Cheval de troie win 32

le voici :

############################## [ UsbFix V3.018 # Scan ]

# User : Marc (Administrateurs) # CALINOU
# Update on 11/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 11:27:11 | 13/05/2009

# Intel(R) Celeron(R) CPU 1.70GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.13
# Windows Firewall Status : Enabled
# AV : avast! antivirus 4.8.1229 [VPS 090512-0] 4.8.1229 [ Enabled | Updated ]

# C:\ # Disque fixe local # 37,26 Go (8,02 Go free) # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque amovible # 124,01 Mo (3,12 Mo free) # FAT32

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Documents and Settings\Marc\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\SFRWidget\WidgetSFR.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Registre # Startup ]

HKCU_Main: "Local Page"="C:\\windows\\system32\\blank.htm"
HKCU_Main: "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
HKCU_Main: "Start Page"="https://www.mozilla.org/en-US/"
HKCU_Main: "Secondary Start Pages"=hex(7):68,00,74,00,74,00,70,00,3a,00,2f,00,2f,00,66,00,\
HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
HKLM_logon: "DefaultUserName"="Marc"
HKLM_logon: "AltDefaultUserName"="Marc"
HKLM_logon: "LegalNoticeCaption"=""
HKLM_logon: "LegalNoticeText"=""
HKLM_Run: NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
HKLM_Run: nwiz=nwiz.exe /install
HKLM_Run: NvMediaCenter=RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
HKLM_Run: SoundMan=SOUNDMAN.EXE
HKLM_Run: Adobe Version Cue CS2="C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
HKLM_Run: Acrobat Assistant 7.0="C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
HKLM_Run: SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe"
HKLM_Run: LogitechCommunicationsManager="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
HKLM_Run: LogitechQuickCamRibbon="C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
HKLM_Run: avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
HKLM_Run: Tweak UI=RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
HKLM_Run: EoEngine=
HKLM_Run: SoftwareHelper=C:\Documents and Settings\Marc\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
HKLM_Run: EoDesk3d=
HKLM_Run: CPMff407968=Rundll32.exe "c:\windows\system32\riwirinu.dll",a
HKLM_Run: rutigugoze=Rundll32.exe "C:\WINDOWS\system32\silulotu.dll",s
HKLM_Run: fc734af4=rundll32.exe "C:\WINDOWS\system32\jojesira.dll",b
HKCU_Run: CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe
HKCU_Run: msnmsgr="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
HKCU_Run: Software Informer="C:\Program Files\Software Informer\softinfo.exe" -autorun
HKCU_Run: Microsoft Windows logon process=C:\Documents and Settings\Marc\Application Data\Microsoft\Windows\winlogon.exe
HKCU_Run: Internet Antivirus Pro="c:\program files\Internet Antivirus Pro\IAPro.exe" /s

################## [ Informations ]


################## [ Fichiers # Dossiers infectieux ]

Found ! C:\WINDOWS\system32\tmp.reg
Found ! C:\WINDOWS\system32\tmp.txt

################## [ Registre # Clés Run infectieuses ]

Found ! HKLM\software\microsoft\security center\\ "AntiVirusOverride"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 )
Found ! HKLM\software\microsoft\security center\\ "FirewallOverride"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 )
Found ! HKLM\software\microsoft\security center\\ "UpdatesDisableNotify"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 )

################## [ Registre # Mountpoints2 ]

HKCU\Software\Microsoft\....\MountPoints2\{c24338aa-3fc1-11dd-aa68-0050fc968802}\Shell\Auto\command
HKCU\Software\Microsoft\....\MountPoints2\{c24338aa-3fc1-11dd-aa68-0050fc968802}\Shell\AutoRun\command

################## [ ! Fin du rapport # UsbFix V3.018 ! ]
je dois fermer les précédents bloc notes et usbfix ?
merci
cathy

tu l'as bien reçu le dernier post avec le rapport de usbfix ?
merci
cathy

voici le dernier rapport :

############################## [ UsbFix V3.018 # Cleaning ]

# User : Marc (Administrateurs) # CALINOU
# Update on 11/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 12:53:06 | 13/05/2009

# Intel(R) Celeron(R) CPU 1.70GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.13
# Windows Firewall Status : Enabled
# AV : avast! antivirus 4.8.1229 [VPS 090512-0] 4.8.1229 [ Enabled | Updated ]

# C:\ # Disque fixe local # 37,26 Go (7,99 Go free) # NTFS
# D:\ # Disque CD-ROM

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Fichiers # Dossiers infectieux ]

Deleted ! C:\WINDOWS\system32\tmp.reg
Deleted ! C:\WINDOWS\system32\tmp.txt

################## [ Registre # Clés Run infectieuses ]

# HKLM\software\microsoft\security center\\ "AntiVirusOverride"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
# HKLM\software\microsoft\security center\\ "FirewallOverride"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
# HKLM\software\microsoft\security center\\ "UpdatesDisableNotify"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !

################## [ Registre # Mountpoints2 ]

Deleted ! HKCU\Software\Microsoft\....\MountPoints2\{c24338aa-3fc1-11dd-aa68-0050fc968802}\Shell\Auto\command

################## [ Listing des fichiers présent ]

[23/03/2008 14:17|--a------|0] - C:\AUTOEXEC.BAT
[25/02/2009 20:32|--a------|2144] - C:\bloc note rapport.txt
[22/11/2008 21:44|-rahs----|216] - C:\boot.ini
[30/08/2002 14:00|-rahs----|4952] - C:\Bootfont.bin
[23/03/2008 14:17|--a------|0] - C:\CONFIG.SYS
[30/03/2008 01:33|--a------|693] - C:\Desktop.ini
[?|?|?] - C:\hiberfil.sys
[23/01/2009 21:16|--a------|424] - C:\InstallHelper.log
[23/03/2008 14:17|-rahs----|0] - C:\IO.SYS
[23/03/2008 14:17|-rahs----|0] - C:\MSDOS.SYS
[23/03/2008 15:40|-rahs----|47564] - C:\NTDETECT.COM
[03/09/2008 23:07|-rahs----|252240] - C:\ntldr
[29/02/2004 17:44|--a------|52576] - C:\orange.bmp
[?|?|?] - C:\pagefile.sys
[23/03/2008 14:17|--ahs----|864] - C:\pjxjaw3o.sys
[25/02/2009 20:31|--a------|2144] - C:\rapport.txt
[23/03/2008 18:38|--ah-----|268] - C:\sqmdata00.sqm
[24/07/2008 19:24|--ah-----|268] - C:\sqmdata01.sqm
[14/08/2008 03:10|--ah-----|268] - C:\sqmdata02.sqm
[15/08/2008 00:42|--ah-----|268] - C:\sqmdata03.sqm
[22/02/2009 20:28|--ah-----|232] - C:\sqmdata04.sqm
[22/02/2009 20:28|--ah-----|232] - C:\sqmdata05.sqm
[22/02/2009 20:28|--ah-----|232] - C:\sqmdata06.sqm
[22/02/2009 20:29|--ah-----|232] - C:\sqmdata07.sqm
[22/02/2009 20:29|--ah-----|232] - C:\sqmdata08.sqm
[22/02/2009 20:29|--ah-----|232] - C:\sqmdata09.sqm
[22/02/2009 20:30|--ah-----|232] - C:\sqmdata10.sqm
[22/02/2009 20:30|--ah-----|232] - C:\sqmdata11.sqm
[22/02/2009 20:30|--ah-----|232] - C:\sqmdata12.sqm
[23/03/2008 18:38|--ah-----|244] - C:\sqmnoopt00.sqm
[24/07/2008 19:24|--ah-----|244] - C:\sqmnoopt01.sqm
[14/08/2008 03:10|--ah-----|244] - C:\sqmnoopt02.sqm
[15/08/2008 00:42|--ah-----|244] - C:\sqmnoopt03.sqm
[22/02/2009 20:27|--ah-----|244] - C:\sqmnoopt04.sqm
[22/02/2009 20:28|--ah-----|244] - C:\sqmnoopt05.sqm
[22/02/2009 20:28|--ah-----|244] - C:\sqmnoopt06.sqm
[22/02/2009 20:29|--ah-----|244] - C:\sqmnoopt07.sqm
[22/02/2009 20:29|--ah-----|244] - C:\sqmnoopt08.sqm
[22/02/2009 20:29|--ah-----|244] - C:\sqmnoopt09.sqm
[22/02/2009 20:30|--ah-----|244] - C:\sqmnoopt10.sqm
[22/02/2009 20:30|--ah-----|244] - C:\sqmnoopt11.sqm
[22/02/2009 20:30|--ah-----|244] - C:\sqmnoopt12.sqm
[13/05/2009 12:55|--a------|5045] - C:\UsbFix.txt

################## [ Vaccination ]

# C:\autorun.inf -> Folder created by UsbFix.

################## [ Cracks / Keygens / Serials ]

# -> Nothing found !

################## [ ! Fin du rapport # UsbFix V3.018 ! ]

je dois attendre ta réponse avant de continuer ou je fais ce que tu m'as indiqué ?
cat

voilà le dernier (je continue) :


--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Celeron(R) CPU 1.70GHz )
BIOS : BIOS Date: 02/26/03 13:28:24 Ver: 08.00.07
USER : Marc ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 090512-0] 4.8.1229 (Activated)
C:\ (Local Disk) - NTFS - Total:37 Go (Free:7 Go)
D:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( 13/05/2009|13:46 )


\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

Supprime! - C:\DOCUME~1\Marc\LOCALS~1\Temp\nsw10E.tmp
Supprime! - C:\DOCUME~1\Marc\Cookies\marc@advertising[2].txt
Supprime! - C:\DOCUME~1\Marc\Cookies\marc@adopt.euroclick[2].txt

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


--------------------\\ Listing des dossiers dans APPLIC~1

[28/03/2008|19:53] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

[09/04/2008|18:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[23/03/2008|19:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems
[12/04/2008|20:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[29/03/2008|18:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
[25/02/2009|12:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\eBay
[19/08/2008|19:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[13/05/2009|10:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
[24/03/2008|16:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logishrd
[24/03/2008|16:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
[04/03/2009|00:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[29/12/2008|17:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
[23/03/2008|14:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
[12/05/2009|20:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\OneStepSrch
[13/04/2009|11:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[25/02/2009|10:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WholeSecurity
[23/03/2008|15:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[29/03/2008|13:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
[23/03/2008|17:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[12/07/2008|16:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom



[25/03/2008|23:41] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[23/03/2008|17:29] C:\DOCUME~1\INVIT~1\APPLIC~1\Microsoft

[03/06/2008|19:49] C:\DOCUME~1\INVIT~1.CAL\APPLIC~1\Adobe
[03/06/2008|19:47] C:\DOCUME~1\INVIT~1.CAL\APPLIC~1\Apple Computer
[03/06/2008|18:01] C:\DOCUME~1\INVIT~1.CAL\APPLIC~1\Identities
[03/06/2008|19:49] C:\DOCUME~1\INVIT~1.CAL\APPLIC~1\Macromedia
[03/06/2008|21:16] C:\DOCUME~1\INVIT~1.CAL\APPLIC~1\Microsoft
[03/06/2008|19:52] C:\DOCUME~1\INVIT~1.CAL\APPLIC~1\Mozilla

[23/03/2008|14:21] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[22/11/2008|22:27] C:\DOCUME~1\LOCALS~1\APPLIC~1\Mozilla

[24/02/2009|21:14] C:\DOCUME~1\Marc\APPLIC~1\Adobe
[21/06/2008|13:21] C:\DOCUME~1\Marc\APPLIC~1\AdobeUM
[12/02/2009|17:04] C:\DOCUME~1\Marc\APPLIC~1\DivX
[14/04/2009|14:54] C:\DOCUME~1\Marc\APPLIC~1\DMCache
[05/05/2009|23:32] C:\DOCUME~1\Marc\APPLIC~1\dvdcss
[16/02/2009|11:07] C:\DOCUME~1\Marc\APPLIC~1\eBay
[08/03/2009|01:15] C:\DOCUME~1\Marc\APPLIC~1\EoRezo
[23/11/2008|16:50] C:\DOCUME~1\Marc\APPLIC~1\FileZilla
[03/02/2009|23:11] C:\DOCUME~1\Marc\APPLIC~1\Google
[03/03/2009|02:06] C:\DOCUME~1\Marc\APPLIC~1\gtk-2.0
[18/02/2009|03:23] C:\DOCUME~1\Marc\APPLIC~1\Help
[25/04/2009|16:48] C:\DOCUME~1\Marc\APPLIC~1\Icone
[20/06/2008|20:48] C:\DOCUME~1\Marc\APPLIC~1\Identities
[14/04/2009|15:03] C:\DOCUME~1\Marc\APPLIC~1\IDM
[10/03/2009|09:46] C:\DOCUME~1\Marc\APPLIC~1\InstallShield
[25/02/2009|14:59] C:\DOCUME~1\Marc\APPLIC~1\Internet Antivirus Pro
[10/04/2009|00:01] C:\DOCUME~1\Marc\APPLIC~1\LG Electronics
[05/03/2009|07:53] C:\DOCUME~1\Marc\APPLIC~1\LimeWire
[20/06/2008|20:52] C:\DOCUME~1\Marc\APPLIC~1\Macromedia
[16/04/2009|17:02] C:\DOCUME~1\Marc\APPLIC~1\Microsoft
[26/08/2008|22:02] C:\DOCUME~1\Marc\APPLIC~1\Mozilla
[04/04/2009|21:05] C:\DOCUME~1\Marc\APPLIC~1\MSN6
[13/05/2009|10:22] C:\DOCUME~1\Marc\APPLIC~1\OpenOffice.org2
[24/07/2008|20:57] C:\DOCUME~1\Marc\APPLIC~1\Real
[10/03/2009|10:18] C:\DOCUME~1\Marc\APPLIC~1\Sony Corporation
[24/06/2008|18:55] C:\DOCUME~1\Marc\APPLIC~1\Sun
[29/03/2009|23:07] C:\DOCUME~1\Marc\APPLIC~1\vlc
[05/04/2009|18:17] C:\DOCUME~1\Marc\APPLIC~1\Windows Live Writer
[24/06/2008|21:23] C:\DOCUME~1\Marc\APPLIC~1\WinRAR
[29/06/2008|00:46] C:\DOCUME~1\Marc\APPLIC~1\Yahoo!

[25/03/2008|23:40] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[13/05/2009 12:52][--a------] C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job
[13/05/2009 12:52][--a------] C:\WINDOWS\tasks\Google Software Updater.job
[10/05/2009 18:00][--a------] C:\WINDOWS\tasks\Norton Security Scan.job
[13/05/2009 12:52][--ah-----] C:\WINDOWS\tasks\SA.DAT
[30/08/2002 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[05/03/2009|00:50] C:\Program Files\ACE Mega CoDecS Pack
[23/03/2008|19:36] C:\Program Files\Adobe
[21/06/2008|14:51] C:\Program Files\Alwil Software
[23/03/2008|15:28] C:\Program Files\AvRack
[20/06/2008|20:28] C:\Program Files\CamStudio
[13/04/2009|11:11] C:\Program Files\DivX
[21/04/2008|18:31] C:\Program Files\Dofus
[25/02/2009|15:01] C:\Program Files\eBay
[11/03/2009|14:40] C:\Program Files\Fichiers communs
[22/11/2008|21:21] C:\Program Files\FileZilla FTP Client
[22/11/2008|21:39] C:\Program Files\Gimp-2.0
[27/02/2009|22:19] C:\Program Files\Google
[10/05/2008|19:28] C:\Program Files\Gpotato.eu
[20/06/2008|20:32] C:\Program Files\IkAgora
[10/04/2009|00:04] C:\Program Files\InstallShield Installation Information
[14/04/2009|15:06] C:\Program Files\Internet Download Manager
[25/04/2009|16:47] C:\Program Files\Internet Explorer
[11/02/2009|09:33] C:\Program Files\Java
[23/03/2008|14:32] C:\Program Files\Lavalys
[10/04/2009|00:04] C:\Program Files\LG Electronics
[10/04/2009|00:06] C:\Program Files\LG PC Suite II
[24/03/2008|16:21] C:\Program Files\Logitech
[04/09/2008|03:08] C:\Program Files\Messenger
[20/06/2008|20:35] C:\Program Files\Messenger Plus! Live
[02/07/2008|21:56] C:\Program Files\Micro Application
[10/02/2009|23:37] C:\Program Files\Microsoft
[25/03/2008|23:41] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[23/03/2008|14:17] C:\Program Files\microsoft frontpage
[05/03/2009|00:53] C:\Program Files\Microsoft Silverlight
[10/02/2009|23:41] C:\Program Files\Microsoft SQL Server Compact Edition
[10/02/2009|23:43] C:\Program Files\Microsoft Sync Framework
[03/09/2008|23:14] C:\Program Files\Movie Maker
[13/05/2009|13:07] C:\Program Files\Mozilla Firefox
[29/12/2008|19:16] C:\Program Files\MSN
[23/03/2008|14:13] C:\Program Files\MSN Gaming Zone
[11/04/2009|03:01] C:\Program Files\MSXML 4.0
[03/09/2008|23:10] C:\Program Files\NetMeeting
[09/01/2009|19:06] C:\Program Files\Norton Security Scan
[20/06/2008|20:36] C:\Program Files\Notepad++
[10/01/2009|00:03] C:\Program Files\OneStepSrch
[29/03/2008|22:20] C:\Program Files\OpenOffice.org 2.4
[29/03/2008|22:13] C:\Program Files\OpenOffice.org 2.4 (fr)
[04/09/2008|03:08] C:\Program Files\Outlook Express
[24/03/2008|19:33] C:\Program Files\Photobie
[23/03/2008|15:28] C:\Program Files\Realtek Sound Manager
[14/04/2008|21:28] C:\Program Files\Rockstar Games
[29/03/2008|20:32] C:\Program Files\Romain's Software
[23/03/2008|14:15] C:\Program Files\Services en ligne
[26/04/2009|16:49] C:\Program Files\SFRWidget
[27/03/2009|01:45] C:\Program Files\smiley
[10/03/2009|09:50] C:\Program Files\Sony
[29/03/2008|18:41] C:\Program Files\Spybot - Search & Destroy
[09/01/2009|19:28] C:\Program Files\Stardock
[29/03/2008|16:06] C:\Program Files\Styler
[05/04/2008|14:43] C:\Program Files\TGTSoft
[29/03/2008|14:12] C:\Program Files\themexp
[13/05/2009|11:01] C:\Program Files\trend micro
[23/03/2008|14:24] C:\Program Files\Uninstall Information
[29/03/2008|01:33] C:\Program Files\UxTheme Multipatcher Fr
[04/07/2008|10:57] C:\Program Files\Veoh Networks
[29/03/2009|23:00] C:\Program Files\VideoLAN
[30/05/2008|20:13] C:\Program Files\weblin
[04/03/2009|00:49] C:\Program Files\Windows Live
[04/03/2009|00:39] C:\Program Files\Windows Live SkyDrive
[30/03/2008|19:57] C:\Program Files\Windows Media Connect 2
[03/09/2008|23:10] C:\Program Files\Windows Media Player
[03/09/2008|23:10] C:\Program Files\Windows NT
[23/03/2008|14:13] C:\Program Files\WindowsUpdate
[10/03/2009|10:12] C:\Program Files\WinRAR
[23/03/2008|14:17] C:\Program Files\xerox
[04/07/2008|10:59] C:\Program Files\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[28/07/2008|21:00] C:\Program Files\Fichiers communs\Adobe
[23/03/2008|19:20] C:\Program Files\Fichiers communs\Adobe Systems Shared
[24/03/2008|20:22] C:\Program Files\Fichiers communs\InstallShield
[24/03/2008|13:56] C:\Program Files\Fichiers communs\Java
[20/06/2008|20:31] C:\Program Files\Fichiers communs\LogiShrd
[04/03/2009|00:40] C:\Program Files\Fichiers communs\Microsoft Shared
[23/03/2008|14:14] C:\Program Files\Fichiers communs\MSSoap
[23/03/2008|14:40] C:\Program Files\Fichiers communs\ODBC
[23/03/2008|14:14] C:\Program Files\Fichiers communs\Services
[23/03/2008|14:40] C:\Program Files\Fichiers communs\SpeechEngines
[10/12/2008|04:41] C:\Program Files\Fichiers communs\Symantec Shared
[03/09/2008|23:10] C:\Program Files\Fichiers communs\System
[10/02/2009|23:09] C:\Program Files\Fichiers communs\Windows Live
[23/03/2008|17:04] C:\Program Files\Fichiers communs\WindowsLiveInstaller

--------------------\\ Process

( 39 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE


--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-13 13:50:19
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !

[F:3477][D:165]-> C:\DOCUME~1\Marc\LOCALS~1\Temp
[F:601][D:0]-> C:\DOCUME~1\Marc\Cookies
[F:5747][D:24]-> C:\DOCUME~1\Marc\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 13/05/2009|13:17 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 13/05/2009|13:55 - Option : [2]

--------------------\\ Fin du rapport a 13:55:06

je fais au plus vite mais il ne veut pas se fermer ou que je quitte je ne parviens pas à poster le rapport de droite, je me suis plantée quelque part ? je recommence ?
cat

voici le rapport :

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
File/Folder c:\documents and settings\marc\application data\eorezo\softwareupdate\softwareupdatehp.exe not found.
File/Folder c:\windows\system32\subapuzo.dll not found.
File/Folder c:\documents and settings\all users\application data\onestepsrch\onestep210.exe not found.
File/Folder C:\Documents and Settings\All Users\Application Data\OneStepSrch not found.
File/Folder c:\windows\system32\riwirinu.dll not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SoftwareHelper deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\"AppInit_DLLs"|"" /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\OneStepSrch Service\\ not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\Marc\LOCALS~1\Temp\etilqs_g8uOoX8OShutSHeSabC2 scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\Marc\Local Settings\Temporary Internet Files\Content.IE5\45BOP2GP\sha1auth[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Marc\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\_avast4_\unp224106649.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\_avast4_\unp31332327.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\hsperfdata_SYSTEM\208 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\ib2 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\ib3 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\ib4 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_178.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_464.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\Marc\Local Settings\Application Data\Mozilla\Firefox\Profiles\e04bg2s3.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Marc\Local Settings\Application Data\Mozilla\Firefox\Profiles\e04bg2s3.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Marc\Local Settings\Application Data\Mozilla\Firefox\Profiles\e04bg2s3.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Marc\Local Settings\Application Data\Mozilla\Firefox\Profiles\e04bg2s3.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Marc\Local Settings\Application Data\Mozilla\Firefox\Profiles\e04bg2s3.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Marc\Local Settings\Application Data\Mozilla\Firefox\Profiles\e04bg2s3.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 051

j'espère que c'est bien ça
cat

merci beaucoup, je ne pensais pas avoir de réponse si vite, je vais faire ce tu m'as indiqué, j'espère que ça n'est pas trop compliqué et qu'il suffit de suivre les indications malheureusement je n'ai plus d'imprimante et je devrai revenir sur ton message à chaque fois, ça n'est pas gênant de laisser ce site ouvert ?
merci encore
cathy

voici le 1er mais il est très long je poste le second dans un second message.
cathy
Logfile of random's system information tool 1.06 (written by random/random)
Run by Marc at 2009-05-13 11:01:31
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 8 GB (22%) free of 38 GB
Total RAM: 511 MB (25% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:01:58, on 13/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Documents and Settings\Marc\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\SFRWidget\WidgetSFR.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Documents and Settings\Marc\Bureau\RSIT.exe
C:\Program Files\trend micro\Marc.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.mozilla.org/en-US/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3b2a9d63-b56d-48b0-90d9-946cc3f0b6f8} - C:\WINDOWS\system32\dovanati.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [SoftwareHelper] C:\Documents and Settings\Marc\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
O4 - HKLM\..\Run: [CPMff407968] Rundll32.exe "c:\windows\system32\riwirinu.dll",a
O4 - HKLM\..\Run: [rutigugoze] Rundll32.exe "C:\WINDOWS\system32\silulotu.dll",s
O4 - HKLM\..\Run: [fc734af4] rundll32.exe "C:\WINDOWS\system32\jojesira.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Software Informer] "C:\Program Files\Software Informer\softinfo.exe" -autorun
O4 - HKCU\..\Run: [Microsoft Windows logon process] C:\Documents and Settings\Marc\Application Data\Microsoft\Windows\winlogon.exe
O4 - HKCU\..\Run: [Internet Antivirus Pro] "c:\program files\Internet Antivirus Pro\IAPro.exe" /s
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Widget SFR.lnk = C:\Program Files\SFRWidget\WidgetSFR.exe
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Lancement rapide d'Adobe Acrobat.lnk = ?
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{317147AC-3DD7-484B-AFAD-9EA7BC9BBFF3}: NameServer = 192.168.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{317147AC-3DD7-484B-AFAD-9EA7BC9BBFF3}: NameServer = 192.168.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{317147AC-3DD7-484B-AFAD-9EA7BC9BBFF3}: NameServer = 192.168.0.1
O20 - AppInit_DLLs: c:\windows\system32\riwirinu.dll,C:\WINDOWS\system32\subapuzo.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\riwirinu.dll (file missing)
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\riwirinu.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Update Service (gupdate1c9864366c9645e) (gupdate1c9864366c9645e) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Guard Service (ITGrdEngine) - Unknown owner - C:\Documents and Settings\Marc\Local Settings\Application Data\Microsoft\Windows\services.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: OneStepSrch Service - Unknown owner - C:\Documents and Settings\All Users\Application Data\OneStepSrch\onestep210.exe (file missing)

c'est vrai, merci encore, j'attends je ne reste pas loin
merci encore
cathy

bonsoir, je n'ai pas posté d'autre message, je suis sincèrement désolée mais une autre personne qui vit dans la même maison que moi a rencontré un problème de virus et je crois que c'est plutôt ces messages que tu as reçu, je fais entièrement confiance à la personne qui me donne des indications, d'ailleurs je les suis à la lettre, s'il y a une confusion, je n'y suis pour rien (nous sommes en réseau c'est peut-être pour ça)
merci
cordialement
cathy

le problème c'est que je ne le retrouve plus, le pc s'est éteint, peux-tu me dire où le trouver exactement ? c'est dans le bureau ?
désolée c'est vraiment bête de bloquer la dessus
cathy

re, je l'ai retrouvé voici le rapport :

Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2121
Windows 5.1.2600 Service Pack 3

13/05/2009 19:09:29
mbam-log-2009-05-13 (19-09-29).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 211140
Temps écoulé: 4 hour(s), 27 minute(s), 42 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 13
Valeur(s) du Registre infectée(s): 7
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 10

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3b2a9d63-b56d-48b0-90d9-946cc3f0b6f8} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3b2a9d63-b56d-48b0-90d9-946cc3f0b6f8} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{5b4c3b43-49b6-42a7-a602-f7acdca0d409} (Adware.OneStepSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ITGrdEngine (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\urlsearchhook.toolbarurlsearchhook (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\urlsearchhook.toolbarurlsearchhook.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\internet antivirus pro_is1 (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\WUSN.1 (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpmff407968 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rutigugoze (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fc734af4 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\internet antivirus pro (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows logon process (Malware.Trace) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Documents and Settings\Marc\Application Data\Internet Antivirus Pro (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Marc\Application Data\Internet Antivirus Pro\db (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\System Volume Information\_restore{9EB82246-5564-4126-8418-3C7507D1FDB2}\RP358\A0114357.exe (Malware.Tool) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9EB82246-5564-4126-8418-3C7507D1FDB2}\RP359\A0114445.exe (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Marc\Application Data\Internet Antivirus Pro\settings.ini (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Marc\Application Data\Internet Antivirus Pro\uill.ini (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Marc\Application Data\Internet Antivirus Pro\unins000.exe (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Marc\Application Data\Internet Antivirus Pro\Uninstall Internet Antivirus Pro.lnk (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Marc\Application Data\Internet Antivirus Pro\db\config.cfg (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Marc\Application Data\Internet Antivirus Pro\db\Timeout.inf (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Marc\Application Data\Internet Antivirus Pro\db\Urls.inf (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Marc\Local Settings\Application Data\Microsoft\Windows\pguard.ini (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.

y aura t-il d'autres choses à faire ? j'espère que j'ai fait ce qu'il fallait
merci encore
cathy

bonjour chimay8, es tu là ?
je t'ai envoyé le rapport hier mais je ne sais pas ce qu'il en est, par contre j'ai pu constaté que je pouvais retravailler sur ebay alors que depuis bientôt 1 semaine il y a plein de choses que je ne pouvais plus faire.
il va plus vite également mais je ne sais pas si c'est complètement parti
pourras-tu me renseigner stp ? d'autre part j'ai quelques questions à te poser sur les antivirus
merci encore pour tout
cathy

bonjour, voici le dernier rapport, si j'ai bien compris je recommence comme hier depuis le début sans télécharger ?
cathy
Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2121
Windows 5.1.2600 Service Pack 3

13/05/2009 19:09:29
mbam-log-2009-05-13 (19-09-29).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 211140
Temps écoulé: 4 hour(s), 27 minute(s), 42 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 13
Valeur(s) du Registre infectée(s): 7
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 10

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3b2a9d63-b56d-48b0-90d9-946cc3f0b6f8} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3b2a9d63-b56d-48b0-90d9-946cc3f0b6f8} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{5b4c3b43-49b6-42a7-a602-f7acdca0d409} (Adware.OneStepSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ITGrdEngine (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\urlsearchhook.toolbarurlsearchhook (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\urlsearchhook.toolbarurlsearchhook.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\internet antivirus pro_is1 (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\WUSN.1 (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpmff407968 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rutigugoze (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fc734af4 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\internet antivirus pro (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows logon process (Malware.Trace) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Documents and Settings\Marc\Application Data\Internet Antivirus Pro (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Marc\Application Data\Internet Antivirus Pro\db (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\System Volume Information\_restore{9EB82246-5564-4126-8418-3C7507D1FDB2}\RP358\A0114357.exe (Malware.Tool) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9EB82246-5564-4126-8418-3C7507D1FDB2}\RP359\A0114445.exe (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Marc\Application Data\Internet Antivirus Pro\settings.ini (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Marc\Application Data\Internet Antivirus Pro\uill.ini (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Marc\Application Data\Internet Antivirus Pro\unins000.exe (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Marc\Application Data\Internet Antivirus Pro\Uninstall Internet Antivirus Pro.lnk (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Marc\Application Data\Internet Antivirus Pro\db\config.cfg (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Marc\Application Data\Internet Antivirus Pro\db\Timeout.inf (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Marc\Application Data\Internet Antivirus Pro\db\Urls.inf (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Marc\Local Settings\Application Data\Microsoft\Windows\pguard.ini (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.

voici le rapport que je viens d'avoir en executant la même manoeuvre qu'hier du poste 1 :

Logfile of random's system information tool 1.06 (written by random/random)
Run by Marc at 2009-05-14 15:37:45
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 8 GB (21%) free of 38 GB
Total RAM: 511 MB (45% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:38:13, on 14/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Documents and Settings\Marc\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\SFRWidget\WidgetSFR.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\Documents and Settings\Marc\Bureau\RSIT.exe
C:\Program Files\trend micro\Marc.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [SoftwareHelper] C:\Documents and Settings\Marc\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Software Informer] "C:\Program Files\Software Informer\softinfo.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Widget SFR.lnk = C:\Program Files\SFRWidget\WidgetSFR.exe
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Lancement rapide d'Adobe Acrobat.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{317147AC-3DD7-484B-AFAD-9EA7BC9BBFF3}: NameServer = 192.168.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{317147AC-3DD7-484B-AFAD-9EA7BC9BBFF3}: NameServer = 192.168.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{317147AC-3DD7-484B-AFAD-9EA7BC9BBFF3}: NameServer = 192.168.0.1
O20 - AppInit_DLLs: c:\windows\system32\riwirinu.dll,C:\WINDOWS\system32\subapuzo.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Update Service (gupdate1c9864366c9645e) (gupdate1c9864366c9645e) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: OneStepSrch Service - Unknown owner - C:\Documents and Settings\All Users\Application Data\OneStepSrch\onestep210.exe (file missing)

bonjour, désolée, hier, je pensais que tu étais parti le soir justement donc j'ai du quitter mon pc juste avant ton dernier message, voici le rapport généré par hijackThis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:35:04, on 15/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\SFRWidget\WidgetSFR.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Marc\Bureau\HiJackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Software Informer] "C:\Program Files\Software Informer\softinfo.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Widget SFR.lnk = C:\Program Files\SFRWidget\WidgetSFR.exe
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Lancement rapide d'Adobe Acrobat.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://fichiers.touslesdrivers.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{317147AC-3DD7-484B-AFAD-9EA7BC9BBFF3}: NameServer = 192.168.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{317147AC-3DD7-484B-AFAD-9EA7BC9BBFF3}: NameServer = 192.168.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{317147AC-3DD7-484B-AFAD-9EA7BC9BBFF3}: NameServer = 192.168.0.1
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Update Service (gupdate1c9864366c9645e) (gupdate1c9864366c9645e) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

bonjour, j'ai vu ton message et j'ai fait ce patin ce que tu m'as demandé de faire avec hijack, j'ai bien compris ce que tu disais sur les antivirus, apparemment de nombreuses personnes sur ce site pensent la même chose que toi.
par contre je conserve tout ce tu m'as fait téléchargé je suppose ?
et nous avons fini c'est bien ça ?
merci pour tout en tous les cas, j'ai vraiment été bien aidée, la propriétaire de la maison m'a dit qu'il suffisait de reformater le pc et qu'en 2 heures c'était parti mais sans même savoir ce que j'avais exactement, j'ai préféré t'écouter et de plus cela m'a appris des choses, merci vraiment !
à bientôt peut-être
cathy

merci encore,
voici le rapport de toolcleaner :

[ Rapport ToolsCleaner version 2.2.3 (par A.Rothstein & dj QUIOU) ]

-->- Recherche:

C:\lopR.txt: trouvé !
C:\Lop SD: trouvé !
C:\_OtMoveIt: trouvé !
C:\Documents and Settings\Marc\Bureau\LopSD.exe: trouvé !
C:\Documents and Settings\Marc\Bureau\HijackThis.exe: trouvé !
C:\Documents and Settings\Marc\Bureau\hijackthis.log: trouvé !
C:\Program Files\Mozilla Firefox\SmitFraudfix: trouvé !
C:\Program Files\trend micro\HijackThis.exe: trouvé !
C:\Program Files\trend micro\hijackthis.log: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\Marc\Bureau\LopSD.exe: supprimé !
C:\Documents and Settings\Marc\Bureau\HijackThis.exe: supprimé !
C:\Program Files\trend micro\HijackThis.exe: supprimé !
C:\lopR.txt: supprimé !
C:\Documents and Settings\Marc\Bureau\hijackthis.log: supprimé !
C:\Program Files\trend micro\hijackthis.log: supprimé !
C:\Lop SD: supprimé !
C:\_OtMoveIt: supprimé !
C:\Program Files\Mozilla Firefox\SmitFraudfix: supprimé !

Corbeille vidée!

je continue !

alors, normalement tout est bon mais je ne parviens pas à cocher ou décocher "desactiver la restauration systeme".
il reste décoché et on ne peut rien y changer.
je peux donc classer comme résolu ?
merci encore pour tout c'est vraiement sympa d'avoir pris tout ce temps pour m'aider, tu m'as été d'un grand secours.
ps : la personne qui possède l'ordinateur principal ds cette maison et qui voulait que je reformate a un disque dur externe qu'elle m'a déjà prêté et elle télécharge des films, un des problèmes a pu survenir de là ?
merci encore
cathy

bonjour, merci pour toute ton aide, je n'ai plus la possibilité de cocher résolu ou non les cases n'y sont pas, je ne comprends pas, je vais voir si je suis bien connectée au site, je viens juste d'y penser
merci encore pour tout
cathy
ps : je vais suivre tes conseils
merci vraiment

je t'ai envoyé le rapport, tu ne l'as pas reçu ? de plus je ne sais pas si je peux fermer les 3 bloc notes et usbfix ?
j'ai oublié de te dire que dans cette maison on est en réseau et il y a pas mal de pc auxquels je n'ai malheureusement pas accès
merci encore pour ton aide
cathy

voici la suite :

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Celeron(R) CPU 1.70GHz )
BIOS : BIOS Date: 02/26/03 13:28:24 Ver: 08.00.07
USER : Marc ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 090512-0] 4.8.1229 (Activated)
C:\ (Local Disk) - NTFS - Total:37 Go (Free:7 Go)
D:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 13/05/2009|13:08 )

--------------------\\ Listing des dossiers dans APPLIC~1

[28/03/2008|19:53] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

[09/04/2008|18:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[23/03/2008|19:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems
[12/04/2008|20:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[29/03/2008|18:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
[25/02/2009|12:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\eBay
[19/08/2008|19:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[13/05/2009|10:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
[24/03/2008|16:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logishrd
[24/03/2008|16:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
[04/03/2009|00:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[29/12/2008|17:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
[23/03/2008|14:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
[12/05/2009|20:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\OneStepSrch
[13/04/2009|11:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[25/02/2009|10:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WholeSecurity
[23/03/2008|15:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[29/03/2008|13:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
[23/03/2008|17:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[12/07/2008|16:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom



[25/03/2008|23:41] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[23/03/2008|17:29] C:\DOCUME~1\INVIT~1\APPLIC~1\Microsoft

[03/06/2008|19:49] C:\DOCUME~1\INVIT~1.CAL\APPLIC~1\Adobe
[03/06/2008|19:47] C:\DOCUME~1\INVIT~1.CAL\APPLIC~1\Apple Computer
[03/06/2008|18:01] C:\DOCUME~1\INVIT~1.CAL\APPLIC~1\Identities
[03/06/2008|19:49] C:\DOCUME~1\INVIT~1.CAL\APPLIC~1\Macromedia
[03/06/2008|21:16] C:\DOCUME~1\INVIT~1.CAL\APPLIC~1\Microsoft
[03/06/2008|19:52] C:\DOCUME~1\INVIT~1.CAL\APPLIC~1\Mozilla

[23/03/2008|14:21] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[22/11/2008|22:27] C:\DOCUME~1\LOCALS~1\APPLIC~1\Mozilla

[24/02/2009|21:14] C:\DOCUME~1\Marc\APPLIC~1\Adobe
[21/06/2008|13:21] C:\DOCUME~1\Marc\APPLIC~1\AdobeUM
[12/02/2009|17:04] C:\DOCUME~1\Marc\APPLIC~1\DivX
[14/04/2009|14:54] C:\DOCUME~1\Marc\APPLIC~1\DMCache
[05/05/2009|23:32] C:\DOCUME~1\Marc\APPLIC~1\dvdcss
[16/02/2009|11:07] C:\DOCUME~1\Marc\APPLIC~1\eBay
[08/03/2009|01:15] C:\DOCUME~1\Marc\APPLIC~1\EoRezo
[23/11/2008|16:50] C:\DOCUME~1\Marc\APPLIC~1\FileZilla
[03/02/2009|23:11] C:\DOCUME~1\Marc\APPLIC~1\Google
[03/03/2009|02:06] C:\DOCUME~1\Marc\APPLIC~1\gtk-2.0
[18/02/2009|03:23] C:\DOCUME~1\Marc\APPLIC~1\Help
[25/04/2009|16:48] C:\DOCUME~1\Marc\APPLIC~1\Icone
[20/06/2008|20:48] C:\DOCUME~1\Marc\APPLIC~1\Identities
[14/04/2009|15:03] C:\DOCUME~1\Marc\APPLIC~1\IDM
[10/03/2009|09:46] C:\DOCUME~1\Marc\APPLIC~1\InstallShield
[25/02/2009|14:59] C:\DOCUME~1\Marc\APPLIC~1\Internet Antivirus Pro
[10/04/2009|00:01] C:\DOCUME~1\Marc\APPLIC~1\LG Electronics
[05/03/2009|07:53] C:\DOCUME~1\Marc\APPLIC~1\LimeWire
[20/06/2008|20:52] C:\DOCUME~1\Marc\APPLIC~1\Macromedia
[16/04/2009|17:02] C:\DOCUME~1\Marc\APPLIC~1\Microsoft
[26/08/2008|22:02] C:\DOCUME~1\Marc\APPLIC~1\Mozilla
[04/04/2009|21:05] C:\DOCUME~1\Marc\APPLIC~1\MSN6
[13/05/2009|10:22] C:\DOCUME~1\Marc\APPLIC~1\OpenOffice.org2
[24/07/2008|20:57] C:\DOCUME~1\Marc\APPLIC~1\Real
[10/03/2009|10:18] C:\DOCUME~1\Marc\APPLIC~1\Sony Corporation
[24/06/2008|18:55] C:\DOCUME~1\Marc\APPLIC~1\Sun
[29/03/2009|23:07] C:\DOCUME~1\Marc\APPLIC~1\vlc
[05/04/2009|18:17] C:\DOCUME~1\Marc\APPLIC~1\Windows Live Writer
[24/06/2008|21:23] C:\DOCUME~1\Marc\APPLIC~1\WinRAR
[29/06/2008|00:46] C:\DOCUME~1\Marc\APPLIC~1\Yahoo!

[25/03/2008|23:40] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[13/05/2009 12:52][--a------] C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job
[13/05/2009 12:52][--a------] C:\WINDOWS\tasks\Google Software Updater.job
[10/05/2009 18:00][--a------] C:\WINDOWS\tasks\Norton Security Scan.job
[13/05/2009 12:52][--ah-----] C:\WINDOWS\tasks\SA.DAT
[30/08/2002 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[05/03/2009|00:50] C:\Program Files\ACE Mega CoDecS Pack
[23/03/2008|19:36] C:\Program Files\Adobe
[21/06/2008|14:51] C:\Program Files\Alwil Software
[23/03/2008|15:28] C:\Program Files\AvRack
[20/06/2008|20:28] C:\Program Files\CamStudio
[13/04/2009|11:11] C:\Program Files\DivX
[21/04/2008|18:31] C:\Program Files\Dofus
[25/02/2009|15:01] C:\Program Files\eBay
[11/03/2009|14:40] C:\Program Files\Fichiers communs
[22/11/2008|21:21] C:\Program Files\FileZilla FTP Client
[22/11/2008|21:39] C:\Program Files\Gimp-2.0
[27/02/2009|22:19] C:\Program Files\Google
[10/05/2008|19:28] C:\Program Files\Gpotato.eu
[20/06/2008|20:32] C:\Program Files\IkAgora
[10/04/2009|00:04] C:\Program Files\InstallShield Installation Information
[14/04/2009|15:06] C:\Program Files\Internet Download Manager
[25/04/2009|16:47] C:\Program Files\Internet Explorer
[11/02/2009|09:33] C:\Program Files\Java
[23/03/2008|14:32] C:\Program Files\Lavalys
[10/04/2009|00:04] C:\Program Files\LG Electronics
[10/04/2009|00:06] C:\Program Files\LG PC Suite II
[24/03/2008|16:21] C:\Program Files\Logitech
[04/09/2008|03:08] C:\Program Files\Messenger
[20/06/2008|20:35] C:\Program Files\Messenger Plus! Live
[02/07/2008|21:56] C:\Program Files\Micro Application
[10/02/2009|23:37] C:\Program Files\Microsoft
[25/03/2008|23:41] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[23/03/2008|14:17] C:\Program Files\microsoft frontpage
[05/03/2009|00:53] C:\Program Files\Microsoft Silverlight
[10/02/2009|23:41] C:\Program Files\Microsoft SQL Server Compact Edition
[10/02/2009|23:43] C:\Program Files\Microsoft Sync Framework
[03/09/2008|23:14] C:\Program Files\Movie Maker
[13/05/2009|13:07] C:\Program Files\Mozilla Firefox
[29/12/2008|19:16] C:\Program Files\MSN
[23/03/2008|14:13] C:\Program Files\MSN Gaming Zone
[11/04/2009|03:01] C:\Program Files\MSXML 4.0
[03/09/2008|23:10] C:\Program Files\NetMeeting
[09/01/2009|19:06] C:\Program Files\Norton Security Scan
[20/06/2008|20:36] C:\Program Files\Notepad++
[10/01/2009|00:03] C:\Program Files\OneStepSrch
[29/03/2008|22:20] C:\Program Files\OpenOffice.org 2.4
[29/03/2008|22:13] C:\Program Files\OpenOffice.org 2.4 (fr)
[04/09/2008|03:08] C:\Program Files\Outlook Express
[24/03/2008|19:33] C:\Program Files\Photobie
[23/03/2008|15:28] C:\Program Files\Realtek Sound Manager
[14/04/2008|21:28] C:\Program Files\Rockstar Games
[29/03/2008|20:32] C:\Program Files\Romain's Software
[23/03/2008|14:15] C:\Program Files\Services en ligne
[26/04/2009|16:49] C:\Program Files\SFRWidget
[27/03/2009|01:45] C:\Program Files\smiley
[10/03/2009|09:50] C:\Program Files\Sony
[29/03/2008|18:41] C:\Program Files\Spybot - Search & Destroy
[09/01/2009|19:28] C:\Program Files\Stardock
[29/03/2008|16:06] C:\Program Files\Styler
[05/04/2008|14:43] C:\Program Files\TGTSoft
[29/03/2008|14:12] C:\Program Files\themexp
[13/05/2009|11:01] C:\Program Files\trend micro
[23/03/2008|14:24] C:\Program Files\Uninstall Information
[29/03/2008|01:33] C:\Program Files\UxTheme Multipatcher Fr
[04/07/2008|10:57] C:\Program Files\Veoh Networks
[29/03/2009|23:00] C:\Program Files\VideoLAN
[30/05/2008|20:13] C:\Program Files\weblin
[04/03/2009|00:49] C:\Program Files\Windows Live
[04/03/2009|00:39] C:\Program Files\Windows Live SkyDrive
[30/03/2008|19:57] C:\Program Files\Windows Media Connect 2
[03/09/2008|23:10] C:\Program Files\Windows Media Player
[03/09/2008|23:10] C:\Program Files\Windows NT
[23/03/2008|14:13] C:\Program Files\WindowsUpdate
[10/03/2009|10:12] C:\Program Files\WinRAR
[23/03/2008|14:17] C:\Program Files\xerox
[04/07/2008|10:59] C:\Program Files\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[28/07/2008|21:00] C:\Program Files\Fichiers communs\Adobe
[23/03/2008|19:20] C:\Program Files\Fichiers communs\Adobe Systems Shared
[24/03/2008|20:22] C:\Program Files\Fichiers communs\InstallShield
[24/03/2008|13:56] C:\Program Files\Fichiers communs\Java
[20/06/2008|20:31] C:\Program Files\Fichiers communs\LogiShrd
[04/03/2009|00:40] C:\Program Files\Fichiers communs\Microsoft Shared
[23/03/2008|14:14] C:\Program Files\Fichiers communs\MSSoap
[23/03/2008|14:40] C:\Program Files\Fichiers communs\ODBC
[23/03/2008|14:14] C:\Program Files\Fichiers communs\Services
[23/03/2008|14:40] C:\Program Files\Fichiers communs\SpeechEngines
[10/12/2008|04:41] C:\Program Files\Fichiers communs\Symantec Shared
[03/09/2008|23:10] C:\Program Files\Fichiers communs\System
[10/02/2009|23:09] C:\Program Files\Fichiers communs\Windows Live
[23/03/2008|17:04] C:\Program Files\Fichiers communs\WindowsLiveInstaller

--------------------\\ Process

( 38 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\Marc\LOCALS~1\Temp\nsw10E.tmp
C:\DOCUME~1\Marc\Cookies\marc@advertising[2].txt
C:\DOCUME~1\Marc\Cookies\marc@adopt.euroclick[2].txt

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE


--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-13 13:12:04
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !

[F:3481][D:166]-> C:\DOCUME~1\Marc\LOCALS~1\Temp
[F:603][D:0]-> C:\DOCUME~1\Marc\Cookies
[F:5747][D:24]-> C:\DOCUME~1\Marc\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 13/05/2009|13:17 - Option : [1]

--------------------\\ Fin du rapport a 13:17:08
normalement j'attends maintenant, merci
cat

bonsoir, apparemment oui mais je laisse le temps à chimay8 de les analyser, ce doit être long, il y a du boulot, je vais certainement avoir une réponse demain
cordialement
cathy