Re

Infection Lop. On commence par la désinfecter.

Télécharge LopxpMH sur ton bureau.
http://www.alt-shift-return.org/Info/Fichiers/lopxpMH2.zip
Dézippe-le et double clique sur le fichier lopxpMH.bat.
Enfin, Poste le contenu du rapport qui va s'ouvrir.

Rapport lopxpMH2 version 2.0 fait à 20:50:25,95 le 29/02/2008
C:\Documents and Settings\fab\Bureau\lopxpMH2

• • ***************************************

Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est EC9C-7F7E

Répertoire de C:\DOCUME~1\All Users\Application Data

19/04/2007 12:34 <REP> .
19/04/2007 12:34 <REP> ..
01/10/2007 15:56 <REP> Adobe
15/05/2007 20:31 <REP> Apple Computer
18/01/2008 12:19 <REP> Avira
02/11/2007 16:42 <REP> AVS4YOU
19/06/2007 22:24 <REP> Google
17/05/2007 16:39 <REP> InstallShield
19/01/2008 21:15 <REP> Lavasoft
19/01/2008 23:54 <REP> Messenger Plus!
19/04/2007 12:34 <REP> Microsoft
26/11/2007 21:29 <REP> nView_Profiles
16/01/2008 19:26 <REP> soft ref platform bind
20/01/2008 00:21 <REP> Software4u
05/06/2007 12:28 <REP> Spybot - Search & Destroy
29/02/2008 13:33 <REP> TEMP
17/05/2007 16:46 <REP> Trymedia
27/05/2007 16:37 <REP> Ubisoft
19/04/2007 18:34 <REP> Windows Genuine Advantage
12/11/2007 19:38 <REP> WLInstaller
18/11/2007 14:29 <REP> Yahoo! Companion
05/06/2007 12:14 3 120 118300.34
18/01/2008 12:25 305 addr_file.html
19/04/2007 12:34 62 desktop.ini
16/06/2007 14:23 3 DragToDiscUserNameE.txt
15/05/2007 20:35 1 751 QTSBandwidthCache
5 fichier(s) 5 241 octets
21 Rép(s) 26 846 629 888 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est EC9C-7F7E

Répertoire de C:\DOCUME~1\Default User\Application Data

19/04/2007 12:34 <REP> .
19/04/2007 12:34 <REP> ..
19/04/2007 12:34 <REP> Microsoft
19/04/2007 12:34 62 desktop.ini
1 fichier(s) 62 octets
3 Rép(s) 26 846 629 888 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est EC9C-7F7E

Répertoire de C:\DOCUME~1\Default User\Local Settings\Application Data

19/04/2007 12:34 <REP> .
19/04/2007 12:34 <REP> ..
01/10/2007 15:57 <REP> Adobe
19/04/2007 10:43 <REP> Microsoft
0 fichier(s) 0 octets
4 Rép(s) 26 846 629 888 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est EC9C-7F7E

Répertoire de C:\DOCUME~1\fab\Application Data

19/04/2007 10:48 <REP> .
19/04/2007 10:48 <REP> ..
19/04/2007 18:31 <REP> Adobe
25/04/2007 18:13 <REP> AdobeUM
15/05/2007 20:34 <REP> Apple Computer
01/05/2007 16:43 <REP> Avant Profiles
02/11/2007 16:42 <REP> AVS4YOU
12/06/2007 18:00 <REP> Disney Interactive Studios
13/06/2007 22:01 <REP> dvdcss
16/01/2008 19:26 <REP> FLAP NEW
17/01/2008 15:25 <REP> fltk.org
19/06/2007 22:26 <REP> Google
05/12/2007 15:30 <REP> Hamachi
03/05/2007 17:00 <REP> Help
19/04/2007 10:48 <REP> Identities
18/09/2007 10:40 <REP> LG Electronics
19/04/2007 11:47 <REP> Macromedia
18/11/2007 14:54 <REP> Media Player Classic
19/04/2007 10:48 <REP> Microsoft
19/04/2007 18:09 <REP> Mozilla
19/04/2007 18:54 <REP> Opera
24/07/2007 09:29 <REP> Real
16/06/2007 14:23 <REP> Roxio
19/01/2008 23:53 <REP> Shareaza
20/01/2008 00:20 <REP> Software4u
02/06/2007 23:00 <REP> Sun
02/05/2007 21:30 <REP> Talkback
15/05/2007 16:27 <REP> teamspeak2
16/12/2007 16:11 <REP> U3
06/06/2007 19:37 <REP> vlc
18/11/2007 14:29 <REP> Yahoo!
19/04/2007 10:48 62 desktop.ini
1 fichier(s) 62 octets
31 Rép(s) 26 846 625 792 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est EC9C-7F7E

Répertoire de C:\DOCUME~1\fab\Local Settings\Application Data

19/04/2007 10:47 <REP> .
19/04/2007 10:47 <REP> ..
19/04/2007 18:31 <REP> Adobe
15/05/2007 20:34 <REP> Apple Computer
22/04/2007 14:10 <REP> ApplicationHistory
18/05/2007 19:43 <REP> capcom
15/01/2008 21:06 <REP> CDBurnerXP_Soft
19/06/2007 22:26 <REP> Google
03/05/2007 17:00 <REP> Help
19/04/2007 18:42 <REP> Identities
19/04/2007 10:47 <REP> Microsoft
19/04/2007 18:09 <REP> Mozilla
19/04/2007 11:04 <REP> Roxio
05/05/2007 20:03 <REP> Shareaza
04/10/2007 16:46 <REP> Steam
05/11/2007 13:23 <REP> WMTools Downloaded Files
15/05/2007 20:12 93 184 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
22/04/2007 14:10 126 fusioncache.dat
19/04/2007 11:05 13 496 GDIPFONTCACHEV1.DAT
24/07/2007 12:03 4 314 330 IconCache.db
4 fichier(s) 4 421 136 octets
16 Rép(s) 26 846 625 792 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est EC9C-7F7E

Répertoire de C:\DOCUME~1\LocalService\Application Data

19/04/2007 10:47 <REP> .
19/04/2007 10:47 <REP> ..
04/10/2007 19:55 <REP> Google
19/04/2007 10:47 <REP> Microsoft
0 fichier(s) 0 octets
4 Rép(s) 26 846 625 792 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est EC9C-7F7E

Répertoire de C:\DOCUME~1\LocalService\Local Settings\Application Data

19/04/2007 10:47 <REP> .
19/04/2007 10:47 <REP> ..
04/10/2007 19:55 <REP> Google
19/04/2007 10:47 <REP> Microsoft
0 fichier(s) 0 octets
4 Rép(s) 26 846 625 792 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est EC9C-7F7E

Répertoire de C:\DOCUME~1\NetworkService\Application Data

19/04/2007 10:46 <REP> .
19/04/2007 10:46 <REP> ..
19/04/2007 10:46 <REP> Microsoft
19/04/2007 18:33 <REP> Spyware Terminator
0 fichier(s) 0 octets
4 Rép(s) 26 846 625 792 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est EC9C-7F7E

Répertoire de C:\DOCUME~1\NetworkService\Local Settings\Application Data

19/04/2007 10:46 <REP> .
19/04/2007 10:46 <REP> ..
19/04/2007 10:46 <REP> Microsoft
0 fichier(s) 0 octets
3 Rép(s) 26 846 625 792 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est EC9C-7F7E

Répertoire de
C:\WINDOWS\system32\config\systemprofile\Applicati
on Data

19/04/2007 10:45 <REP> .
19/04/2007 10:45 <REP> ..
19/04/2007 10:45 <REP> Microsoft
02/05/2007 19:31 <REP> Spyware Terminator
19/04/2007 10:45 62 desktop.ini
1 fichier(s) 62 octets
4 Rép(s) 26 846 625 792 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est EC9C-7F7E

Répertoire de C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data

19/04/2007 10:45 <REP> .
19/04/2007 10:45 <REP> ..
19/04/2007 10:45 <REP> Microsoft
0 fichier(s) 0 octets
3 Rép(s) 26 846 621 696 octets libres

• • ***************************************

Recherche des taches planifiées dans C:\WINDOWS\tasks

C:\WINDOWS\Tasks\AF20B9C2918B2BD2.job


B/5ë&HYà¤"C¯éF Î <
s  "€!Ø   } 5 c : \ d o c u m e ~ 1 \ f a b \ a p p l i c ~ 1 \ f l a p n e ~ 1 \ G l u e O n c e J u g s . e x e  f a b 
0 Ì

C:\WINDOWS\Tasks\AppleSoftwareUpdate.job


ùÐ\‰CE¼KªO}úÄ}÷F ê <
s  €! : C : \ P r o g r a m F i l e s \ A p p l e S o f t w a r e U p d a t e \ S o f t w a r e U p d a t e . e x e  - T a s k  S Y S T E M  
0 ×  ( 

• • ***************************************

Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est EC9C-7F7E

Répertoire de C:\Program Files

29/02/2008 14:27 <REP> .
29/02/2008 14:27 <REP> ..
07/09/2007 18:08 <REP> 7-Zip
01/10/2007 15:55 <REP> Adobe
05/06/2007 13:03 <REP> adslTV
19/06/2007 17:47 <REP> AGEIA Technologies
19/04/2007 11:51 <REP> Alwil Software
15/05/2007 20:32 <REP> Apple Software Update
19/01/2008 23:53 <REP> a-squared Free
30/12/2007 16:19 <REP> AviSynth 2.5
11/02/2008 18:08 <REP> AxBx
20/01/2008 00:44 <REP> CCleaner
15/01/2008 21:06 <REP> CDBurnerXP
20/05/2007 17:25 <REP> Common
19/04/2007 10:40 <REP> ComPlus Applications
19/04/2007 11:35 <REP> Controle Parental
19/04/2007 11:01 <REP> Creative
05/01/2008 21:21 <REP> CSO-DAX Compressor
19/04/2007 11:33 <REP> directx
26/12/2007 21:58 <REP> DivX
29/02/2008 19:50 <REP> eMule
12/11/2007 19:40 <REP> Fichiers communs
14/02/2008 17:44 <REP> FLAP NEW
03/08/2007 16:46 <REP> FlashGet
21/11/2007 19:21 <REP> Google
13/02/2008 17:09 <REP> Internet Explorer
19/11/2007 23:15 <REP> Java
14/11/2007 22:16 <REP> kauav
18/11/2007 14:52 <REP> K-Lite Codec Pack
19/01/2008 21:15 <REP> Lavasoft
14/01/2008 18:02 <REP> LibUSB-Win32-0.1.10.1
18/02/2008 20:18 <REP> LimeWire
20/01/2008 15:53 <REP> Messenger
19/01/2008 23:54 <REP> MessengerPlus! 3
19/04/2007 10:43 <REP> microsoft frontpage
12/11/2007 20:26 <REP> Microsoft SQL Server Compact Edition
20/01/2008 15:52 <REP> Movie Maker
29/02/2008 15:59 <REP> Mozilla Firefox
02/05/2007 21:29 <REP> mozilla.org
19/04/2007 10:39 <REP> MSN
02/09/2007 11:44 <REP> MSN Apps
19/04/2007 10:39 <REP> MSN Gaming Zone
19/01/2008 23:53 <REP> MSN Messenger
30/04/2007 10:23 <REP> MSXML 4.0
01/02/2008 18:36 <REP> Mystic Sword
29/02/2008 14:31 <REP> Navilog1
20/01/2008 15:47 <REP> NetMeeting
19/04/2007 10:39 <REP> Online Services
01/01/2008 18:38 <REP> OpenAL
25/02/2008 12:52 <REP> Opera
06/02/2008 13:26 <REP> OrangeBox
20/01/2008 15:47 <REP> Outlook Express
01/02/2008 18:48 <REP> Oxygene V6
02/06/2007 15:49 <REP> Philips
24/01/2008 18:53 <REP> Project64 1.6
10/11/2007 13:19 <REP> pspvideo9
24/07/2007 09:29 <REP> Real
28/12/2007 23:12 <REP> Red Kawa
19/01/2008 23:52 <REP> Registry Mechanic
02/11/2007 11:34 <REP> Ripp-it_AM
17/02/2008 22:46 <REP> RomStation
19/04/2007 10:52 <REP> Roxio
19/04/2007 11:38 <REP> SAGEM
19/04/2007 10:41 <REP> Services en ligne
24/01/2008 20:30 <REP> Shareaza
14/01/2008 18:07 <REP> SixaxisDriver
11/02/2008 17:55 <REP> Spybot - Search & Destroy
14/11/2007 20:32 <REP> SpyBro
28/12/2007 21:48 <REP> Trend Micro
23/05/2007 22:25 91 216 unrar.exe
19/04/2007 18:27 <REP> VideoLAN
01/01/2008 17:15 <REP> Wanadoo
20/01/2008 13:12 <REP> Windows Live
19/04/2007 18:37 <REP> Windows Media Connect 2
20/01/2008 15:52 <REP> Windows Media Player
20/01/2008 15:47 <REP> Windows NT
31/10/2007 11:01 <REP> WinPcap
03/05/2007 17:00 <REP> WinRAR
19/04/2007 10:43 <REP> xerox
13/11/2007 12:41 <REP> Yahoo!
19/01/2008 19:40 <REP> ZyDAS Technology Corporation
1 fichier(s) 91 216 octets
80 Rép(s) 26 846 617 600 octets libres

******************************************

1. 1. Popups autorisées

• Internet Explorer

• Mozilla Firefox (1 autorisé 2 interdit)

---------- C:\DOCUMENTS AND SETTINGS\FAB\APPLICATION
DATA\MOZILLA\FIREFOX\PROFILES\3FRTAS36.DEFAULT\HOS
TPERM.1
host popup 1 www.one-piece.fr
host popup 1 www.rap1pulsif.com
host popup 1 www.r4v3n.com
host popup 1 www.3suisses.fr

• • ***************************************

• [HKEY_CURRENT_USER\\Software\Microsoft\Internet Explorer\Main]

Search
Bar REG_SZ http://www.microsoft.com/isapi/redir.dl
l?prd=ie&ar=iesearch

*

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur
rentVersion\Run]
platform bind axis time REG_SZ C:\Documents and Settings\All Users\Application Data\soft ref platform bind\64 wave.exe

*

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curr
entVersion\Run]

MeetDash REG_SZ C:\DOCUME~1\fab\APPLIC~1\FLAPNE~1\
BINMPEGIDLE.exe

• • ***************************************

• HKCU Domains (4)

• P3P History (5)

• • ***************************************

• • ************ Fin du rapport ****************

Re

Par souci de rédaction (JVC affiche mal les scripts), tu trouveras ma réponse ici :
http://xplodconcept.com/viewtopic.php?f=14&amp;t=44&amp;p=49#p49

Analyse ma réponse wiwi

en fait je savais si le texte il falait le mettre dans past standard ou past custom donc je l'ai mis dans past standard et ca ma mis ca.
Folder move failed. C:\Documents and Settings\All Users\Application Data\soft ref platform bind scheduled to be moved on reboot.
C:\DOCUME~1\fab\APPLIC~1\FLAPNE~1 moved successfully.
C:\WINDOWS\Tasks\AF20B9C2918B2BD2.job moved successfully.

OTMoveIt2 v1.0.20 log created on 02292008_211850

alors je me suis trompé?

Pour OTMoveIt2, c'est bon.

Fais-nous un rapport HijackThis.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:18:13, on 29/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\libusbd-nt.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Controle Parental\bin\optproxy.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {00617613-724A-4FFA-8AF4-99846CF94CFB} - (no file)
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {04A152D0-A5E1-405D-B443-2A255E2DCE93} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0B92EFF3-7280-444B-9CDD-050075604E48} - (no file)
O2 - BHO: (no name) - {15247187-154C-4156-A679-62B1C610DFC3} - (no file)
O2 - BHO: (no name) - {1CA9E0D2-6084-4D35-9257-149A0C884BEE} - (no file)
O2 - BHO: (no name) - {28804CFE-B349-4177-98BD-8A3BB5EA6E2A} - (no file)
O2 - BHO: (no name) - {2A0BD6E1-ED84-4F0D-B7A8-5EC108650292} - (no file)
O2 - BHO: (no name) - {355D81EC-5461-4CE7-BABD-73B84AE98E43} - (no file)
O2 - BHO: (no name) - {3615483C-721B-486A-BBA5-FF36DDEFC791} - (no file)
O2 - BHO: (no name) - {39177C9E-D95A-4CD9-A977-C387493355CC} - (no file)
O2 - BHO: (no name) - {3E66BDA3-3321-4A2F-BA4C-336A8C961A73} - (no file)
O2 - BHO: (no name) - {48BF0151-D9B1-49C2-90B2-5576718C4FCD} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {545E2E02-91A6-4176-9C06-9A9BD2BF0246} - (no file)
O2 - BHO: (no name) - {55F4C58F-6023-4EBB-9389-3975ED74D5EA} - (no file)
O2 - BHO: (no name) - {6134FFEB-7DB6-4A25-A9DB-4FFF4C23137F} - (no file)
O2 - BHO: (no name) - {62A85BBF-8AD5-4FF1-9C13-1CDB9648A4B5} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7A3F26AB-AE32-47F5-899E-B5F3FDD0938C} - (no file)
O2 - BHO: (no name) - {7BFBCB4D-AF68-462A-94CF-17D1E7046D11} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {857130F3-DAA0-4146-80EE-C026C618C816} - (no file)
O2 - BHO: (no name) - {8F65468C-BEB4-4B7D-AE89-3BE3977D767A} - (no file)
O2 - BHO: (no name) - {931C3F01-9236-494A-BF51-6226986189A0} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: (no name) - {96441422-E562-457D-BA50-2054FD4357C5} - (no file)
O2 - BHO: (no name) - {9B04CC3B-797D-48FE-94C8-0EFD30CFEC33} - (no file)
O2 - BHO: (no name) - {9D77B2EA-4626-4723-8C5E-5DC8DC8F8BBE} - (no file)
O2 - BHO: (no name) - {A3F4F140-04B9-468E-B2D8-818FC9D2ADC5} - (no file)
O2 - BHO: (no name) - {A6645592-3805-4721-8E35-846911A86B75} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: (no name) - {BEF17BE5-0BA6-4575-B3E0-EF9954B4BD47} - (no file)
O2 - BHO: (no name) - {C0EB56EE-ADA0-45AB-ADD5-570910EEF971} - (no file)
O2 - BHO: (no name) - {C9B92A20-486D-4C56-9086-C6DA74C5CCA5} - (no file)
O2 - BHO: (no name) - {D702381B-1515-4697-93D5-C091B3C0A382} - (no file)
O2 - BHO: (no name) - {DC9EB02A-7FB6-4B1A-843D-31B148E20AE7} - (no file)
O2 - BHO: (no name) - {DFBD1987-1E64-4168-A7C4-0120A27C6356} - (no file)
O2 - BHO: (no name) - {E3D906D1-4D3D-4B9E-83C3-19CE002A37CC} - (no file)
O2 - BHO: (no name) - {ED84FE33-D69C-45F6-A6AB-9462A5BAA112} - (no file)
O2 - BHO: (no name) - {FA3A13F6-9D78-4504-9D0A-D1B9AF29302B} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\Winsos\WINSOS.EXE" MINI
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1176982263671
O20 - Winlogon Notify: joytUI - joytUI.dll (file missing)
O20 - Winlogon Notify: xxyvutt - C:\WINDOWS\
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\WINDOWS\system32\libusbd-nt.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Control Parental (OPTENET_FILTER) - Contrôle Parental - C:\Program Files\Controle Parental\bin\optproxy.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

--
End of file - 10413 bytes

Tu dois le renommer en scanner ...Refais en un ensuite.

c'est bon comme ca?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:26:25, on 29/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\libusbd-nt.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Controle Parental\bin\optproxy.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {00617613-724A-4FFA-8AF4-99846CF94CFB} - (no file)
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {04A152D0-A5E1-405D-B443-2A255E2DCE93} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0B92EFF3-7280-444B-9CDD-050075604E48} - (no file)
O2 - BHO: (no name) - {15247187-154C-4156-A679-62B1C610DFC3} - (no file)
O2 - BHO: (no name) - {1CA9E0D2-6084-4D35-9257-149A0C884BEE} - (no file)
O2 - BHO: (no name) - {28804CFE-B349-4177-98BD-8A3BB5EA6E2A} - (no file)
O2 - BHO: (no name) - {2A0BD6E1-ED84-4F0D-B7A8-5EC108650292} - (no file)
O2 - BHO: (no name) - {355D81EC-5461-4CE7-BABD-73B84AE98E43} - (no file)
O2 - BHO: (no name) - {3615483C-721B-486A-BBA5-FF36DDEFC791} - (no file)
O2 - BHO: (no name) - {39177C9E-D95A-4CD9-A977-C387493355CC} - (no file)
O2 - BHO: (no name) - {3E66BDA3-3321-4A2F-BA4C-336A8C961A73} - (no file)
O2 - BHO: (no name) - {48BF0151-D9B1-49C2-90B2-5576718C4FCD} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {545E2E02-91A6-4176-9C06-9A9BD2BF0246} - (no file)
O2 - BHO: (no name) - {55F4C58F-6023-4EBB-9389-3975ED74D5EA} - (no file)
O2 - BHO: (no name) - {6134FFEB-7DB6-4A25-A9DB-4FFF4C23137F} - (no file)
O2 - BHO: (no name) - {62A85BBF-8AD5-4FF1-9C13-1CDB9648A4B5} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7A3F26AB-AE32-47F5-899E-B5F3FDD0938C} - (no file)
O2 - BHO: (no name) - {7BFBCB4D-AF68-462A-94CF-17D1E7046D11} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {857130F3-DAA0-4146-80EE-C026C618C816} - (no file)
O2 - BHO: (no name) - {8F65468C-BEB4-4B7D-AE89-3BE3977D767A} - (no file)
O2 - BHO: (no name) - {931C3F01-9236-494A-BF51-6226986189A0} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: (no name) - {96441422-E562-457D-BA50-2054FD4357C5} - (no file)
O2 - BHO: (no name) - {9B04CC3B-797D-48FE-94C8-0EFD30CFEC33} - (no file)
O2 - BHO: (no name) - {9D77B2EA-4626-4723-8C5E-5DC8DC8F8BBE} - (no file)
O2 - BHO: (no name) - {A3F4F140-04B9-468E-B2D8-818FC9D2ADC5} - (no file)
O2 - BHO: (no name) - {A6645592-3805-4721-8E35-846911A86B75} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: (no name) - {BEF17BE5-0BA6-4575-B3E0-EF9954B4BD47} - (no file)
O2 - BHO: (no name) - {C0EB56EE-ADA0-45AB-ADD5-570910EEF971} - (no file)
O2 - BHO: (no name) - {C9B92A20-486D-4C56-9086-C6DA74C5CCA5} - (no file)
O2 - BHO: (no name) - {D702381B-1515-4697-93D5-C091B3C0A382} - (no file)
O2 - BHO: (no name) - {DC9EB02A-7FB6-4B1A-843D-31B148E20AE7} - (no file)
O2 - BHO: (no name) - {DFBD1987-1E64-4168-A7C4-0120A27C6356} - (no file)
O2 - BHO: (no name) - {E3D906D1-4D3D-4B9E-83C3-19CE002A37CC} - (no file)
O2 - BHO: (no name) - {ED84FE33-D69C-45F6-A6AB-9462A5BAA112} - (no file)
O2 - BHO: (no name) - {FA3A13F6-9D78-4504-9D0A-D1B9AF29302B} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\Winsos\WINSOS.EXE" MINI
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1176982263671
O20 - Winlogon Notify: joytUI - joytUI.dll (file missing)
O20 - Winlogon Notify: xxyvutt - C:\WINDOWS\
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\WINDOWS\system32\libusbd-nt.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Control Parental (OPTENET_FILTER) - Contrôle Parental - C:\Program Files\Controle Parental\bin\optproxy.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

--
End of file - 10410 bytes

La suite ici :
http://www.xplodconcept.com/viewtopic.php?f=14&amp;t=44&amp;p=49#p49