:\WINDOWS\system32\qcap.dll
2007-05-19 02:16 24,064 --a------ C:\WINDOWS\system32\ddrawex.dll
2007-05-19 02:16 230,400 --a------ C:\WINDOWS\system32\dplayx.dll
2007-05-19 02:16 19,968 --a------ C:\WINDOWS\system32\dpvacm.dll
2007-05-19 02:16 186,880 --a------ C:\WINDOWS\system32\dsdmo.dll
2007-05-19 02:16 181,248 --a------ C:\WINDOWS\system32\dmime.dll
2007-05-19 02:16 18,944 --a------ C:\WINDOWS\system32\encapi.dll
2007-05-19 02:16 18,688 --a------ C:\WINDOWS\system32\drivers\wstcodec.sys
2007-05-19 02:16 18,432 --a------ C:\WINDOWS\system32\dswave.dll
2007-05-19 02:16 16,896 --a------ C:\WINDOWS\system32\msyuv.dll
2007-05-19 02:16 16,896 --a------ C:\WINDOWS\system32\dpnsvr.exe
2007-05-19 02:16 16,384 --a------ C:\WINDOWS\system32\drivers\ccdecode.sys
2007-05-19 02:16 15,104 --a------ C:\WINDOWS\system32\drivers\mpe.sys
2007-05-19 02:16 14,976 --a------ C:\WINDOWS\system32\drivers\streamip.sys
2007-05-19 02:16 132,608 --a------ C:\WINDOWS\system32\devenum.dll
2007-05-19 02:16 130,304 --a------ C:\WINDOWS\system32\drivers\ks.sys
2007-05-19 02:16 13,312 --a------ C:\WINDOWS\system32\msdmo.dll
2007-05-19 02:16 122,880 --a------ C:\WINDOWS\system32\dmusic.dll
2007-05-19 02:16 112,128 --a------ C:\WINDOWS\system32\dpvvox.dll
2007-05-19 02:16 11,392 --a------ C:\WINDOWS\system32\drivers\bdasup.sys
2007-05-19 02:16 100,864 --a------ C:\WINDOWS\system32\dmsynth.dll
2007-05-19 02:16 10,880 --a------ C:\WINDOWS\system32\drivers\slip.sys
2007-05-19 02:16 10,112 --a------ C:\WINDOWS\system32\drivers\ndisip.sys
2007-05-19 02:16 1,962,496 --a------ C:\WINDOWS\system32\quartz.dll
2007-05-19 02:16 1,798,144 --a------ C:\WINDOWS\system32\qedit.dll
2007-05-19 02:16 1,769,472 --a------ C:\WINDOWS\system32\dxdiagn.dll
2007-05-19 02:16 1,703,936 --a------ C:\WINDOWS\system32\d3d9.dll
2007-05-19 02:16 1,294,336 --a------ C:\WINDOWS\system32\dsound3d.dll
2007-05-19 02:16 1,230,336 --a------ C:\WINDOWS\system32\msvidctl.dll
2007-05-19 02:16 1,201,152 --a------ C:\WINDOWS\system32\d3d8.dll
2007-05-19 02:16 1,189,888 --a------ C:\WINDOWS\system32\dx8vb.dll
2007-05-13 01:57 <REP> d-------- C:\SOPHTEMP
2007-05-13 00:44 <REP> d-------- C:\WINDOWS\Prefetch
2007-05-13 00:37 <REP> d-------- C:\DOCUME~1\DEFAUL~1\APPLIC~1\DivX
2007-05-13 00:35 223,232 --a------ C:\WINDOWS\system32\qmgr.dll
2007-05-13 00:35 17,408 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2007-05-13 00:33 115,480 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-05-13 00:33 1,081,112 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-05-13 00:21 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2007-05-13 00:21 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2007-05-13 00:12 <REP> d-------- C:\WINDOWS\setup.pss
2007-05-12 21:00 <REP> d-------- C:\Program Files\SAGEM
2007-05-12 20:18 <REP> d-------- C:\fbxusb
2007-05-12 20:16 4,718,592 --a------ C:\DOCUME~1\Chantal\ntuser.dat
2007-05-12 19:48 46,892 --a------ C:\WINDOWS\system32\adadix16.dll
2007-05-12 19:48 46,167 --a------ C:\WINDOWS\system32\drivers\adildr.sys
2007-05-12 19:48 4,981 --a------ C:\WINDOWS\system32\adadix2k.dll
2007-05-12 19:48 155,648 --a------ C:\WINDOWS\system32\adadix32.dll
2007-05-12 19:48 143,360 --a------ C:\WINDOWS\autoclk.exe
2007-05-12 19:48 135,168 --a------ C:\WINDOWS\system32\unaddrv.exe
2007-05-12 19:48 127,456 --a------ C:\WINDOWS\system32\ipdetect.exe
2007-05-12 19:48 127,145 --a------ C:\WINDOWS\system32\drivers\adiusbaw.sys
2007-05-12 19:48 126,976 --a------ C:\WINDOWS\system32\coclassfast.dll
2007-05-12 16:34 24,576 --a------ C:\WINDOWS\system32\xpsp1hfm.exe
2007-05-12 16:34 <REP> d-------- C:\0fdc9cca3a67fe0da2c9f512d6beb0b6
2007-05-12 13:13 <REP> d-------- C:\WINDOWS\system32\bits
2007-05-12 13:10 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-05-12 13:10 <REP> d-------- C:\WINDOWS\system32\PreInstall
2007-05-12 13:09 <REP> d--h----- C:\WINDOWS\$hf_mig$
2007-05-06 20:24 <REP> d-------- C:\DOCUME~1\Chantal\APPLIC~1\DivX
2007-05-06 20:18 129,784 --a------ C:\WINDOWS\system32\pxafs.dll
2007-05-06 18:39 7,680 --a------ C:\WINDOWS\system32\bitsprx2.dll
2007-05-06 18:39 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll
2007-05-06 18:35 <REP> d-------- C:\WINDOWS\system32\SoftwareDistribution
2007-05-06 18:33 467,224 --a------ C:\WINDOWS\system32\wuapi.dll
2007-05-06 18:33 41,240 --a------ C:\WINDOWS\system32\wups.dll
2007-05-06 18:33 195,352 --a------ C:\WINDOWS\system32\wuaueng1.dll
2007-05-06 18:33 175,896 --a------ C:\WINDOWS\system32\wuauclt1.exe
2007-05-06 18:33 173,536 --a------ C:\WINDOWS\system32\wuweb.dll
2007-05-06 18:33 128,792 --a------ C:\WINDOWS\system32\wucltui.dll
2007-05-06 18:33 <REP> d-------- C:\WINDOWS\SoftwareDistribution
2007-05-06 18:11 <REP> d-------- C:\DOCUME~1\Chantal\APPLIC~1\vlc
2007-05-06 17:55 <REP> d-------- C:\Program Files\VideoLAN
2007-05-06 16:55 53,248 --a------ C:\WINDOWS\system32\zlib.dll
2007-05-06 16:55 119,568 --a------ C:\WINDOWS\system32\VB6FR.DLL
2007-05-06 16:55 <REP> d-------- C:\Program Files\scrabbleproB1.0.6
2007-05-06 16:08 <REP> d-------- C:\DOCUME~1\Chantal\APPLIC~1\BSplayer Pro
2007-05-02 20:04 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe
2007-05-02 20:04 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-05-02 20:04 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-05-02 20:04 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-05-02 20:02 73,728 --a------ C:\WINDOWS\system32\dpl100.dll
2007-05-02 20:02 593,920 --a------ C:\WINDOWS\system32\dpuGUI11.dll
2007-05-02 20:02 57,344 --a------ C:\WINDOWS\system32\dpv11.dll
2007-05-02 20:02 53,248 --a------ C:\WINDOWS\system32\dpuGUI10.dll
2007-05-02 20:02 344,064 --a------ C:\WINDOWS\system32\dpus11.dll
2007-05-02 20:02 294,912 --a------ C:\WINDOWS\system32\dpu11.dll
2007-05-02 20:02 294,912 --a------ C:\WINDOWS\system32\dpu10.dll
2007-05-02 20:02 196,608 --a------ C:\WINDOWS\system32\dtu100.dll
2007-05-02 20:01 823,296 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2007-05-02 20:01 823,296 --a------ C:\WINDOWS\system32\divx_xx07.dll
2007-05-02 20:01 802,816 --a------ C:\WINDOWS\system32\divx_xx11.dll
2007-05-02 20:01 740,442 --a------ C:\WINDOWS\system32\DivX.dll
2007-05-02 04:33 124,472 --a------ C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
2007-05-02 04:33 12,288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
2007-04-30 23:36 <REP> d-------- C:\DOCUME~1\Chantal\APPLIC~1\uTorrent


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-25 00:21:49 -------- d-----w C:\DOCUME~1\Chantal\APPLIC~1\BSplayer
2007-05-24 13:51:48 -------- d-----w C:\DOCUME~1\Chantal\APPLIC~1\Temporary
2007-05-19 18:10:27 -------- d-----w C:\Program Files\NCH Swift Sound
2007-05-19 18:10:16 -------- d-----w C:\DOCUME~1\Chantal\APPLIC~1\NCH Swift Sound
2007-05-19 14:55:11 -------- d-----w C:\DOCUME~1\Chantal\APPLIC~1\AdobeUM
2007-05-19 14:27:53 -------- d-----w C:\Program Files\eMule
2007-05-12 22:54:05 -------- d--h--w C:\Program Files\WindowsUpdate
2007-05-12 22:49:40 75,266 ----a-w C:\WINDOWS\system32\perfc00C.dat
2007-05-12 22:49:40 468,072 ----a-w C:\WINDOWS\system32\perfh00C.dat
2007-05-12 22:35:21 -------- d-----w C:\Program Files\Movie Maker
2007-05-12 22:34:18 23,992 ----a-w C:\WINDOWS\system32\emptyregdb.dat
2007-05-12 22:33:44 -------- d-----w C:\Program Files\Messenger
2007-05-12 22:33:43 -------- d-----w C:\Program Files\Windows NT
2007-05-12 18:17:08 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-05-12 16:59:37 -------- d-----w C:\Program Files\Free.fr
2007-05-06 18:18:54 -------- d-----w C:\Program Files\DivX
2007-05-06 17:22:14 -------- d-----w C:\DOCUME~1\Chantal\APPLIC~1\Lavasoft
2007-05-06 14:08:04 -------- d-----w C:\Program Files\Webteh
2007-05-02 18:04:15 36,624 ----a-w C:\WINDOWS\system32\drivers\pxhelp20.sys
2007-05-02 18:04:14 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2007-05-02 18:04:14 116,472 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2007-04-27 21:58:32 -------- d-----w C:\Program Files\Aws
2007-04-18 07:47:12 -------- d-----w C:\Program Files\MyWebSearchWB
2007-04-01 02:23:21 -------- d-----w C:\Program Files\VSToolbar
2007-03-25 10:44:03 -------- d-----w C:\Program Files\Zylom Games
2007-03-24 00:28:40 -------- d-----w C:\Program Files\BoltSoft
2007-03-18 01:28:42 -------- d-----w C:\DOCUME~1\Chantal\APPLIC~1\Zylom
2007-02-16 01:08:35 87,608 ----a-w C:\DOCUME~1\Chantal\APPLIC~1\ezpinst.exe
2007-02-16 01:08:35 47,360 ----a-w C:\DOCUME~1\Chantal\APPLIC~1\pcouffin.sys
2005-10-15 23:03:11 56 --sha-r C:\WINDOWS\system32\E1C3D8BA43.sys


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 21:38]
{222D352C-E3A2-D304-C990-F17497B1D4AB}=C:\WINDOWS\System32\ometffbb.dll []
{2E03C0FD-4C48-43A7-9A54-00240C70FF16}=C:\WINDOWS\System32\BhoECart.dll [2006-02-07 10:05]
{3549E9DB-2574-426E-914E-851D9E8DBF88}=C:\WINDOWS\System32\guoapcwv.dll [2006-09-01 02:45]
{519B77EC-EF09-EBFE-2C02-CBCE6BC9EFEF}=C:\WINDOWS\System32\rcm.dll []
{742FEB7C-3BAD-5C5D-C105-2869C6F387F9}=C:\WINDOWS\System32\pzs.dll []
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll [2006-12-15 04:23]
{82AC1069-90E1-F346-8D99-D4E61DAD71F5}=C:\WINDOWS\System32\kjxxexix.dll []
{9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 21:33]
{B481206C-BDD1-B072-A0AB-91CB2BEC5CB3}=C:\WINDOWS\System32\kjxxexix.dll []
{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}=C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll [2006-01-17 17:04]
{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}=C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2004-02-10 14:08]
{EE95B58B-AA73-9E40-C02D-4241E3269A82}=C:\DOCUME~1\Chantal\APPLIC~1\GLOBAL~1\Jugs Dupe.exe []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AltnetPointsManager"="c:\program files\altnet\points manager\points manager.exe" []
"MS Unix Binary"="msnq3insller.exe" []
"bIGjYFso0"="C:\WINDOWS\fwethvb.exe" []
"EPSON Stylus Photo RX420 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.exe" [2004-04-09 05:00]
"Microsoft Works Update Detection"="C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe" [2001-09-04 23:30]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"WinampAgent"="C:\Program Files\Winamp\Winampa.exe" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 04:23]
"The Heart Lite Download"="C:\Documents and Settings\All Users\Application Data\chinacetheheart\RoadUser.exe" []
"ToUcamVProperty"="C:\Program Files\Philips ToUcam Camera\VProperty.exe" [2001-11-28 14:50]
"VSOCheckTask"="C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 18:18]
"VirusScan Online"="C:\Program Files\McAfee.com\VSO\mcvsshld.exe" [2005-08-10 12:49]
"OASClnt"="C:\Program Files\McAfee.com\VSO\oasclnt.exe" [2005-08-11 22:02]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 18:29]
"MCUpdateExe"="c:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 12:05]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-12-16 04:09]
"Cmaudio"="cmicnfg.cpl" []
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2006-12-12 02:36]
"eCarteBleue-CLEO"="C:\Program Files\ECB-CLEO.exe" [2006-02-07 10:07]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-07 02:00]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 13:55]
"MS Unix Binary"="msnq3insller.exe" []
"Loio"="C:\WINDOWS\MBOLS~1\explorer.exe" []
"WhenUSave"="C:\Program Files\Save\Save.exe" [2006-08-25 14:45]
"Ekr"="C:\WINDOWS\W?nSxS\n?tepad.exe" []
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2002-08-20 15:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runservices]
"Smoking pot"=poteux.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
"MS Unix Binary"=msnq3insller.exe
"Windowfdgfds DLL fgfdg Verifier"=winsecure.exe

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MS Unix Binary"=msnq3insller.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cmqkfxyd]
cmqkfxyd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxyxu]
xxyxu.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\NetBIOS Helper]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin]
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smoking pot]
poteux.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SOProc_RegSoAlertWxLiteNnAj]
rundll32 shell32.dll,ShellExec_RunDLL C:\PROGRA~1\SOFTWA~1\soproc.exe -pack RegSoAlertWxLiteNnAj

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\System service75]
C:\WINDOWS\etb\pokapoka75.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windowfdgfds DLL fgfdg Verifier]
winsecure.exe

*Newly Created Service* -PROCEXP90

Contents of the 'Scheduled Tasks' folder
2007-05-25 12:00:00 C:\WINDOWS\tasks\A9013806919AB1BA.job

********************************************************************

catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-26 00:45:28
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
ToUcamVProperty = C:\Program Files\Philips ToUcam Camera\VProperty.exe??U?c?a?m? ?C?a?m?e?r?a?\?V?P?r?o?p?e?r?t?y?.?e?x?e???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0


********************************************************************

Completion time: 2007-05-26 0:46:57
C:\ComboFix-quarantined-files.txt ... 2007-05-26 00:46

--- E O F ---

Logfile of HijackThis v1.99.1
Scan saved at 12:20:28, on 26/05/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Philips ToUcam Camera\VProperty.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\ECB-CLEO.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Save\Save.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Chantal\Bureau\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.s1s1s1search.com/sp2.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {B481206C-BDD1-B072-A0AB-91CB2BEC5CB3} - C:\WINDOWS\System32\kjxxexix.dll (file missing)
R3 - URLSearchHook: (no name) - {82AC1069-90E1-F346-8D99-D4E61DAD71F5} - C:\WINDOWS\System32\kjxxexix.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {222D352C-E3A2-D304-C990-F17497B1D4AB} - C:\WINDOWS\System32\ometffbb.dll (file missing)
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\System32\BhoECart.dll
O2 - BHO: (no name) - {3549E9DB-2574-426E-914E-851D9E8DBF88} - C:\WINDOWS\System32\guoapcwv.dll
O2 - BHO: (no name) - {519B77EC-EF09-EBFE-2C02-CBCE6BC9EFEF} - C:\WINDOWS\System32\rcm.dll (file missing)
O2 - BHO: (no name) - {742FEB7C-3BAD-5C5D-C105-2869C6F387F9} - C:\WINDOWS\System32\pzs.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {82AC1069-90E1-F346-8D99-D4E61DAD71F5} - C:\WINDOWS\System32\kjxxexix.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B481206C-BDD1-B072-A0AB-91CB2BEC5CB3} - C:\WINDOWS\System32\kjxxexix.dll (file missing)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {EE95B58B-AA73-9E40-C02D-4241E3269A82} - C:\DOCUME~1\Chantal\APPLIC~1\GLOBAL~1\Jugs Dupe.exe (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {821F87FF-8245-4972-9E28-732E92EC2F51} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s
O4 - HKLM\..\Run: [MS Unix Binary] msnq3insller.exe
O4 - HKLM\..\Run: [bIGjYFso0] C:\WINDOWS\fwethvb.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [The Heart Lite Download] C:\Documents and Settings\All Users\Application Data\chinacetheheart\RoadUser.exe
O4 - HKLM\..\Run: [ToUcamVProperty] C:\Program Files\Philips ToUcam Camera\VProperty.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [eCarteBleue-CLEO] "C:\Program Files\ECB-CLEO.exe" /dontopenmycards
O4 - HKLM\..\RunServices: [MS Unix Binary] msnq3insller.exe
O4 - HKLM\..\RunServices: [Windowfdgfds DLL fgfdg Verifier] winsecure.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MS Unix Binary] msnq3insller.exe
O4 - HKCU\..\Run: [Loio] "C:\WINDOWS\MBOLS~1\explorer.exe" -vt ndrv
O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"
O4 - HKCU\..\Run: [Ekr] C:\WINDOWS\W?nSxS\n?tepad.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\RunServices: [Smoking pot] poteux.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exe
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O4 - Global Startup: Reality Fusion GameCam SE.lnk = ?
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusea [...] xdm209YYFR
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O16 - DPF: {B3231E01-D1EA-4BF1-B872-CF21619704F3} (NMInstall Control) - http://a14.g.akamai.net/f/14/7141/ [...] EUROPE.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~2\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~2\MSGRAP~1.DLL
O20 - Winlogon Notify: cmqkfxyd - cmqkfxyd.dll (file missing)
O20 - Winlogon Notify: xxyxu - xxyxu.dll (file missing)
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe

C:\WINDOWS\System32\guoapcwv.dll unregistered successfully.
C:\WINDOWS\System32\guoapcwv.dll moved successfully.
File/Folder C:\WINDOWS\System32\msnq3insller.exe not found.
File/Folder C:\WINDOWS\System32\winsecure.exe not found.
File/Folder C:\WINDOWS\System32\poteux.exe not found.
File/Folder c:\program files\altnet not found.
File/Folder C:\Program Files\PartyPoker not found.
C:\Program Files\Save moved successfully.
C:\Documents and Settings\All Users\Application Data\chinacetheheart moved successfully.
File/Folder C:\WINDOWS\fwethvb.exe not found.

Created on 05/27/2007 01:12:50

Logfile of HijackThis v1.99.1
Scan saved at 12:21:32, on 27/05/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Philips ToUcam Camera\VProperty.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\ECB-CLEO.exe
C:\WINDOWS\System32\ctfmon.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Chantal\Bureau\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.s1s1s1search.com/sp2.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/
R3 - URLSearchHook: (no name) - {B481206C-BDD1-B072-A0AB-91CB2BEC5CB3} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\System32\BhoECart.dll
O2 - BHO: (no name) - {3549E9DB-2574-426E-914E-851D9E8DBF88} - C:\WINDOWS\System32\guoapcwv.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [ToUcamVProperty] C:\Program Files\Philips ToUcam Camera\VProperty.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [eCarteBleue-CLEO] "C:\Program Files\ECB-CLEO.exe" /dontopenmycards
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exe
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O4 - Global Startup: Reality Fusion GameCam SE.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O16 - DPF: {B3231E01-D1EA-4BF1-B872-CF21619704F3} (NMInstall Control) - http://a14.g.akamai.net/f/14/7141/ [...] EUROPE.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~2\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~2\MSGRAP~1.DLL
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe

C'est fait. Merci beaucoup pour ton aide !

Logfile of HijackThis v1.99.1
Scan saved at 12:31:15, on 27/05/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Philips ToUcam Camera\VProperty.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\ECB-CLEO.exe
C:\WINDOWS\System32\ctfmon.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Chantal\Bureau\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.s1s1s1search.com/sp2.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\System32\BhoECart.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [ToUcamVProperty] C:\Program Files\Philips ToUcam Camera\VProperty.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [eCarteBleue-CLEO] "C:\Program Files\ECB-CLEO.exe" /dontopenmycards
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exe
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O4 - Global Startup: Reality Fusion GameCam SE.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O16 - DPF: {B3231E01-D1EA-4BF1-B872-CF21619704F3} (NMInstall Control) - http://a14.g.akamai.net/f/14/7141/ [...] EUROPE.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~2\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~2\MSGRAP~1.DLL
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe

J'ai encore les fenêtres, un peu moins fréquement peut être...Par contre, j'avais des problèmes pour me connecter à Internet lorsque j'allumais mon pc et Internet était très lent. Mais ce problème est réglé. Que dois je d'autre ??

KASPERSKY ON-LINE SCANNER REPORT
Sunday, May 27, 2007 3:31:46 PM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky On-line Scanner version : 5.0.83.0
Dernière mise à jour de la base antivirus Kaspersky : 27/05/2007
Enregistrements dans la base antivirus Kaspersky : 310035
Paramètres d'analyse
Analyser avec la base antivirus suivante standard
Analyser les archives vrai
Analyser les bases de messagerie vrai
Cible de l'analyse Poste de travail
A:\
C:\
D:\
E:\
Statistiques de l'analyse
Total d'objets analysés 45946
Nombre de virus trouvés 4
Nombre d'objets infectés 13 / 0
Nombre d'objets suspects 0
Durée de l'analyse 02:39:53

Nom de l'objet infecté Nom du virus Dernière action
C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Logs\TaskScheduler\McTskshd002.log L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\McAfee.com\VSO\OASLogs\OAS.log L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\Agent_CHANTAL-3K06RLD.log L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Application Data\Temporary\_working_ musique de pub dim 1 34.wma Infecté : Trojan-Downloader.WMA.Wimad.d ignoré
C:\Documents and Settings\Chantal\Bureau\hijackthis\backups\backup-20070527-011056-174.dll Infecté : Packed.Win32.Klone.j ignoré
C:\Documents and Settings\Chantal\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Local Settings\Temporary Internet Files\Content.IE5\SZ6VMHI1\forum[2] L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Mes documents\Downloads\(Serial) 36 quai des orfèvres 38.wma Infecté : Trojan-Downloader.WMA.Wimad.d ignoré
C:\Documents and Settings\Chantal\Mes documents\Downloads\01 - le grand meaulnes 49.wma Infecté : Trojan-Downloader.WMA.Wimad.d ignoré
C:\Documents and Settings\Chantal\Mes documents\Downloads\_working_ musique de pub dim 1 34.wma Infecté : Trojan-Downloader.WMA.Wimad.d ignoré
C:\Documents and Settings\Chantal\ntuser.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\System Volume Information\_restore{6B962F2A-28A8-4924-976B-1399DE2FAA50}\RP10\change.log L'objet est verrouillé ignoré
C:\System Volume Information\_restore{6B962F2A-28A8-4924-976B-1399DE2FAA50}\RP6\A0000437.exe L'objet est verrouillé ignoré
C:\System Volume Information\_restore{6B962F2A-28A8-4924-976B-1399DE2FAA50}\RP9\A0000581.exe Infecté : Trojan.Win32.Small.ju ignoré
C:\System Volume Information\_restore{6B962F2A-28A8-4924-976B-1399DE2FAA50}\RP9\A0000582.exe Infecté : Trojan.Win32.Small.ju ignoré
C:\System Volume Information\_restore{6B962F2A-28A8-4924-976B-1399DE2FAA50}\RP9\A0000583.exe Infecté : Trojan.Win32.Small.ju ignoré
C:\VundoFix Backups\klxnqern.exe.bad Infecté : Trojan.Win32.Small.ju ignoré
C:\VundoFix Backups\tweqmlgl.exe.bad Infecté : Trojan.Win32.Small.ju ignoré
C:\VundoFix Backups\yyemmhxt.exe.bad Infecté : Trojan.Win32.Small.ju ignoré
C:\WINDOWS\Debug\oakley.log L'objet est verrouillé ignoré
C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré
C:\WINDOWS\SchedLgU.Txt L'objet est verrouillé ignoré
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré
C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré
C:\WINDOWS\system32\osntkxmo.exe Infecté : Trojan.Win32.Agent.ny ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré
C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré
C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré
C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré
C:\_OTMoveIt\MovedFiles\WINDOWS\System32\guoapcwv.dll Infecté : Packed.Win32.Klone.j ignoré
Analyse terminée.

Je ne vois pas ce dossier :

C:\Documents and Settings\Chantal\Application Data\Temporary\

Dans le dossier suivant il n'y a que des données que je souhaite conserver :

C:\Documents and Settings\Chantal\Mes documents\Downloads\

J'ai effectué les autres opérations.

Oui c'est bon merci. C'est nettoyé...

KASPERSKY ON-LINE SCANNER REPORT
Monday, May 28, 2007 2:36:25 PM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky On-line Scanner version : 5.0.83.0
Dernière mise à jour de la base antivirus Kaspersky : 28/05/2007
Enregistrements dans la base antivirus Kaspersky : 312216
Paramètres d'analyse
Analyser avec la base antivirus suivante standard
Analyser les archives vrai
Analyser les bases de messagerie vrai
Cible de l'analyse Poste de travail
A:\
C:\
D:\
E:\
Statistiques de l'analyse
Total d'objets analysés 45924
Nombre de virus trouvés 4
Nombre d'objets infectés 14 / 0
Nombre d'objets suspects 0
Durée de l'analyse 01:08:04

Nom de l'objet infecté Nom du virus Dernière action
C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Logs\TaskScheduler\McTskshd000.log L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\McAfee.com\VSO\OASLogs\OAS.log L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\Agent_CHANTAL-3K06RLD.log L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Application Data\Mozilla\Firefox\Profiles\sy256v3i.default\cert8.db L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Application Data\Mozilla\Firefox\Profiles\sy256v3i.default\GoogleToolbarData\googlesafebrowsing.db L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Application Data\Mozilla\Firefox\Profiles\sy256v3i.default\history.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Application Data\Mozilla\Firefox\Profiles\sy256v3i.default\key3.db L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Application Data\Mozilla\Firefox\Profiles\sy256v3i.default\parent.lock L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Bureau\hijackthis\backups\backup-20070527-011056-174.dll Infecté : Packed.Win32.Klone.j ignoré
C:\Documents and Settings\Chantal\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Local Settings\Application Data\Mozilla\Firefox\Profiles\sy256v3i.default\Cache\_CACHE_001_ L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Local Settings\Application Data\Mozilla\Firefox\Profiles\sy256v3i.default\Cache\_CACHE_002_ L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Local Settings\Application Data\Mozilla\Firefox\Profiles\sy256v3i.default\Cache\_CACHE_003_ L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Local Settings\Application Data\Mozilla\Firefox\Profiles\sy256v3i.default\Cache\_CACHE_MAP_ L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Local Settings\Historique\History.IE5\MSHist012007052820070529\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\Mes documents\Downloads\(Serial) 36 quai des orfèvres 38.wma Infecté : Trojan-Downloader.WMA.Wimad.d ignoré
C:\Documents and Settings\Chantal\Mes documents\Downloads\01 - le grand meaulnes 49.wma Infecté : Trojan-Downloader.WMA.Wimad.d ignoré
C:\Documents and Settings\Chantal\Mes documents\Downloads\_working_ musique de pub dim 1 34.wma Infecté : Trojan-Downloader.WMA.Wimad.d ignoré
C:\Documents and Settings\Chantal\ntuser.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\Chantal\UserData\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\RECYCLER\S-1-5-21-1645522239-152049171-854245398-1003\Dc1\MovedFiles\WINDOWS\System32\guoapcwv.dll Infecté : Packed.Win32.Klone.j ignoré
C:\RECYCLER\S-1-5-21-1645522239-152049171-854245398-1003\Dc2\klxnqern.exe.bad Infecté : Trojan.Win32.Small.ju ignoré
C:\RECYCLER\S-1-5-21-1645522239-152049171-854245398-1003\Dc2\tweqmlgl.exe.bad Infecté : Trojan.Win32.Small.ju ignoré
C:\RECYCLER\S-1-5-21-1645522239-152049171-854245398-1003\Dc2\yyemmhxt.exe.bad Infecté : Trojan.Win32.Small.ju ignoré
C:\RECYCLER\S-1-5-21-1645522239-152049171-854245398-1003\Dc3.exe Infecté : Trojan.Win32.Agent.ny ignoré
C:\RECYCLER\S-1-5-21-1645522239-152049171-854245398-1003\Dc8.wma Infecté : Trojan-Downloader.WMA.Wimad.d ignoré
C:\System Volume Information\_restore{6B962F2A-28A8-4924-976B-1399DE2FAA50}\RP11\A0000727.exe Infecté : Trojan.Win32.Agent.ny ignoré
C:\System Volume Information\_restore{6B962F2A-28A8-4924-976B-1399DE2FAA50}\RP11\change.log L'objet est verrouillé ignoré
C:\System Volume Information\_restore{6B962F2A-28A8-4924-976B-1399DE2FAA50}\RP9\A0000581.exe Infecté : Trojan.Win32.Small.ju ignoré
C:\System Volume Information\_restore{6B962F2A-28A8-4924-976B-1399DE2FAA50}\RP9\A0000582.exe Infecté : Trojan.Win32.Small.ju ignoré
C:\System Volume Information\_restore{6B962F2A-28A8-4924-976B-1399DE2FAA50}\RP9\A0000583.exe Infecté : Trojan.Win32.Small.ju ignoré
C:\WINDOWS\Debug\oakley.log L'objet est verrouillé ignoré
C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré
C:\WINDOWS\SchedLgU.Txt L'objet est verrouillé ignoré
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré
C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré
C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré
C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré
C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré
Analyse terminée.

C'est fait merci. Ensuite ?

hélas oui! ça continue!!!!

Refais un scan Hijackthis.

Re,

Télécharge Blacklight (F-Secure), clique sur " I ACCEPT " en bas de la page :
Clique sur le premier " Download " afin de télécharger le programme
Sauvegarde le sur ton Bureau
Double-clique fsbl.exe et accepte la licence; clique Scan puis Next.

A la fin du scan, NE TOUCHE A RIEN !

Tu verras un rapport, sur ton Bureau, nommé fsbl.xxxxxxx.log (les xxxxxxx sont des chiffres).
Nous devons analyser ce rapport, ferme donc le BlackLight.

Poste le rapport sur le forum.

AIDE : Tuto sur BlackLight (Malekal)

Toujours des pubs ?

Re,

Télécharge puis installe AVG Anti-Spyware (AVG AS)
Fais les mises à jour mais ne lance pas de scan pour le moment.
AIDE : Tuto sur AVG Anti-Spyware (Malekal)

Redémarre en mode sans échec

Relance AVG AS :
- Choisis l'onglet "Analyse"
- Puis l'onglet "Paramètres"
- Sous la question "Comment réagir ?", clique sur "Actions recommandées" et choisis "Quarantaine"
- Re-clique sur l'onglet "Analyse" puis réalise une "Analyse complète du système"

Si un fichier est infecté en fin d'analyse, clique sur "Appliquer toutes les actions"

Clique sur "Enregistrer le rapport" puis sur "Enregistrer le rapport sous"
Enregistre ce fichier texte sur ton bureau.

Redémarre normalement.
Poste le rapport AVG AS ainsi qu'un rapport Hijackthis.

Pas mieux ?

Tu as des pubs sur toutes les pages ? tu visites quels sites ?

http://www.google.fr/url?sa=t&ct=r [...] alHb9wO0qw

Tu as fait ce que j'ai dit ?