Bonjour,

mon ordi est infecté par le virus Trojan.Win32.Monder.gen. Impossible de m'en débarrasser.
J'ai Windows xp ainsi que l'antivirus SECURITOO de Wadadoo. Comment faire pour l'éliminer ?
Merci

Je viens de lire les messages plus bas. J'ai donc télécharger TREND MICRO HIJAC THIS et voici le rapport :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:23:39, on 25/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\PROGRA~1\SECURI~2\av_fw\backweb\1044199\Program\SERVIC~1.EXE
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
C:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXE
C:\Program Files\Securitoo\av_fw\fswsclds.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
C:\Program Files\Securitoo\av_fw\Common\FSMB32.EXE
C:\Program Files\Securitoo\av_fw\Common\FCH32.EXE
C:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXE
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exe
C:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Acer\Acer eMode Management\AspireService.exe
C:\Program Files\Acer\Acer eConsole\MediaSync.exe
C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe
C:\Program Files\Hotbar\bin\10.0.412.0\OEAddOn.exe
C:\Program Files\Hotbar\bin\10.0.412.0\HotbarSA.exe
C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
C:\Program Files\Lexmark 2200 Series\lxbvbmon.exe
C:\WINDOWS\V0230Mon.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hotbar\bin\10.0.412.0\Weather.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Securitoo\av_fw\backweb\1044199\Program\BackWeb-1044199.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\HOTALBUMMyBOX\MediaChecker.exe
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\BlueSynchroManager\BlueSynchroManager.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Orange\browser\browser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Live Toolbar\msn_sl.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://resultsmaster.com/SmartOffe [...] ftPane.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Shareaza Web Download Hook - {0EEDB912-C5FA-486F-8334-57288578C627} - C:\Program Files\Crux P2P\Plugins\RazaWebHook.dll
O2 - BHO: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O2 - BHO: (no name) - {543691FF-3C2C-4D84-9641-C477256D1905} - C:\WINDOWS\system32\ljJBrSkh.dll (file missing)
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\geBSjkLb.dll (file missing)
O2 - BHO: (no name) - {6E66F73D-29CA-482A-8401-C140027135B8} - C:\WINDOWS\system32\ssqOGwUl.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: {c3398109-5170-160a-c024-bccdaaa4521e} - {e1254aaa-dccb-420c-a061-07159018933c} - C:\WINDOWS\system32\rfwhym.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: (no name) - {07AA283A-43D7-4CBE-A064-32A21112D94D} - (no file)
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: (no name) - {2bae58c2-79f9-45d1-a286-81f911301c3a} - (no file)
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Lexmark 2200 Series] "C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe"
O4 - HKLM\..\Run: [HotbarOE] C:\Program Files\Hotbar\bin\10.0.412.0\OEAddOn.exe
O4 - HKLM\..\Run: [HotbarSA] "C:\Program Files\Hotbar\bin\10.0.412.0\HotbarSA.exe"
O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
O4 - HKLM\..\Run: [V0230Mon.exe] C:\WINDOWS\V0230Mon.exe
O4 - HKLM\..\Run: [MBBalloon] C:\Program Files\HOTALBUMMyBOX\MBBalloon.exe
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL
O4 - HKLM\..\Run: [e4ddcb84] rundll32.exe "C:\WINDOWS\system32\ibwbggio.dll",b
O4 - HKLM\..\Run: [BMe7eef818] Rundll32.exe "C:\WINDOWS\system32\ipddxpds.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [WeatherDPA] "C:\Program Files\Hotbar\bin\10.0.412.0\Weather.exe" -auto
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: BlueSynchroManager.lnk = C:\Program Files\BlueSynchroManager\BlueSynchroManager.exe
O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Démarrage d'Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: MediaChecker.lnk = C:\Program Files\HOTALBUMMyBOX\MediaChecker.exe
O4 - Global Startup: Microsoft Recherche accélérée.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?a1959640c57749e5bd495b68a4db381b
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?a1959640c57749e5bd495b68a4db381b
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O15 - Trusted Zone: http://www.orange.fr
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/control [...] oader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/n [...] 0.15-3.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-F [...] E_UNO1.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/bina [...] b56986.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O20 - Winlogon Notify: geBSjkLb - geBSjkLb.dll (file missing)
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Securitoo AntiVirus Firewall (BackWeb Client - 1044199) - Unknown owner - C:\PROGRA~1\SECURI~2\av_fw\backweb\1044199\Program\SERVIC~1.EXE
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\Securitoo\av_fw\Common\FSAA.EXE (file missing)
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exe
O23 - Service: F-Secure Distributed Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 15395 bytes

Bonsoir,

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.

• Lance l'installation du programme en exécutant le fichier téléchargé.
• Double-clique maintenant sur le raccourci de Toolbar-S&D.
• Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
• Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
• Poste le rapport généré. (C:\TB.txt)

Bonsoir,
voici le rapport
merci
-----------\\ ToolBar S&D 1.0.7 XP/Vista

[ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
[ USER : PAULINE ] [ "C:\Toolbar SD" ] [ Selection : 1 ]
[ 25/07/2008 | 23:00:53,76 ] [ PC : ACER-755E621E64 ]
[ MAJ : 25-07-2008 | 17:35 ]

-----------\\ Recherche de Fichiers / Dossiers ...

C:\Program Files\Conduit
C:\Program Files\Conduit\Community Alerts
C:\DOCUME~1\PAULINE\Cookies\pauline@www.conduit[2].txt
C:\DOCUME~1\ISABELLE\APPLIC~1\Hotbar
C:\DOCUME~1\ISABELLE\APPLIC~1\Hotbar\IESkins
C:\DOCUME~1\ISABELLE\APPLIC~1\Hotbar\v3.0
C:\DOCUME~1\MARION\APPLIC~1\Hotbar
C:\DOCUME~1\MARION\APPLIC~1\Hotbar\IESkins
C:\DOCUME~1\MARION\APPLIC~1\Hotbar\v3.0
C:\DOCUME~1\PAULINE\APPLIC~1\Hotbar
C:\DOCUME~1\PAULINE\APPLIC~1\Hotbar\eskin
C:\DOCUME~1\PAULINE\APPLIC~1\Hotbar\IESkins
C:\DOCUME~1\PAULINE\APPLIC~1\Hotbar\v3.0
C:\Program Files\Hotbar
C:\Program Files\Hotbar\bin
C:\WINDOWS\Prefetch\HOTBARSA.EXE-062ED50E.pf
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\Hotbar
C:\DOCUME~1\PAULINE\Cookies\pauline@hotbar[1].txt
C:\Program Files\MyWebSearch
C:\Program Files\MyWebSearch\bar
C:\DOCUME~1\PAULINE\Cookies\pauline@mywebsearch[2].txt
C:\Program Files\P2P_Energy
C:\Program Files\P2P_Energy\INSTALL.LOG
C:\Program Files\P2P_Energy\P2P_EnergyToolbarHelper.exe
C:\Program Files\P2P_Energy\tbP2P_.dll
C:\Program Files\P2P_Energy\toolbar.cfg
C:\Program Files\P2P_Energy\UNWISE.EXE
C:\DOCUME~1\PAULINE\Cookies\pauline@cs.shopperreports[1].txt
C:\DOCUME~1\ISABELLE\APPLIC~1\ShoppingReport
C:\DOCUME~1\ISABELLE\APPLIC~1\ShoppingReport\cs
C:\DOCUME~1\MARION\APPLIC~1\ShoppingReport
C:\DOCUME~1\MARION\APPLIC~1\ShoppingReport\cs
C:\DOCUME~1\PAULINE\APPLIC~1\ShoppingReport
C:\DOCUME~1\PAULINE\APPLIC~1\ShoppingReport\cs
C:\Program Files\ShoppingReport
C:\Program Files\ShoppingReport\Bin
C:\Program Files\ShoppingReport\cs
C:\Program Files\ShoppingReport\Uninst.exe
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\---Yahoo.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\01net.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\1px_dark.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\1px_green.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\1px_white.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\a.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\amazon.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\an.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\arrowB.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\arrowT.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\arrow_down.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\arrow_red.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\arrow_red2.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\arrow_up.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\autofill.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\avstate.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\b.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\background2.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\bgmeteo_results.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\bg_pub.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\bg_ttl.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\bn.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\bottom.png
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\bottom_left.png
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\bottom_right.png
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\btn_close.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\btn_minus.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\btn_moreforecast.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\c.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\canalblog.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\cn.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\COMBOSEARCH.acs
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\d.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\dictionary2.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\dn.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\downfile
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\DownloadCOM.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\dropdown.css
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\ErrorLog.txt
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\ErrorPageTemplate.css
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\f.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\flag_argentine.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\flag_australia.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\flag_brazil.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\flag_canada.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\flag_china.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\flag_france.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\flag_germany.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\flag_greece.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\flag_hongkong.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\flag_india.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\flag_indonesia.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\flag_italy.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\flag_japan.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\flag_korea.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\flag_mexico.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\flag_netherlands.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\flag_spain.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\flag_sweeden.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\flag_taiwan.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\flag_uk.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\flag_usa.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\fn.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\g.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\gaming.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\gn.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\gograph.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\graphred0.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\graphred0_5.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\graphred1.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\graphred1_5.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\graphred2.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\graphred2_5.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\graphred3.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\graphred3_5.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\graphred4.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\graphred4_5.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\graphred5.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\h.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\help.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\hideremove.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\highlight.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\hn.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\h_aquarius.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\h_aries.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\h_cancer.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\h_capricorn.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\h_gemini.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\h_leo.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\h_libra.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\h_pisces.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\h_sagittarius.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\h_scorpio.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\h_taurus.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\h_virgo.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\i.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\icotemp_placeholder.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\IEtab1_7d.zip
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\in.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\ipsearch.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\j.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\jn.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\k.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\kn.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\l.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\left.png
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\ln.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\loading.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\login.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\logo.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\n.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\New York_NY_weather.txt
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\New York_NY_weather.txt12778140
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\New York_NY_weather.txt12900015
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\New York_NY_weather.txt413859
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\New York_NY_weather.txt6672062
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\new02.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\NewCfg
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\news.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\news.html
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\nn.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\o.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\on.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\p.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\pestscanimg.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\pixsy.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\pn.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\popup_off.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\popup_on.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\popup_ona.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\p_yahoo.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\p_yahoo_fr.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\q.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\qn.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\r.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\relatedlinks.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\report.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\right.png
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\rn.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\rss.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\rss.xsl
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\rss1.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\rsslib.js
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\rssmenu1_7a.zip
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\s.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\search.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\search_fr.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\security.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\sinfo.txt
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\sinfo.txt10604406
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\sinfo.txt13941421
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\sinfo.txt194718
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\sinfo.txt2029296
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\sinfo.txt2920734
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\sinfo.txt3439421
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\siteinfo.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\slider.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\sn.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\spacer.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\stars-red1.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\stars-red2.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\stars-red3.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\stars-red4.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\stars-red5.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\storage.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\t.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\tabdataV3.js
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\tablib.js
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\tabwelcome_en.html
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\tabwelcome_fr.html
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\tab_icon.png
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\technorati.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\thes_search.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\tn.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\tools.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\top.png
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\top_left.png
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\top_right.png
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\translate.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\u.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\un.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\utf8.js
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\v.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\vmlib.js
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\vmntoolbartb1501.cfg
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\vn.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\w.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\web.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\web_fr.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\wikipedia.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\wn.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\x.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\xp_close_small.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\yahoo.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\yahoo_search.gif
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\YouTube.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\z.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\zn.bmp
C:\DOCUME~1\PAULINE\APPLIC~1\VMNToolbar\zoom.bmp
C:\Program Files\VMNToolbar
C:\Program Files\VMNToolbar\install.ico
C:\Program Files\VMNToolbar\tbuninstall.exe
C:\Program Files\VMNToolbar\toolbar.ini
C:\Program Files\VMNToolbar\uninstall.exe
C:\Program Files\VMNToolbar\vmntoolbar.dll
C:\DOCUME~1\PAULINE\Cookies\pauline@static.zangocash[2].txt
C:\DOCUME~1\PAULINE\Cookies\pauline@zango[2].txt
C:\WINDOWS\Prefetch\RUNDLL32.EXE-4B8848F4.pf

-----------\\ Extensions

(All Users) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://www.wanadoo.fr/go/page_recherche/"
"Start Page"="http://www.google.fr/"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://global.acer.com"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"


-----------\\ Fin du rapport a 23:03:21,92

Re,

Relance Toolbar-S&D en double-cliquant sur le raccourci.

• Choisis cette fois l'option 2 puis valide en appuyant sur Entrée.

! Ne ferme pas la fenêtre lors de la suppression !

• Un rapport sera généré, poste son contenu ici, puis un nouveau rapport HijackThis.

Si ton bureau ne réapparait pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches.
Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "Nouvelle tâche (exécuter)"
Tapes explorer et valide. Cela te fera apparaitre ton bureau