Petit Virus : impossible de m'en débarrasser

Bonjour,
je crois que je suis victime d'un virus sur mon ordinateur : le curseur de ma souris apparait en "charge" alors qu'il ne se passe rien, je ne peux plus accéder à mon "centre de sécurité windows", j'ai des pubs qui s'affichent ans arrêt sur Internet, et la case afficher les images" des options d'internet explorer se décoche sans cesse. Comme je ne sais pas du tout quoi faire, je vous joins mon rapport Highjack this.
J'espère que vous pourrez m'aider. Merci

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:02:28, on 11/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\dlcxcoms.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I091.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe
C:\Program Files\Dell Photo AIO Printer 926\memcard.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\rundll32.exe
C:\acer\epm\epm-dm.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Documents and Settings\Péro\lsass.exe
C:\WINDOWS\System32\rs32net.exe
C:\DOCUME~1\PÉRO\LOCALS~1\Temp\winlogin.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\rs32net.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\m3V02\m3V022328.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\WINDOWS\TEMP\csrssc.exe
C:\DOCUME~1\PÉRO\LOCALS~1\Temp\csrssc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Péro\Bureau\HiJackThis.exe
C:\Documents and Settings\Péro\Péro.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = HTTP=proxy.club-internet.fr:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [RecoverFromReboot] C:\WINDOWS\Temp\RecoverFromReboot.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [EPSON Stylus C48 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I091.EXE /P23 "EPSON Stylus C48 Series" /O6 "USB002" /M "Stylus C48"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [dlcxmon.exe] "C:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe"
O4 - HKLM\..\Run: [MemoryCardManager] "C:\Program Files\Dell Photo AIO Printer 926\memcard.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLCXCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [LSA Shellu] C:\Documents and Settings\Péro\lsass.exe
O4 - HKLM\..\Run: [rs32net] C:\WINDOWS\System32\rs32net.exe
O4 - HKLM\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\PÉRO\LOCALS~1\Temp\winlogin.exe
O4 - HKLM\..\Run: [NvSvc] C:\WINDOWS\system32\nvsvc32.exe
O4 - HKLM\..\Run: [320d18a1] rundll32.exe "C:\WINDOWS\system32\fsmoapjy.dll",b
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [rs32net] C:\WINDOWS\System32\rs32net.exe
O4 - HKCU\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\PÉRO\LOCALS~1\Temp\winlogin.exe
O4 - HKCU\..\Run: [Jnskdfmf9eldfd] C:\DOCUME~1\PÉRO\LOCALS~1\Temp\csrssc.exe
O4 - HKCU\..\Run: [Péro] C:\Documents and Settings\Péro\Péro.exe /i
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O20 - AppInit_DLLs: zxbqlu.dll amemak.dll
O22 - SharedTaskScheduler: jgzfkj9w38rksndfi7r4 - {C5BF49A2-94F3-42BD-F434-3604812C8955} - C:\WINDOWS\system32\rwhbfb873unjdfdg.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: dlcx_device - - C:\WINDOWS\system32\dlcxcoms.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\icf.exe.exe:ext.exe (file missing)
O23 - Service: Windows CardSpace (idsvc) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (file missing)
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

--
End of file - 11095 bytes
Configuration: Windows XP
Internet Explorer 7.0

7 réponses

  1. petit virus, tu te rends pas compter ,

    c est remplie de cochonnerie. cela fait un moment que tu ne dois pas t occuper de cela.

    1)passe cet antimalware, fait comme indique
    Telecharges malwaresbytes antimalwares(MBAM) : egalement tres util sur pb de pub mais pas tous malheureusement

    Malwarebytes Anti-Malware: http://www.malwarebytes.org/mbam/program/mbam-setup.exe

    Tutoriel Malwarebytes Anti-Malware: https://forum.pcastuces.com/malwarebytes_antimalwares___tutoriel-f31s3.htm
    fais comme indique,mise a jour , scan complet en mode sans echec et les rapports.
    COLLE LE RAPPORT APRES SUPPRESSION MERCI.

    garde le et lance un scan tout les mois comme indique.

    si tu as ad aware tu peux desinstalle car il ne reconnait plus grand chose.

    2)refais un hijack et colle le rapport obtenu.
    0
    1. cela m etonnerait qu avec malwarebyte cela t enleve tout, il faudra surement en passer d autres.
      0
      1. Alors j'ai fait tou ce que tu m'a demandé, voici le rapport de Malware, suivi du nouveau de HighJack this :
        Malwarebytes' Anti-Malware 1.32
        Version de la base de données: 1643
        Windows 5.1.2600 Service Pack 2

        11/01/2009 21:36:05
        mbam-log-2009-01-11 (21-35-57).txt

        Type de recherche: Examen complet (C:\|D:\|)
        Eléments examinés: 114062
        Temps écoulé: 1 hour(s), 59 minute(s), 24 second(s)

        Processus mémoire infecté(s): 0
        Module(s) mémoire infecté(s): 4
        Clé(s) du Registre infectée(s): 24
        Valeur(s) du Registre infectée(s): 11
        Elément(s) de données du Registre infecté(s): 5
        Dossier(s) infecté(s): 0
        Fichier(s) infecté(s): 29

        Processus mémoire infecté(s):
        (Aucun élément nuisible détecté)

        Module(s) mémoire infecté(s):
        C:\WINDOWS\system32\byXOeEXo.dll (Trojan.Vundo.H) -> No action taken.
        C:\WINDOWS\system32\zxbqlu.dll (Trojan.Vundo) -> No action taken.
        C:\WINDOWS\system32\ljJDUolK.dll (Trojan.Vundo) -> No action taken.
        C:\WINDOWS\system32\rwhbfb873unjdfdg.dll (Trojan.FakeAlert) -> No action taken.

        Clé(s) du Registre infectée(s):
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dac69e9d-4327-447e-a01c-7b8ca05708bf} (Trojan.Vundo.H) -> No action taken.
        HKEY_CLASSES_ROOT\CLSID\{dac69e9d-4327-447e-a01c-7b8ca05708bf} (Trojan.Vundo.H) -> No action taken.
        HKEY_CLASSES_ROOT\CLSID\{c5bf49a2-94f3-42bd-f434-3604812c8955} (Trojan.Zlob.H) -> No action taken.
        HKEY_CLASSES_ROOT\CLSID\{8acb27cb-4125-457e-a591-c97e5a9b5d69} (Trojan.Vundo) -> No action taken.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8acb27cb-4125-457e-a591-c97e5a9b5d69} (Trojan.Vundo) -> No action taken.
        HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ljjduolk (Trojan.Vundo) -> No action taken.
        HKEY_CLASSES_ROOT\CLSID\{b200799f-9538-403d-9a6e-36f5942ec540} (Trojan.BHO) -> No action taken.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b200799f-9538-403d-9a6e-36f5942ec540} (Trojan.BHO) -> No action taken.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{fbd29c3c-c642-4843-a627-6e54a947b511} (Trojan.Vundo) -> No action taken.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{e596df5f-4239-4d40-8367-ebadf0165917} (Rogue.Installer) -> No action taken.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5bf49a2-94f3-42bd-f434-3604812c8955} (Trojan.FakeAlert) -> No action taken.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c5bf49a2-94f3-42bd-f434-3604812c8955} (Trojan.FakeAlert) -> No action taken.
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\restore (Rootkit.Agent) -> No action taken.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> No action taken.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> No action taken.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ICF (Rootkit.Agent) -> No action taken.

        Valeur(s) du Registre infectée(s):
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\320d18a1 (Trojan.Vundo.H) -> No action taken.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{c5bf49a2-94f3-42bd-f434-3604812c8955} (Trojan.Zlob.H) -> No action taken.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jsf8uiw3jnjgffght (Trojan.Dropper) -> No action taken.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jsf8uiw3jnjgffght (Trojan.Dropper) -> No action taken.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nvsvc (Spyware.Agent) -> No action taken.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{fbd29c3c-c642-4843-a627-6e54a947b511} (Trojan.Vundo) -> No action taken.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rs32net (Trojan.Agent) -> No action taken.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rs32net (Trojan.Agent) -> No action taken.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LSA Shellu (Trojan.Agent) -> No action taken.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Jnskdfmf9eldfd (Trojan.Downloader) -> No action taken.

        Elément(s) de données du Registre infecté(s):
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\byxoeexo -> No action taken.
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\byxoeexo -> No action taken.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> No action taken.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> No action taken.

        Dossier(s) infecté(s):
        (Aucun élément nuisible détecté)

        Fichier(s) infecté(s):
        C:\WINDOWS\system32\byXOeEXo.dll (Trojan.Vundo.H) -> No action taken.
        C:\WINDOWS\system32\oXEeOXyb.ini (Trojan.Vundo.H) -> No action taken.
        C:\WINDOWS\system32\oXEeOXyb.ini2 (Trojan.Vundo.H) -> No action taken.
        C:\WINDOWS\system32\fsmoapjy.dll (Trojan.Vundo.H) -> No action taken.
        C:\WINDOWS\system32\yjpaomsf.ini (Trojan.Vundo.H) -> No action taken.
        C:\WINDOWS\system32\rwhbfb873unjdfdg.dll (Trojan.Zlob.H) -> No action taken.
        C:\WINDOWS\system32\zxbqlu.dll (Trojan.Vundo) -> No action taken.
        C:\Documents and Settings\Péro\Local Settings\Temp\winlogin.exe (Trojan.Dropper) -> No action taken.
        C:\WINDOWS\system32\nvsvc32.exe (Spyware.Agent) -> No action taken.
        C:\WINDOWS\system32\ljJDUolK.dll (Trojan.Vundo) -> No action taken.
        C:\WINDOWS\system32\fklame32.dll (Trojan.BHO) -> No action taken.
        C:\WINDOWS\system32\cmmruafd.dll (Trojan.Vundo) -> No action taken.
        C:\WINDOWS\Temp\BN5.tmp (Rootkit.Agent) -> No action taken.
        C:\WINDOWS\Temp\BN2.tmp (Rootkit.Agent) -> No action taken.
        C:\WINDOWS\Temp\BNA.tmp (Rootkit.Agent) -> No action taken.
        C:\WINDOWS\Temp\BN4.tmp (Rootkit.Agent) -> No action taken.
        C:\WINDOWS\Temp\BN3.tmp (Rootkit.Agent) -> No action taken.
        C:\System Volume Information\_restore{39138AFC-2562-464E-ABA0-3F3BA0BC3ED9}\RP265\A0065149.sys (Rootkit.Agent) -> No action taken.
        C:\System Volume Information\_restore{39138AFC-2562-464E-ABA0-3F3BA0BC3ED9}\RP265\A0065166.sys (Rootkit.Agent) -> No action taken.
        C:\System Volume Information\_restore{39138AFC-2562-464E-ABA0-3F3BA0BC3ED9}\RP265\A0066162.dll (Trojan.Vundo) -> No action taken.
        C:\System Volume Information\_restore{39138AFC-2562-464E-ABA0-3F3BA0BC3ED9}\RP265\A0066175.sys (Rootkit.Agent) -> No action taken.
        C:\System Volume Information\_restore{39138AFC-2562-464E-ABA0-3F3BA0BC3ED9}\RP265\A0067168.sys (Rootkit.Agent) -> No action taken.
        C:\FOUND.003\FILE0189.CHK (Rootkit.Agent) -> No action taken.
        C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> No action taken.
        C:\WINDOWS\system32\rs32net.exe (Trojan.Agent) -> No action taken.
        C:\Documents and Settings\Péro\lsass.exe (Trojan.Agent) -> No action taken.
        C:\WINDOWS\system32\pac.txt (Malware.Trace) -> No action taken.
        C:\WINDOWS\system32\vtUkjGvs.dll (Trojan.vundo) -> No action taken.
        C:\Documents and Settings\Péro\msiexec.exe (Heuristics.Reserved.Word.Exploit) -> No action taken.

        Le rapport de HighJack this :

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 21:47:11, on 11/01/2009
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16762)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
        C:\Program Files\QuickTime\qttask.exe
        C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I091.EXE
        C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
        C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
        C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
        C:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe
        C:\Program Files\Dell Photo AIO Printer 926\memcard.exe
        C:\WINDOWS\system32\CTsvcCDA.exe
        C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
        C:\WINDOWS\system32\dlcxcoms.exe
        C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
        C:\acer\epm\epm-dm.exe
        C:\WINDOWS\RTHDCPL.EXE
        C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
        C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
        C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
        C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        C:\WINDOWS\system32\wscntfy.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
        C:\Documents and Settings\Péro\Bureau\HiJackThis.exe
        C:\Documents and Settings\Péro\Péro.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = HTTP=proxy.club-internet.fr:8080
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        O2 - BHO: pl - {B200799F-9538-403d-9A6E-36F5942EC540} - C:\WINDOWS\system32\fdlame32.dll
        O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
        O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
        O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
        O4 - HKLM\..\Run: [RecoverFromReboot] C:\WINDOWS\Temp\RecoverFromReboot.exe
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
        O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
        O4 - HKLM\..\Run: [EPSON Stylus C48 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I091.EXE /P23 "EPSON Stylus C48 Series" /O6 "USB002" /M "Stylus C48"
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
        O4 - HKLM\..\Run: [dlcxmon.exe] "C:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe"
        O4 - HKLM\..\Run: [MemoryCardManager] "C:\Program Files\Dell Photo AIO Printer 926\memcard.exe"
        O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
        O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
        O4 - HKLM\..\Run: [DLCXCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16
        O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
        O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
        O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
        O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
        O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
        O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
        O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
        O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
        O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
        O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
        O4 - HKCU\..\Run: [Péro] C:\Documents and Settings\Péro\Péro.exe /i
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
        O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
        O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
        O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
        O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
        O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
        O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
        O20 - AppInit_DLLs: zxbqlu.dll amemak.dll
        O20 - Winlogon Notify: gdttwhd - C:\WINDOWS\SYSTEM32\gdttwhd32.dll
        O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
        O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
        O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
        O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
        O23 - Service: dlcx_device - - C:\WINDOWS\system32\dlcxcoms.exe
        O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: Windows CardSpace (idsvc) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (file missing)
        O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
        O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe
        0
        1. AH oui, j'ai oubli de dire : les images d'internet apparaissent directement maintenant et visiblement je n'ai plus de publicités intempestives ; en revanche, le pointeur de ma souris est toujours en charge.
          J'espère que le nouveau rapport HighJack this pourra t'aiguiller pour m'aider,
          Merci encore
          0
          1. il en reste surement.

            1)regarde bien le tuto d antivir fait la configuration pour le scan comme indique.
            https://www.malekal.com/avira-free-security-antivirus-gratuit/

            ensuite fait bien la mise a jour d antivir et apres va en mode sans echec la tu lances le scan complet de ton ordi.a la fin tu repasses en mode normal
            tu as un rapport de ton scan dans l onglet rapport, tu me le colles merci.

            2)apres refais moi un rapport hijack.
            0
            1. Voici le rapport de antivir et le nouveau HJ this :

              AntiVir PersonalEdition Classic
              Report file date: dimanche 11 janvier 2009 22:31

              Scanning for 1145475 virus strains and unwanted programs.

              Licensed to: Avira AntiVir PersonalEdition Classic
              Serial number: 0000149996-ADJIE-0001
              Platform: Windows XP
              Windows version: (Service Pack 2) [5.1.2600]
              Username: SYSTEM
              Computer name: ACER-29569F1E48

              Version information:
              BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
              AVSCAN.EXE : 7.0.6.1 290856 Bytes 10/10/2007 19:12:02
              AVSCAN.DLL : 7.0.6.0 49192 Bytes 10/10/2007 19:12:02
              LUKE.DLL : 7.0.5.3 147496 Bytes 10/10/2007 19:12:04
              LUKERES.DLL : 7.0.6.1 10280 Bytes 10/10/2007 19:12:04
              ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 19:12:12
              ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 18:34:40
              ANTIVIR2.VDF : 7.0.3.3 2048 Bytes 07/03/2008 18:34:40
              ANTIVIR3.VDF : 7.0.3.22 127488 Bytes 12/03/2008 18:34:40
              AVEWIN32.DLL : 7.6.0.73 3334656 Bytes 12/03/2008 18:34:40
              AVWINLL.DLL : 1.0.0.7 14376 Bytes 23/04/2007 22:17:12
              AVPREF.DLL : 7.0.2.2 25640 Bytes 10/10/2007 19:12:02
              AVREP.DLL : 7.0.0.1 155688 Bytes 23/04/2007 22:17:14
              AVPACK32.DLL : 7.6.0.3 360488 Bytes 07/02/2008 10:59:30
              AVREG.DLL : 7.0.1.6 30760 Bytes 10/10/2007 19:12:02
              AVARKT.DLL : 1.0.0.20 278568 Bytes 10/10/2007 19:12:00
              AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 10/10/2007 19:12:00
              NETNT.DLL : 7.0.0.0 7720 Bytes 23/04/2007 22:17:12
              RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 10/10/2007 19:11:28
              RCTEXT.DLL : 7.0.62.0 86056 Bytes 10/10/2007 19:11:28
              SQLITE3.DLL : 3.3.17.1 339968 Bytes 10/10/2007 19:12:04

              Configuration settings for the scan:
              Jobname..........................: Complete system scan
              Configuration file...............: c:\program files\antivir personaledition classic\sysscan.avp
              Logging..........................: low
              Primary action...................: interactive
              Secondary action.................: ignore
              Scan master boot sector..........: off
              Scan boot sector.................: on
              Boot sectors.....................: D:,
              Scan memory......................: on
              Process scan.....................: on
              Scan registry....................: on
              Search for rootkits..............: off
              Scan all files...................: Intelligent file selection
              Scan archives....................: on
              Recursion depth..................: 20
              Smart extensions.................: on
              Macro heuristic..................: on
              File heuristic...................: medium

              Start of the scan: dimanche 11 janvier 2009 22:31

              The scan of running processes will be started
              Scan process 'PÉRO.EXE' - '1' Module(s) have been scanned
              Scan process 'avscan.exe' - '1' Module(s) have been scanned
              Scan process 'avcenter.exe' - '1' Module(s) have been scanned
              Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
              Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
              Scan process 'svchost.exe' - '1' Module(s) have been scanned
              Scan process 'svchost.exe' - '1' Module(s) have been scanned
              Scan process 'svchost.exe' - '1' Module(s) have been scanned
              Scan process 'jqs.exe' - '1' Module(s) have been scanned
              Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
              Scan process 'svchost.exe' - '1' Module(s) have been scanned
              Scan process 'alg.exe' - '1' Module(s) have been scanned
              Scan process 'rundll32.exe' - '1' Module(s) have been scanned
              Scan process 'svchost.exe' - '1' Module(s) have been scanned
              Scan process 'svchost.exe' - '1' Module(s) have been scanned
              Scan process 'svchost.exe' - '1' Module(s) have been scanned
              Scan process 'IJPLMSVC.EXE' - '1' Module(s) have been scanned
              Scan process 'SAgent2.exe' - '1' Module(s) have been scanned
              Scan process 'CTSyncU.exe' - '1' Module(s) have been scanned
              Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
              Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
              Scan process 'dlcxcoms.exe' - '1' Module(s) have been scanned
              Scan process 'MsnMsgr.Exe' - '1' Module(s) have been scanned
              Scan process 'CTsvcCDA.exe' - '1' Module(s) have been scanned
              Scan process 'avguard.exe' - '1' Module(s) have been scanned
              Scan process 'OpWareSE4.exe' - '1' Module(s) have been scanned
              Scan process 'sched.exe' - '1' Module(s) have been scanned
              Scan process 'BJMyPrt.exe' - '1' Module(s) have been scanned
              Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned
              Scan process 'epm-dm.exe' - '1' Module(s) have been scanned
              Scan process 'issch.exe' - '1' Module(s) have been scanned
              Scan process 'memcard.exe' - '1' Module(s) have been scanned
              Scan process 'dlcxmon.exe' - '1' Module(s) have been scanned
              Scan process 'E_S4I091.EXE' - '1' Module(s) have been scanned
              Scan process 'qttask.exe' - '1' Module(s) have been scanned
              Scan process 'avgnt.exe' - '1' Module(s) have been scanned
              Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
              Scan process 'Explorer.EXE' - '1' Module(s) have been scanned
              Scan process 'aawservice.exe' - '1' Module(s) have been scanned
              Scan process 'svchost.exe' - '1' Module(s) have been scanned
              Scan process 'svchost.exe' - '1' Module(s) have been scanned
              Scan process 'svchost.exe' - '1' Module(s) have been scanned
              Scan process 'svchost.exe' - '1' Module(s) have been scanned
              Scan process 'svchost.exe' - '1' Module(s) have been scanned
              Scan process 'svchost.exe' - '1' Module(s) have been scanned
              Scan process 'lsass.exe' - '1' Module(s) have been scanned
              Scan process 'services.exe' - '1' Module(s) have been scanned
              Scan process 'winlogon.exe' - '1' Module(s) have been scanned
              Scan process 'csrss.exe' - '1' Module(s) have been scanned
              Scan process 'smss.exe' - '1' Module(s) have been scanned
              50 processes with 50 modules were scanned

              Start scanning boot sectors:
              Boot sector 'C:\'
              [NOTE] No virus was found!
              Boot sector 'D:\'
              [NOTE] No virus was found!

              Starting to scan the registry.
              The registry was scanned ( '37' files ).

              Starting the file scan:

              Begin scan in 'C:\' <ACER>
              C:\hiberfil.sys
              [WARNING] The file could not be opened!
              C:\pagefile.sys
              [WARNING] The file could not be opened!
              C:\WINDOWS\system32\drivers\ati8gmxx.sys
              [WARNING] The file could not be opened!
              Begin scan in 'D:\' <ACERDATA>

              End of the scan: dimanche 11 janvier 2009 23:00
              Used time: 29:25 min

              The scan has been done completely.

              5239 Scanning directories
              363544 Files were scanned
              0 viruses and/or unwanted programs were found
              0 Files were classified as suspicious:
              0 files were deleted
              0 files were repaired
              0 files were moved to quarantine
              0 files were renamed
              3 Files cannot be scanned
              363544 Files not concerned
              8013 Archives were scanned
              3 Warnings
              0 Notes

              HJ this:

              Logfile of Trend Micro HijackThis v2.0.2
              Scan saved at 23:04:20, on 11/01/2009
              Platform: Windows XP SP2 (WinNT 5.01.2600)
              MSIE: Internet Explorer v7.00 (7.00.6000.16762)
              Boot mode: Normal

              Running processes:
              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
              C:\WINDOWS\Explorer.EXE
              C:\WINDOWS\system32\spoolsv.exe
              C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
              C:\Program Files\QuickTime\qttask.exe
              C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I091.EXE
              C:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe
              C:\Program Files\Dell Photo AIO Printer 926\memcard.exe
              C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
              C:\acer\epm\epm-dm.exe
              C:\WINDOWS\RTHDCPL.EXE
              C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
              C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
              C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
              C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
              C:\WINDOWS\system32\CTsvcCDA.exe
              C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
              C:\WINDOWS\system32\dlcxcoms.exe
              C:\WINDOWS\system32\ctfmon.exe
              C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
              C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
              C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
              C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\system32\rundll32.exe
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\system32\wuauclt.exe
              C:\Program Files\Java\jre6\bin\jqs.exe
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\Program Files\Internet Explorer\IEXPLORE.EXE
              C:\Documents and Settings\Péro\Bureau\HiJackThis.exe
              C:\Documents and Settings\Péro\Péro.exe

              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
              R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
              R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
              R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = HTTP=proxy.club-internet.fr:8080
              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
              O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
              O2 - BHO: pl - {B200799F-9538-403d-9A6E-36F5942EC540} - C:\WINDOWS\system32\fklame32.dll
              O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
              O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
              O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
              O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
              O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
              O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
              O4 - HKLM\..\Run: [RecoverFromReboot] C:\WINDOWS\Temp\RecoverFromReboot.exe
              O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
              O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
              O4 - HKLM\..\Run: [EPSON Stylus C48 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I091.EXE /P23 "EPSON Stylus C48 Series" /O6 "USB002" /M "Stylus C48"
              O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
              O4 - HKLM\..\Run: [dlcxmon.exe] "C:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe"
              O4 - HKLM\..\Run: [MemoryCardManager] "C:\Program Files\Dell Photo AIO Printer 926\memcard.exe"
              O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
              O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
              O4 - HKLM\..\Run: [DLCXCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16
              O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
              O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
              O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
              O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
              O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
              O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
              O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
              O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
              O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
              O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
              O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
              O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
              O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
              O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
              O4 - HKCU\..\Run: [Péro] C:\Documents and Settings\Péro\Péro.exe /i
              O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
              O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
              O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
              O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
              O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
              O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
              O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
              O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
              O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
              O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
              O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
              O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
              O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
              O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
              O20 - AppInit_DLLs: zxbqlu.dll
              O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
              O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
              O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
              O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
              O23 - Service: dlcx_device - - C:\WINDOWS\system32\dlcxcoms.exe
              O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
              O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
              O23 - Service: Windows CardSpace (idsvc) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (file missing)
              O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
              O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
              O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe
              0
              1. sais tu lire ou bien tu te fous de moi.aucune mise a jour d effectuer regarde les dates, e3nsuite pour la config rien de fait . REVEIL

                FAIT DES CHANGEMENTS OU DEBROUILLE TOI.REGARDE LE TUTO ET REFAIS UN SCAN EN MODE SANS ECHEC COMME INDIQUE.
                IL FAUT APPRENDRE A LIRE.

                Version information:
                BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
                AVSCAN.EXE : 7.0.6.1 290856 Bytes 10/10/2007 19:12:02
                AVSCAN.DLL : 7.0.6.0 49192 Bytes 10/10/2007 19:12:02
                LUKE.DLL : 7.0.5.3 147496 Bytes 10/10/2007 19:12:04
                LUKERES.DLL : 7.0.6.1 10280 Bytes 10/10/2007 19:12:04
                ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 19:12:12
                ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 18:34:40
                ANTIVIR2.VDF : 7.0.3.3 2048 Bytes 07/03/2008 18:34:40
                ANTIVIR3.VDF : 7.0.3.22 127488 Bytes 12/03/2008 18:34:40
                AVEWIN32.DLL : 7.6.0.73 3334656 Bytes 12/03/2008 18:34:40
                AVWINLL.DLL : 1.0.0.7 14376 Bytes 23/04/2007 22:17:12
                AVPREF.DLL : 7.0.2.2 25640 Bytes 10/10/2007 19:12:02
                AVREP.DLL : 7.0.0.1 155688 Bytes 23/04/2007 22:17:14
                AVPACK32.DLL : 7.6.0.3 360488 Bytes 07/02/2008 10:59:30
                AVREG.DLL : 7.0.1.6 30760 Bytes 10/10/2007 19:12:02
                AVARKT.DLL : 1.0.0.20 278568 Bytes 10/10/2007 19:12:00
                AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 10/10/2007 19:12:00
                NETNT.DLL : 7.0.0.0 7720 Bytes 23/04/2007 22:17:12
                RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 10/10/2007 19:11:28
                RCTEXT.DLL : 7.0.62.0 86056 Bytes 10/10/2007 19:11:28
                SQLITE3.DLL : 3.3.17.1 339968 Bytes 10/10/2007 19:12:04

                Configuration settings for the scan:
                Jobname..........................: Complete system scan
                Configuration file...............: c:\program files\antivir personaledition classic\sysscan.avp
                Logging..........................: low
                Primary action...................: interactive
                Secondary action.................: ignore
                Scan master boot sector..........: off
                Scan boot sector.................: on
                Boot sectors.....................: D:,
                Scan memory......................: on
                Process scan.....................: on
                Scan registry....................: on
                Search for rootkits..............: off
                Scan all files...................: Intelligent file selection
                Scan archives....................: on
                Recursion depth..................: 20
                Smart extensions.................: on
                Macro heuristic..................: on
                File heuristic...................: medium

                regarde le tuto , aucun changement d effectuer jamais de mise a jour .
                tu rigoles.
                0