Gros probléme pc!,mon rappoert est il clean??

salut

de quel rapport tu parle ? poste le deja ou fait ceci :

* Télécharge Random's system information tool (RSIT) et enregistre le sur ton bureau.
http://images.malwareremoval.com/random/RSIT.exe
* Double clique sur RSIT.exe pour lancer l'outil.
* Clique sur ' continue ' à l'écran Disclaimer.
* Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.
* Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports.

( C:\RSIT\log.txt & C:\RSIT\info.txt )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

pardon voici mon rapport...............

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:05:29, on 18/09/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Evidence Eliminator\Ee.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Trend Micro\HijackThis\best.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Steganos Password Manager AutoFill - {1427A821-7B93-4F08-9A34-9FA03A3D93DB} - C:\Program Files\Steganos Security Suite 2007\PasswordManagerBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [Evidence Eliminator] C:\Program Files\Evidence Eliminator\ee.exe /m
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: acaptuser32.dll
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - QLogic Corporation - (no file)
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - QLogic Corporation - (no file)
O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Program Files\Advanced Registry Doctor\RegManServ.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\System32\ZoneLabs\vsmon.exe

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:05:29, on 18/09/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Evidence Eliminator\Ee.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Trend Micro\HijackThis\best.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Steganos Password Manager AutoFill - {1427A821-7B93-4F08-9A34-9FA03A3D93DB} - C:\Program Files\Steganos Security Suite 2007\PasswordManagerBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [Evidence Eliminator] C:\Program Files\Evidence Eliminator\ee.exe /m
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: acaptuser32.dll
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - QLogic Corporation - (no file)
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - QLogic Corporation - (no file)
O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Program Files\Advanced Registry Doctor\RegManServ.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\System32\ZoneLabs\vsmon.exe

re

tu as quoi comme probleme exactement ?

va dans le panneau de configuration et desinstalle :

Evidence Eliminator

ensuite poste le rapport RSIT que j'ai demandé au poste 1 stp

voici le rapport .... Merci

Logfile of random's system information tool 1.06 (written by random/random)
Run by alexdiane at 2009-09-18 10:56:52
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 2
System drive C: has 64 GB (46%) free of 141 GB
Total RAM: 2046 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:57:21, on 18/09/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\alexdiane\Documents\Downloads\Programs\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\alexdiane.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Steganos Password Manager AutoFill - {1427A821-7B93-4F08-9A34-9FA03A3D93DB} - C:\Program Files\Steganos Security Suite 2007\PasswordManagerBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [Evidence Eliminator] C:\Program Files\Evidence Eliminator\ee.exe /m
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: acaptuser32.dll
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - QLogic Corporation - (no file)
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - QLogic Corporation - (no file)
O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Program Files\Advanced Registry Doctor\RegManServ.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\System32\ZoneLabs\vsmon.exe

peut tu repondre a mes questions....

qu'as tu comme probleme ?

tu n'as pas desinstaller :

Evidence Eliminator

clic ici https://www.virustotal.com/gui/
et clic sur parourir en milieu de page dans la nouvelle fentre tu copie colle la ligne ci dessous et clic sir ouvrir puis envoyer.
un rapport va s'etablir copie colle le ici en entier avec le nom du fichier en entete

fait sa avec :

C:\Windows\system32\rotscxxfvvcnic.dll
C:\Windows\system32\rotscxukfpxvrb.dll

il y a 2 ou 3 trcu a supprimer dans ton log, on s'en charge dès que tu reponds a mes questions et poste les rapports demandés

voila je suis de retour ,encore merci....

Srpski | Македонски | العربية | Suomi | ihMdI | | עברית | | Slovenščina | Dansk | Русский | Română | Türkçe | Nederlands | Ελληνικά | Svenska | Português | Italiano | | | Magyar | Deutsch | Česky | Polski | Español | English
Virus Total
Virustotal est un service qui analyse les fichiers suspects et facilite la détection rapide des virus, vers, chevaux de Troie et toutes sortes de malwares détectés par les moteurs antivirus. Plus d'informations...
Fichier 77EB16EE001178ABB2E400D105F8EF00A95B04F4.dll reçu le 2009.09.06 11:36:56 (UTC)
Situation actuelle: terminé
Résultat: 6/41 (14.63%)
Formaté Formaté
Impression des résultats Impression des résultats
Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.24 2009.09.06 -
AhnLab-V3 5.0.0.2 2009.09.05 -
AntiVir 7.9.1.8 2009.09.06 -
Antiy-AVL 2.0.3.7 2009.09.04 -
Authentium 5.1.2.4 2009.09.05 -
Avast 4.8.1351.0 2009.09.05 Win32:Alureon-CW
AVG 8.5.0.409 2009.09.06 Win32/Rustock.Q
BitDefender 7.2 2009.09.06 -
CAT-QuickHeal 10.00 2009.09.05 -
ClamAV 0.94.1 2009.09.06 -
Comodo 2196 2009.09.06 -
DrWeb 5.0.0.12182 2009.09.06 -
eSafe 7.0.17.0 2009.09.03 -
eTrust-Vet 31.6.6721 2009.09.04 -
F-Prot 4.5.1.85 2009.09.05 -
F-Secure 8.0.14470.0 2009.09.06 -
Fortinet 3.120.0.0 2009.09.06 -
GData 19 2009.09.06 Win32:Alureon-CW
Ikarus T3.1.1.72.0 2009.09.06 -
Jiangmin 11.0.800 2009.09.06 -
K7AntiVirus 7.10.837 2009.09.05 -
Kaspersky 7.0.0.125 2009.09.06 Packed.Win32.TDSS.z
McAfee 5732 2009.09.05 -
McAfee+Artemis 5732 2009.09.05 -
McAfee-GW-Edition 6.8.5 2009.09.06 -
Microsoft 1.5005 2009.09.06 Trojan:Win32/Alureon.gen!U
NOD32 4399 2009.09.05 -
Norman 6.01.09 2009.09.04 -
nProtect 2009.1.8.0 2009.09.06 -
Panda 10.0.2.2 2009.09.06 -
PCTools 4.4.2.0 2009.09.04 -
Prevx 3.0 2009.09.06 High Risk Rootkit
Rising 21.45.14.00 2009.09.01 -
Sophos 4.45.0 2009.09.06 -
Sunbelt 3.2.1858.2 2009.09.05 -
Symantec 1.4.4.12 2009.09.06 -
TheHacker 6.3.4.3.396 2009.09.04 -
TrendMicro 8.950.0.1094 2009.09.05 -
VBA32 3.12.10.10 2009.09.05 -
ViRobot 2009.9.4.1919 2009.09.04 -
VirusBuster 4.6.5.0 2009.09.05 -
Information additionnelle
File size: 45568 bytes
MD5 : 562d5d9fcf5be8a2b88e2026ccb59a6c
SHA1 : 3d19cac477a294dcff1da5094a8eb4786f44f12e
SHA256: 61dbc7b47b6e16ea56a7e1ffb8c570e37e4ce45627ed5925686ba5fbe499379b
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1632
timedatestamp.....: 0x4A9BC9EE (Mon Aug 31 15:02:38 2009)
machinetype.......: 0x14C (Intel I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x3070 0x3200 7.41 9dec78f8bb5b6d22a81d9b09abd3491a
.rdata 0x5000 0x2A50 0x2C00 7.49 85bc5eeceb48d24946a00c5cd6dfac8c
.data 0x8000 0x22B7 0x2400 7.74 30f281f0cc53792b3c1f644bed7c9519
.rsrc 0xB000 0x28CB 0x2A00 7.48 378b078079c52a27d777c01df4e69c96
.reloc 0xE000 0x36 0x200 0.83 4e7b24ccd5522e7f06caecf8bd5151e7

( 5 imports )

> comdlg32.dll: LoadAlterBitmap, Ssync_ANSI_UNICODE_Struct_For_WOW, CommDlgExtendedError, FindTextA, PageSetupDlgA, GetOpenFileNameA, PrintDlgA, GetFileTitleW
> kernel32.dll: CreateDirectoryA, GetProcAddress, GetSystemDefaultLCID, SetCurrentDirectoryW, GetLongPathNameA, DosDateTimeToFileTime, GetEnvironmentVariableA, FreeLibraryAndExitThread, VirtualFree, GetLastError, GetCurrentProcess, GetLocaleInfoA, EraseTape, AddAtomA, GetTempPathA, GetVersionExW, CallNamedPipeA, VerLanguageNameW, FindResourceA, FindFirstFileExW, GetProcessHeap, GetComputerNameA, GetStartupInfoW, GetFileSize, DeleteFiber, HeapDestroy, GetFileType, VirtualAlloc, SetFileTime, MoveFileExA, CreateSemaphoreA
> msvcrt.dll: __crtLCMapStringA, _tolower, ___7bad_typeid@@6B@, _wexecv, _fstati64, _terminate@@YAXXZ, atoi, memcpy, _fstat, __0bad_cast@@QAE@ABV0@@Z, rand, atan, __set_new_mode@@YAHH@Z, _getws, __p__fileinfo, sscanf
> opengl32.dll: glFrustum, GlmfEndGlsBlock, glFogi, glVertex3sv, glPixelTransferi, glEdgeFlagv, glIndexPointer, glGetIntegerv, glVertex3f, glGetTexParameterfv, wglDeleteContext, glVertex2iv, glTexCoord3iv
> winmm.dll: midiInGetNumDevs, DrvGetModuleHandle, mmioSeek, joySetThreshold, auxOutMessage, midiOutOpen, midiOutGetDevCapsW, midiInPrepareHeader, DriverCallback

( 1 exports )

> RvhooaHx, OoiEzgrqoOersrf, RngQvot, BwhCkuzsGyzfqi, ZjclvjlBu
TrID : File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
ssdeep: 768:cYUS2m6/3dFJc8SDuqQj/TFQJTeY1WSJpEbqCs4q9NbkNwJLl+xCRHfMMJw:cYUbJvLJc8SDuqQj/TOgSTRNbR+xCR/M
Prevx Info: http://info.prevx.com/aboutprogramtext.asp?PX5=77EB16EE001178ABB2E400D105F8EF00A95B04F4
PEiD : -
RDS : NSRL Reference Data Set
-

ATENTION ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.

Autre fichier

voici le second.... je suis infecté!!!

Srpski | Македонски | العربية | Suomi | ihMdI | | עברית | | Slovenščina | Dansk | Русский | Română | Türkçe | Nederlands | Ελληνικά | Svenska | Português | Italiano | | | Magyar | Deutsch | Česky | Polski | Español | English
Virus Total
Virustotal est un service qui analyse les fichiers suspects et facilite la détection rapide des virus, vers, chevaux de Troie et toutes sortes de malwares détectés par les moteurs antivirus. Plus d'informations...
Fichier 77EB16EE001178ABB2E400D105F8EF00A95B04F4.dll reçu le 2009.09.06 11:36:56 (UTC)
Situation actuelle: terminé
Résultat: 6/41 (14.63%)
Formaté Formaté
Impression des résultats Impression des résultats
Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.24 2009.09.06 -
AhnLab-V3 5.0.0.2 2009.09.05 -
AntiVir 7.9.1.8 2009.09.06 -
Antiy-AVL 2.0.3.7 2009.09.04 -
Authentium 5.1.2.4 2009.09.05 -
Avast 4.8.1351.0 2009.09.05 Win32:Alureon-CW
AVG 8.5.0.409 2009.09.06 Win32/Rustock.Q
BitDefender 7.2 2009.09.06 -
CAT-QuickHeal 10.00 2009.09.05 -
ClamAV 0.94.1 2009.09.06 -
Comodo 2196 2009.09.06 -
DrWeb 5.0.0.12182 2009.09.06 -
eSafe 7.0.17.0 2009.09.03 -
eTrust-Vet 31.6.6721 2009.09.04 -
F-Prot 4.5.1.85 2009.09.05 -
F-Secure 8.0.14470.0 2009.09.06 -
Fortinet 3.120.0.0 2009.09.06 -
GData 19 2009.09.06 Win32:Alureon-CW
Ikarus T3.1.1.72.0 2009.09.06 -
Jiangmin 11.0.800 2009.09.06 -
K7AntiVirus 7.10.837 2009.09.05 -
Kaspersky 7.0.0.125 2009.09.06 Packed.Win32.TDSS.z
McAfee 5732 2009.09.05 -
McAfee+Artemis 5732 2009.09.05 -
McAfee-GW-Edition 6.8.5 2009.09.06 -
Microsoft 1.5005 2009.09.06 Trojan:Win32/Alureon.gen!U
NOD32 4399 2009.09.05 -
Norman 6.01.09 2009.09.04 -
nProtect 2009.1.8.0 2009.09.06 -
Panda 10.0.2.2 2009.09.06 -
PCTools 4.4.2.0 2009.09.04 -
Prevx 3.0 2009.09.06 High Risk Rootkit
Rising 21.45.14.00 2009.09.01 -
Sophos 4.45.0 2009.09.06 -
Sunbelt 3.2.1858.2 2009.09.05 -
Symantec 1.4.4.12 2009.09.06 -
TheHacker 6.3.4.3.396 2009.09.04 -
TrendMicro 8.950.0.1094 2009.09.05 -
VBA32 3.12.10.10 2009.09.05 -
ViRobot 2009.9.4.1919 2009.09.04 -
VirusBuster 4.6.5.0 2009.09.05 -
Information additionnelle
File size: 45568 bytes
MD5 : 562d5d9fcf5be8a2b88e2026ccb59a6c
SHA1 : 3d19cac477a294dcff1da5094a8eb4786f44f12e
SHA256: 61dbc7b47b6e16ea56a7e1ffb8c570e37e4ce45627ed5925686ba5fbe499379b
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1632
timedatestamp.....: 0x4A9BC9EE (Mon Aug 31 15:02:38 2009)
machinetype.......: 0x14C (Intel I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x3070 0x3200 7.41 9dec78f8bb5b6d22a81d9b09abd3491a
.rdata 0x5000 0x2A50 0x2C00 7.49 85bc5eeceb48d24946a00c5cd6dfac8c
.data 0x8000 0x22B7 0x2400 7.74 30f281f0cc53792b3c1f644bed7c9519
.rsrc 0xB000 0x28CB 0x2A00 7.48 378b078079c52a27d777c01df4e69c96
.reloc 0xE000 0x36 0x200 0.83 4e7b24ccd5522e7f06caecf8bd5151e7

( 5 imports )

> comdlg32.dll: LoadAlterBitmap, Ssync_ANSI_UNICODE_Struct_For_WOW, CommDlgExtendedError, FindTextA, PageSetupDlgA, GetOpenFileNameA, PrintDlgA, GetFileTitleW
> kernel32.dll: CreateDirectoryA, GetProcAddress, GetSystemDefaultLCID, SetCurrentDirectoryW, GetLongPathNameA, DosDateTimeToFileTime, GetEnvironmentVariableA, FreeLibraryAndExitThread, VirtualFree, GetLastError, GetCurrentProcess, GetLocaleInfoA, EraseTape, AddAtomA, GetTempPathA, GetVersionExW, CallNamedPipeA, VerLanguageNameW, FindResourceA, FindFirstFileExW, GetProcessHeap, GetComputerNameA, GetStartupInfoW, GetFileSize, DeleteFiber, HeapDestroy, GetFileType, VirtualAlloc, SetFileTime, MoveFileExA, CreateSemaphoreA
> msvcrt.dll: __crtLCMapStringA, _tolower, ___7bad_typeid@@6B@, _wexecv, _fstati64, _terminate@@YAXXZ, atoi, memcpy, _fstat, __0bad_cast@@QAE@ABV0@@Z, rand, atan, __set_new_mode@@YAHH@Z, _getws, __p__fileinfo, sscanf
> opengl32.dll: glFrustum, GlmfEndGlsBlock, glFogi, glVertex3sv, glPixelTransferi, glEdgeFlagv, glIndexPointer, glGetIntegerv, glVertex3f, glGetTexParameterfv, wglDeleteContext, glVertex2iv, glTexCoord3iv
> winmm.dll: midiInGetNumDevs, DrvGetModuleHandle, mmioSeek, joySetThreshold, auxOutMessage, midiOutOpen, midiOutGetDevCapsW, midiInPrepareHeader, DriverCallback

( 1 exports )

> RvhooaHx, OoiEzgrqoOersrf, RngQvot, BwhCkuzsGyzfqi, ZjclvjlBu
TrID : File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
ssdeep: 768:cYUS2m6/3dFJc8SDuqQj/TFQJTeY1WSJpEbqCs4q9NbkNwJLl+xCRHfMMJw:cYUbJvLJc8SDuqQj/TOgSTRNbR+xCR/M
Prevx Info: http://info.prevx.com/aboutprogramtext.asp?PX5=77EB16EE001178ABB2E400D105F8EF00A95B04F4
PEiD : -
RDS : NSRL Reference Data Set
-

ATENTION ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.

Autre fichier
VirusTotal © Hispasec Sistemas - Blog - Contact: info@virustotal.com - Terms of Service & Privacy Policy

c'est dingue rootkit buster ne vois rien, nod 32 ne vois rien, trojan remover ne voit rien!!! et le rapport hijack this ne paraissait pas infecté!!! je ne comprend pas????

salut

normal que l'infection etait pas trés visible c'est un rootkit, qui ne se voit pas ou peut dans les rapport et n'est pas ou trés peu detecté par les antivirus (comme tu vois sur les rapport virus total) mais cela ne suffit pas

clic droit sur le lien ci dessous et choisit "enregsitré la cible du lien sous"
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

tu enregsitre le fichier sur ton BUREAU, et tu le renomme en ton prenom

puis deconnecte toi d'internet et DESACTIVE ton antivirus, lance le fichier et ne touche + a rien jusqu' a la fin et poste le rapport

puis

* Télécharge Malwarebytes
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
* Fais la mise à jour du logiciel (elle se fait normalement à l'installation)
* Lance une analyse complète en cliquant sur "Exécuter un examen complet"
* Sélectionnes les disques que tu veux analyser et cliques sur "Lancer l'examen"
* L'analyse peut durer un bon moment.....
* Une fois l'analyse terminée, cliques sur "OK" puis sur "Afficher les résultats"
* Vérifies que tout est bien coché et cliques sur "Supprimer la sélection" => et ensuite sur "OK"
* Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum

* Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC... Faites le en cliquant sur "oui" à la question posée

encore merci de prendre du temps pour moi...

Logfile of random's system information tool 1.06 (written by random/random)
Run by alexdiane at 2009-09-18 17:46:16
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 2
System drive C: has 64 GB (46%) free of 141 GB
Total RAM: 2046 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:46:21, on 18/09/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Internet Explorer\IELowutil.exe
C:\Windows\system32\msfeedssync.exe
C:\Users\alexdiane\Desktop\alexdiane.exe
C:\Program Files\Trend Micro\HijackThis\alexdiane.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Steganos Password Manager AutoFill - {1427A821-7B93-4F08-9A34-9FA03A3D93DB} - C:\Program Files\Steganos Security Suite 2007\PasswordManagerBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: acaptuser32.dll
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - QLogic Corporation - (no file)
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - QLogic Corporation - (no file)
O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Program Files\Advanced Registry Doctor\RegManServ.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\System32\ZoneLabs\vsmon.exe

encore merci de prndre du temps pour m'aider........

Logfile of random's system information tool 1.06 (written by random/random)
Run by alexdiane at 2009-09-18 17:46:16
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 2
System drive C: has 64 GB (46%) free of 141 GB
Total RAM: 2046 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:46:21, on 18/09/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Internet Explorer\IELowutil.exe
C:\Windows\system32\msfeedssync.exe
C:\Users\alexdiane\Desktop\alexdiane.exe
C:\Program Files\Trend Micro\HijackThis\alexdiane.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Steganos Password Manager AutoFill - {1427A821-7B93-4F08-9A34-9FA03A3D93DB} - C:\Program Files\Steganos Security Suite 2007\PasswordManagerBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: acaptuser32.dll
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - QLogic Corporation - (no file)
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - QLogic Corporation - (no file)
O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Program Files\Advanced Registry Doctor\RegManServ.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\System32\ZoneLabs\vsmon.exe

j'ai edité mon lien du precedent poste je me suis trompé....

refait le stp et renomme bien le fichier sur ton bureau et lance le

voila j'espére que c'est bon.......

Logfile of random's system information tool 1.06 (written by random/random)
Run by alexdiane at 2009-09-18 18:21:23
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 2
System drive C: has 64 GB (46%) free of 141 GB
Total RAM: 2046 MB (55% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:21:26, on 18/09/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\alexdiane\Desktop\alex.exe
C:\Program Files\Trend Micro\HijackThis\alexdiane.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Steganos Password Manager AutoFill - {1427A821-7B93-4F08-9A34-9FA03A3D93DB} - C:\Program Files\Steganos Security Suite 2007\PasswordManagerBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: acaptuser32.dll
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - QLogic Corporation - (no file)
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - QLogic Corporation - (no file)
O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Program Files\Advanced Registry Doctor\RegManServ.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\System32\ZoneLabs\vsmon.exe

non fait sa :

clic droit sur le lien ci dessous et choisit "enregsitré la cible du lien sous"
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

tu enregsitre le fichier sur ton BUREAU, et tu le renomme en ton prenom

puis deconnecte toi d'internet et DESACTIVE ton antivirus, lance le fichier et ne touche + a rien jusqu' a la fin et poste le rapport

puis

* Télécharge Malwarebytes
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
* Fais la mise à jour du logiciel (elle se fait normalement à l'installation)
* Lance une analyse complète en cliquant sur "Exécuter un examen complet"
* Sélectionnes les disques que tu veux analyser et cliques sur "Lancer l'examen"
* L'analyse peut durer un bon moment.....
* Une fois l'analyse terminée, cliques sur "OK" puis sur "Afficher les résultats"
* Vérifies que tout est bien coché et cliques sur "Supprimer la sélection" => et ensuite sur "OK"
* Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum

* Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC... Faites le en cliquant sur "oui" à la question posée

alors j'ai un probléme,il m'est impossible de désactivé le scanner de zone alarm,alors que j'ai éteint zone alarm.....
que faire?

tu clic droit sur l'icone de zone alarm en bas a droite et choisit quitté

si sa marche pas lance le comme sa mais autorise combofix (qui doit etre renommé) si on te demande un acces a internet ou autres

ca je l'avais bien évidement fait.... mais en fait avanit d'éteindre zone alarm il faut entrée dans l'anti spyware de zone alarm et l'éteindre sinon le scan de l'anti spaware continu même zone alarm éteint!!! dingue!!

ComboFix 09-09-17.04 - alexdiane 18/09/2009 19:03.1.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.2046.1212 [GMT 2:00]
Lancé depuis: c:\users\alexdiane\Desktop\alexandre.exe
FW: ZoneAlarm Pro Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
SP: Spy Emergency *disabled* (Updated) {82117492-906E-4b02-A33A-84D42A2DD907}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: ZoneAlarm Pro Anti-Spyware *disabled* (Updated) {F245A209-1085-48B4-B927-35D56015EC60}
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\alexdiane\AppData\Roaming\inst.exe
c:\users\alexdiane\AppData\Roaming\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
c:\users\alexdiane\AppData\Roaming\Microsoft\svchost.exe
c:\users\alexdiane\AppData\Roaming\msnmsgr.exe
c:\windows\refsdm.dll
c:\windows\system32\drivers\npf.sys
c:\windows\system32\oem2.inf
c:\windows\system32\oem4.inf
c:\windows\system32\oem46.inf
c:\windows\system32\Packet.dll
c:\windows\system32\rotscxsgcpsnbe.dat
c:\windows\system32\rotscxsqqvitmk.dll
c:\windows\system32\rotscxukfpxvrb.dll
c:\windows\system32\rotscxxfvvcnic.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_NPF

((((((((((((((((((((((((((((( Fichiers créés du 2009-08-18 au 2009-09-18 ))))))))))))))))))))))))))))))))))))
.

2009-09-18 16:44 . 2009-09-18 16:49 -------- d-----w- c:\windows\vf_hip
2009-09-18 16:44 . 2009-09-18 16:47 -------- d-----w- c:\program files\Hide IP Platinum
2009-09-18 08:56 . 2009-09-18 08:57 -------- d-----w- C:\rsit
2009-09-18 08:50 . 2009-09-18 08:50 2560 ----a-w- c:\windows\_MSRSTRT.EXE
2009-09-16 12:07 . 2009-09-16 12:07 -------- d-----w- c:\users\alexdiane\AppData\Roaming\TuneUp Software
2009-09-16 12:07 . 2009-09-16 12:07 -------- d-----w- c:\programdata\TuneUp Software
2009-09-14 20:54 . 2009-09-14 23:15 -------- d-----w- c:\users\alexdiane\{d1bf494b-9102-4956-9235-227abdda7cab}
2009-09-14 20:53 . 2009-08-05 14:10 831488 ----a-w- c:\windows\RtlExUpd.dll
2009-09-14 20:39 . 2009-09-14 20:39 -------- d-----w- C:\found.001
2009-09-14 20:18 . 2009-09-14 23:15 -------- d--h--w- c:\program files\Temp
2009-09-14 20:03 . 2009-09-14 20:05 -------- d-----w- c:\program files\Trojan Remover
2009-09-14 20:03 . 2009-09-14 20:03 -------- d-----w- c:\users\alexdiane\AppData\Roaming\Simply Super Software
2009-09-14 18:46 . 2009-09-14 18:46 -------- d-----w- C:\found.000
2009-09-12 21:31 . 2009-09-12 21:31 153104 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2009-09-11 08:48 . 2009-02-15 21:10 69000 ----a-w- c:\windows\system32\zlcomm.dll
2009-09-11 08:48 . 2009-02-15 21:10 103816 ----a-w- c:\windows\system32\zlcommdb.dll
2009-09-11 08:48 . 2009-02-15 21:10 1221512 ----a-w- c:\windows\system32\zpeng25.dll
2009-09-11 08:48 . 2009-09-11 08:48 -------- d-----w- c:\program files\Zone Labs
2009-09-11 08:47 . 2009-09-17 16:31 -------- d-----w- c:\windows\system32\ZoneLabs
2009-09-11 08:47 . 2009-02-15 21:11 293528 ----a-w- c:\windows\system32\drivers\vsdatant.sys
2009-09-11 08:46 . 2009-09-18 16:42 -------- d-----w- c:\windows\Internet Logs
2009-09-09 08:58 . 2009-08-14 16:27 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-09-09 08:58 . 2009-08-14 13:48 105984 ----a-w- c:\windows\system32\netiohlp.dll
2009-09-09 08:58 . 2009-08-14 13:49 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-09-09 08:58 . 2009-08-14 13:49 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-09-09 08:58 . 2009-08-14 13:49 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-09-09 08:58 . 2009-08-14 13:49 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-09-09 08:58 . 2009-08-14 13:49 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-09-09 08:58 . 2009-08-14 13:49 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-09-09 08:58 . 2009-08-14 13:49 10240 ----a-w- c:\windows\system32\finger.exe
2009-09-09 08:58 . 2009-08-14 13:48 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-09-09 08:58 . 2009-08-14 15:53 17920 ----a-w- c:\windows\system32\netevent.dll
2009-09-09 08:57 . 2009-07-11 19:01 302592 ----a-w- c:\windows\system32\wlansec.dll
2009-09-09 08:57 . 2009-07-11 19:01 293376 ----a-w- c:\windows\system32\wlanmsm.dll
2009-09-09 08:57 . 2009-07-11 17:03 127488 ----a-w- c:\windows\system32\L2SecHC.dll
2009-09-09 08:57 . 2009-07-11 19:01 513536 ----a-w- c:\windows\system32\wlansvc.dll
2009-09-09 08:57 . 2009-07-11 19:01 65024 ----a-w- c:\windows\system32\wlanapi.dll
2009-09-09 08:57 . 2009-06-10 11:41 2868224 ----a-w- c:\windows\system32\mf.dll
2009-09-08 19:16 . 2009-09-08 19:16 -------- d-----w- c:\programdata\Simply Super Software
2009-09-08 16:05 . 2009-09-08 16:05 -------- d-----w- c:\users\alexdiane\AppData\Local\Evidence Eliminator
2009-09-07 16:48 . 1998-04-23 22:00 368912 ----a-w- c:\windows\system32\vbar332.dll
2009-09-06 18:32 . 2009-09-06 18:32 -------- d-----w- c:\users\alexdiane\{7e60e431-5cbc-42ed-8184-f18fc4e026a9}
2009-09-04 16:14 . 2009-09-04 16:14 -------- d-----w- c:\programdata\Pinnacle
2009-09-04 11:44 . 2009-09-04 12:09 -------- d-----w- c:\windows\Internet Logs(32)
2009-09-04 10:54 . 2009-09-04 10:54 -------- d-----w- c:\users\alexdiane\AppData\Roaming\Publish Providers
2009-09-04 09:55 . 2009-09-06 13:03 -------- d-----w- c:\programdata\Sony
2009-09-03 17:31 . 2009-08-29 00:14 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-09-03 17:31 . 2009-08-29 00:27 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-09-01 20:18 . 2009-09-01 20:18 -------- d-----w- c:\users\alexdiane\AppData\Roaming\NeroDigital(TM)
2009-09-01 10:55 . 2009-09-01 10:55 -------- d-----w- c:\users\alexdiane\AppData\Roaming\NeatImage PS
2009-08-31 22:42 . 2009-08-31 22:42 -------- d-----w- c:\programdata\Zillatech
2009-08-31 18:32 . 2009-09-14 22:44 -------- d-----w- c:\program files\Advanced Registry Doctor
2009-08-30 14:34 . 2009-09-04 10:55 -------- d-----w- c:\users\alexdiane\AppData\Roaming\Sony
2009-08-30 14:34 . 2009-09-04 10:46 -------- d-----w- c:\users\alexdiane\AppData\Local\Sony
2009-08-27 18:30 . 2009-06-22 10:09 2048 ----a-w- c:\windows\system32\tzres.dll
2009-08-19 21:26 . 2009-08-19 21:26 -------- d-----w- c:\users\alexdiane\AppData\Roaming\PC Tools
2009-08-19 20:06 . 2009-08-29 19:12 -------- d-----w- c:\programdata\PC Tools

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-18 17:16 . 2009-05-30 22:34 -------- d-----w- c:\users\alexdiane\AppData\Roaming\DMCache
2009-09-18 17:13 . 2009-09-11 08:47 350197 ---ha-w- c:\windows\system32\drivers\vsconfig.xml
2009-09-18 17:13 . 2009-06-14 22:42 78199 ----a-w- c:\programdata\nvModes.dat
2009-09-18 16:49 . 2009-08-09 13:26 -------- d-----w- c:\users\alexdiane\AppData\Roaming\uTorrent
2009-09-16 17:23 . 2009-08-08 19:04 -------- d-----w- c:\users\alexdiane\AppData\Roaming\LimeWire
2009-09-16 15:03 . 2009-01-12 16:47 123556 ----a-w- c:\windows\system32\perfc00C.dat
2009-09-16 15:03 . 2009-01-12 16:47 0 ----a-w- c:\windows\system32\perfh00C.dat
2009-09-16 12:05 . 2009-05-30 22:46 -------- d-sh--w- c:\programdata\{55A29068-F2CE-456C-9148-C869879E2357}
2009-09-15 17:18 . 2009-06-20 17:57 680 ----a-w- c:\users\alexdiane\AppData\Local\d3d9caps.dat
2009-09-15 10:27 . 2009-01-12 10:08 -------- d-----w- c:\programdata\NVIDIA
2009-09-14 22:45 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-09-14 22:44 . 2009-08-15 09:29 -------- d-----w- c:\program files\UnHackMe
2009-09-14 22:44 . 2009-06-23 21:54 -------- d-----w- c:\users\alexdiane\AppData\Roaming\dvdcss
2009-09-14 22:44 . 2009-06-23 21:54 -------- d-----w- c:\users\alexdiane\AppData\Roaming\vlc
2009-09-14 22:44 . 2009-05-30 22:50 -------- d-----w- c:\program files\Wise Registry Cleaner
2009-09-14 22:44 . 2009-07-14 21:01 -------- d-----w- c:\program files\QuickTime
2009-09-14 22:44 . 2009-06-01 19:51 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-14 22:44 . 2009-01-12 08:08 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-14 20:54 . 2009-01-12 09:49 319456 ----a-w- c:\windows\DIFxAPI.dll
2009-09-11 08:31 . 2009-05-31 11:36 -------- d-----w- c:\users\alexdiane\AppData\Roaming\Skype
2009-09-11 08:30 . 2009-05-31 12:03 -------- d-----w- c:\users\alexdiane\AppData\Roaming\skypePM
2009-09-10 19:25 . 2009-07-14 21:02 -------- d-----w- c:\program files\Common Files\Apple
2009-09-09 09:06 . 2009-01-12 09:01 -------- d-----w- c:\programdata\Microsoft Help
2009-09-08 16:14 . 2009-05-30 22:34 -------- d-----w- c:\program files\Internet Download Manager
2009-09-08 13:48 . 2009-05-30 22:18 -------- d-----w- c:\users\alexdiane\AppData\Roaming\Vso
2009-09-07 16:37 . 2009-05-30 22:34 -------- d-----w- c:\users\alexdiane\AppData\Roaming\IDM
2009-09-06 13:04 . 2009-05-31 12:37 -------- d-----w- c:\program files\Unlocker
2009-09-06 13:04 . 2009-08-09 16:47 -------- d-----w- c:\program files\LimeWire
2009-09-06 12:55 . 2009-07-19 22:17 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-09-06 12:37 . 2009-07-28 17:05 -------- d-----w- c:\program files\Common Files\PC Tools
2009-09-05 19:09 . 2009-07-28 17:05 206256 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-09-05 19:09 . 2009-09-05 19:09 7396 ----a-w- c:\windows\system32\drivers\pctcore.cat
2009-09-04 09:55 . 2009-05-30 22:37 -------- d-----w- c:\program files\Sony
2009-09-01 10:26 . 2009-06-22 20:26 -------- d-----w- c:\users\alexdiane\AppData\Roaming\EPSON
2009-08-31 12:47 . 2009-07-24 15:45 -------- d-----w- c:\program files\Wise Disk Cleaner
2009-08-31 12:31 . 2009-08-08 14:24 -------- d-----w- c:\users\alexdiane\AppData\Roaming\Auslogics
2009-08-31 09:35 . 2009-01-12 09:26 -------- d-----w- c:\program files\Java
2009-08-30 16:25 . 2009-08-02 18:08 -------- d-----w- c:\program files\Yahoo!
2009-08-29 19:27 . 2009-08-12 18:26 -------- d-----w- c:\program files\Smarty Uninstaller Pro
2009-08-21 11:17 . 2009-01-12 09:46 485920 ----a-w- c:\windows\system32\NVUNINST.EXE
2009-08-20 21:26 . 2009-06-17 09:45 -------- d-----w- c:\users\alexdiane\AppData\Roaming\TeamViewer
2009-08-19 11:35 . 2009-08-19 11:35 9787488 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2009-08-19 11:35 . 2009-08-19 11:35 678432 ----a-w- c:\windows\system32\nvcuvid.dll
2009-08-19 11:35 . 2009-08-19 11:35 485920 ----a-w- c:\windows\system32\nvudisp.exe
2009-08-19 11:35 . 2009-08-19 11:35 4224 ----a-w- c:\windows\system32\drivers\nvBridge.kmd
2009-08-19 11:35 . 2009-08-19 11:35 3197952 ----a-w- c:\windows\system32\nvwgf2um.dll
2009-08-19 11:35 . 2009-08-19 11:35 1740800 ----a-w- c:\windows\system32\nvcuda.dll
2009-08-19 11:35 . 2009-08-19 11:35 155648 ----a-w- c:\windows\system32\nvcod163.dll
2009-08-19 11:35 . 2009-08-19 11:35 155648 ----a-w- c:\windows\system32\nvcod.dll
2009-08-19 11:35 . 2009-08-19 11:35 1317408 ----a-w- c:\windows\system32\nvcuvenc.dll
2009-08-19 11:35 . 2009-08-19 11:35 10420224 ----a-w- c:\windows\system32\nvoglv32.dll
2009-08-19 11:35 . 2007-11-07 00:05 991744 ----a-w- c:\windows\system32\nvapi.dll
2009-08-19 11:35 . 2007-11-07 00:05 7660544 ----a-w- c:\windows\system32\nvd3dum.dll
2009-08-18 11:44 . 2009-07-20 06:34 53248 ----a-w- c:\windows\system32\CSVer.dll
2009-08-16 16:19 . 2009-08-16 16:19 -------- d-----w- c:\program files\Super Internet TV
2009-08-16 11:08 . 2009-06-16 10:10 -------- d-----w- c:\program files\LG PC Suite II
2009-08-15 12:03 . 2009-07-20 06:26 -------- d-----w- c:\users\alexdiane\AppData\Roaming\SystemRequirementsLab
2009-08-15 12:03 . 2009-07-09 22:06 -------- d-----w- c:\users\alexdiane\AppData\Roaming\ALLCapture
2009-08-14 20:27 . 2009-07-31 18:39 -------- d-----w- c:\program files\Raxco
2009-08-13 20:00 . 2009-08-13 20:00 -------- d-----w- c:\users\alexdiane\AppData\Roaming\FireShot
2009-08-13 17:20 . 2009-08-13 17:20 -------- d-----w- c:\program files\ESET
2009-08-13 17:17 . 2009-08-13 17:17 -------- d-----w- c:\program files\ESET NOD32 Antivirus Business Edition 4 0 417
2009-08-12 18:59 . 2009-08-12 10:41 -------- d-----w- c:\program files\RAR Password Unlocker
2009-08-12 18:10 . 2009-08-12 18:10 34760 ----a-w- c:\windows\system32\drivers\Partizan.sys
2009-08-12 18:10 . 2009-08-12 18:10 32480 ----a-w- c:\windows\system32\Partizan.exe
2009-08-12 18:10 . 2009-08-12 18:10 2 --shatr- c:\windows\winstart.bat
2009-08-12 17:17 . 2009-08-09 13:27 -------- d-----w- c:\program files\uTorrent
2009-08-12 17:17 . 2009-07-27 19:20 -------- d-----w- c:\program files\VirtualDJ
2009-08-12 17:17 . 2009-06-06 18:37 -------- d-----w- c:\program files\PokerStars
2009-08-12 17:17 . 2009-05-30 22:16 -------- d-----w- c:\programdata\FLEXnet
2009-08-12 17:16 . 2009-08-02 18:08 -------- d-----w- c:\program files\CCleaner
2009-08-12 17:16 . 2009-01-12 09:05 -------- d-----w- c:\program files\Common Files\Adobe
2009-08-12 17:11 . 2009-08-12 17:11 -------- d-----w- c:\program files\Auslogics
2009-08-12 17:10 . 2009-08-09 16:46 -------- d-----w- c:\program files\Lime Wire LLC
2009-08-12 17:10 . 2009-05-30 21:38 -------- d-----w- c:\program files\Innovative Solutions
2009-08-11 16:18 . 2009-05-30 23:47 -------- d-----w- c:\program files\UltraSnapPRO
2009-08-11 16:18 . 2009-05-30 22:42 -------- d-----w- c:\program files\Total Video Converter
2009-08-11 16:18 . 2009-08-02 13:41 -------- d-----w- c:\program files\HyperSnap 6
2009-08-09 16:47 . 2009-08-09 16:47 -------- d-----w- c:\program files\LimeWire(49)
2009-08-09 15:51 . 2009-08-11 21:49 36864 ----a-w- c:\windows\ruto32.exe
2009-08-06 16:37 . 2009-07-06 17:00 -------- d-----w- c:\programdata\Innovative Solutions
2009-08-05 15:25 . 2009-07-31 18:41 -------- d-----w- c:\programdata\Raxco
2009-08-04 20:07 . 2009-08-04 20:07 -------- d-----w- c:\program files\Shadow Defender
2009-08-03 11:40 . 2009-08-03 11:40 -------- d-----w- c:\users\alexdiane\AppData\Roaming\IObit
2009-08-03 11:24 . 2009-05-30 22:22 -------- d-----w- c:\program files\IObit
2009-08-02 16:27 . 2009-08-02 16:27 -------- d-----w- c:\users\alexdiane\AppData\Roaming\Hewlett-Packard
2009-08-02 12:23 . 2009-08-02 12:23 22862224 ----a-w- C:\LimeWireWin.exe
2009-08-02 10:39 . 2009-07-20 14:11 -------- d-----w- c:\users\alexdiane\AppData\Roaming\Steganos
2009-08-01 19:23 . 2009-01-12 09:56 -------- d-----w- c:\programdata\CyberLink
2009-07-31 17:10 . 2009-07-31 17:10 -------- d-----w- c:\program files\Bodrag
2009-07-31 08:42 . 2009-06-25 11:48 -------- d-----w- c:\program files\Windows Live Safety Center
2009-07-29 21:30 . 2009-01-12 09:50 172032 ----a-w- c:\windows\system32\drivers\Rtlh86.sys
2009-07-29 19:55 . 2009-07-29 19:55 0 ----a-w- c:\windows\diskpt.dat
2009-07-28 21:49 . 2009-07-28 21:49 -------- d-----w- c:\users\alexdiane\AppData\Roaming\iExpert Software
2009-07-28 17:00 . 2009-01-12 08:04 -------- d-----w- c:\program files\Hewlett-Packard
2009-07-27 18:20 . 2009-07-27 16:50 6656 ----a-w- c:\windows\system32\bcmwlrc.dll
2009-07-27 18:15 . 2009-01-12 09:49 -------- d-----w- c:\program files\Realtek
2009-07-27 16:50 . 2009-07-27 16:50 1665016 ----a-w- c:\windows\system32\drivers\BCMWL6.SYS
2009-07-27 16:50 . 2007-10-08 20:27 91376 ----a-w- c:\windows\system32\bcmwlcoi.dll
2009-07-27 16:50 . 2009-07-27 16:50 3538944 ----a-w- c:\windows\system32\bcmihvui.dll
2009-04-29 04:29 . 2009-09-07 17:19 202168 ----a-w- c:\program files\mozilla firefox\plugins\SwDir.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-08-29 3114416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2009-05-05 1466368]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-08 311296]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-03-19 2029640]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-15 981384]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"EnableShellExecuteHooks"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\acaptuser32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *\0dpstart\0Partizan

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Privoxy.lnk]
backup=c:\windows\pss\Privoxy.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^UltraSnap PRO.lnk]
backup=c:\windows\pss\UltraSnap PRO.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^alexdiane^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^BitTorrent Turbo Accelerator.lnk]
backup=c:\windows\pss\BitTorrent Turbo Accelerator.lnk.Startup
backupExtension=.Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean Expert Scheduler
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyEmergency
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnHackMe Monitor
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vidalia

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpeedConnectStartUp"=c:\program files\CBS Software\SpeedConnect Internet Accelerator\SpeedConnectStartUp.exe -run
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HP Software Update"=c:\program files\Hp\HP Software Update\HPWuSchd2.exe
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):a9,5d,a2,02,d3,e2,c9,01

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{379BA3CF-0D69-4D6B-912A-C695B3EE0EED}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{04E44F1B-C4D2-4CEE-B3B5-2DD19641029D}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{1BB4E03A-8CF5-489D-B29D-6C5C3DADE516}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{ED8875BD-993E-4D80-B3CD-413533B4C276}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{6FE15015-DCA1-47CA-89A7-B339F6AF6DE3}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{27B1E7AE-3D21-451D-86F0-8A0EF2C8ACB2}"= UDP:5353:Adobe CSI CS4
"{E62C8F3D-5BC9-40CD-BA2C-A6570256E184}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{DEF68ECF-C556-40D5-BA9E-4DCA0549E52D}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{DA86EFF5-4D2A-4DD4-912C-D9FC6EED1A9E}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{DF5C9B8C-E527-434D-8DBE-ED3EEACA303A}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{C03633A0-BA32-41B4-B25A-1A38B16FBD59}"= UDP:48113:LocalSubnet:LocalSubnet:maconfig_tcp
"{6B91F916-34EC-4367-83C2-EDB87EB39D62}"= TCP:48113:LocalSubnet:LocalSubnet:maconfig_udp
"{327C1B88-77BF-496A-A2C3-35001D57646A}"= UDP:c:\program files\TeamViewer\Version4\TeamViewer.exe:Teamviewer Remote Control Application
"{8204C593-7470-4E54-AE35-026C90D296FF}"= TCP:c:\program files\TeamViewer\Version4\TeamViewer.exe:Teamviewer Remote Control Application
"{24B0F042-B2E4-4E4F-A27D-1A3E8BCABD1D}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{71142492-5D4C-4FFD-83F2-9131D699B0BD}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{2712874C-AA40-4A87-ADDA-F72A9FA281D0}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{DE84902E-D09F-47FC-8F53-D336B2702EA2}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{0E6E6470-C6F0-442B-8815-FEA90E6D0D38}"= UDP:c:\users\alexdiane\AppData\Local\Temp\svcchst32.exe:JDrun
"{4794DFB8-0272-47EF-9990-0E45122194A0}"= TCP:c:\users\alexdiane\AppData\Local\Temp\svcchst32.exe:JDrun
"{63311560-84BE-469A-9D52-78CE88CA686E}"= UDP:c:\users\alexdiane\AppData\Local\Temp\JDstart.exe:JDstart
"{5371A379-D8AD-486A-BD20-A557E0CF072F}"= TCP:c:\users\alexdiane\AppData\Local\Temp\JDstart.exe:JDstart

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DoNotAllowExceptions"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
"DoNotAllowExceptions"= 0 (0x0)

R0 diskpt;diskpt;c:\windows\System32\drivers\diskpt.sys [04/08/2009 22:07 182500]
R1 ehdrv;ehdrv;c:\windows\System32\drivers\ehdrv.sys [19/03/2009 11:44 107256]
R1 SLEE_14_DRIVER;Steganos Live Encryption Engine 14 [Driver];c:\windows\System32\drivers\sleen14.sys [24/07/2006 12:16 72480]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [19/03/2009 11:44 731840]
R2 epfwwfpr;epfwwfpr;c:\windows\System32\drivers\epfwwfpr.sys [19/03/2009 11:45 93312]
R2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [27/07/2009 09:37 185640]
S3 Partizan;Partizan;c:\windows\System32\drivers\Partizan.sys [12/08/2009 20:10 34760]
S4 Steganos AntiTheft;Steganos AntiTheft;c:\windows\system32\\SatSrv.exe --> c:\windows\system32\\SatSrv.exe [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contenu du dossier 'Tâches planifiées'

2009-09-18 c:\windows\Tasks\User_Feed_Synchronization-{AA62B5B1-EFBC-49E7-AB99-666F195BD09E}.job
- c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]
.
.
------- Examen supplémentaire -------
.
uStart Page = www.google.com
uInternet Settings,ProxyOverride = local
IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Ajouter à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Télécharger avec IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Télécharger le contenu de video FLV avec IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Télécharger tous les liens avec IDM - c:\program files\Internet Download Manager\IEGetAll.htm
LSP: c:\windows\system32\idmmbc.dll
FF - ProfilePath - c:\users\alexdiane\AppData\Roaming\Mozilla\Firefox\Profiles\3gbqj5fb.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - component: c:\users\alexdiane\AppData\Roaming\IDM\idmmzcc3\components\idmmzcc.dll
FF - component: c:\users\alexdiane\AppData\Roaming\Mozilla\Firefox\Profiles\3gbqj5fb.default\extensions\lazarus@interclue.com\platform\WINNT_x86-msvc\components\WeaveCrypto.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np32asw.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
.
- - - - ORPHELINS SUPPRIMES - - - -

ShellExecuteHooks-{4F07DA45-8170-4859-9B5F-037EF2970034} - (no file)
MSConfigStartUp-PerfectSpeed - (no file)
AddRemove-HijackThis - c:\program files\Trend Micro\HijackThis\HijackThis.exe

**************************************************************************
Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés:

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-4283788246-504816121-809313791-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):c4,7c,92,70,a6,e5,06,67,38,1d,c5,49,df,bd,ec,6e,b0,5b,15,d2,2f,
13,b3,25,8b,e9,6d,a7,2e,96,99,92,11,fd,db,04,2a,96,fa,a5,00,00,00,00,00,00,\

[HKEY_USERS\S-1-5-21-4283788246-504816121-809313791-1000_Classes\CLSID\{fcf81100-e465-4a0a-a0ea-a3a717f84c2f}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:000000d6
"Therad"=dword:00000009
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,98,07,ff,fc,5d,
df,1c,2f,3b,8a,0a,32,11,89,01,b5,42,27,1d,0b,0e,23,ad,f3,ea,3f,46,3b,a2,3f,\

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'Explorer.exe'(3496)
c:\program files\Internet Download Manager\idmmkb.dll
c:\program files\Internet Download Manager\IDMIECC.dll
c:\program files\Steganos Security Suite 2007\PasswordManagerBHO.dll
c:\program files\Epson Software\Easy Photo Print\EPTBL.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\ADFSMenu.dll
c:\program files\Steganos Security Suite 2007\ShellExtension.dll
c:\program files\Unlocker\UnlockerCOM.dll
c:\progra~1\TROJAN~1\Trshlex.dll
c:\program files\ESET\ESET NOD32 Antivirus\shellExt.dll
c:\windows\system32\erasext.dll
c:\windows\system32\Eraser.dll
c:\program files\Adobe\Acrobat 9.0\Acrobat Elements\ContextMenu.dll
c:\program files\Adobe\Acrobat 9.0\Acrobat Elements\ContextMenu.fra
c:\program files\UltraISO\isoshell.dll
c:\program files\Shadow Defender\ShellExt.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\nvvsvc.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\wlanext.exe
c:\windows\System32\nvvsvc.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\program files\Raxco\PerfectDisk10\PDAgent.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\program files\Raxco\PerfectDisk10\PDAgentS1.exe
c:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Heure de fin: 2009-09-18 19:20 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-09-18 17:20

Avant-CF: 67 199 520 768 octets libres
Après-CF: 67 079 663 616 octets libres

401 --- E O F --- 2009-09-09 09:10

MERCI à toi....
et voici malwaresbytes
Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2820
Windows 6.0.6002 Service Pack 2

18/09/2009 19:36:05
mbam-log-2009-09-18 (19-36-05).txt

Type de recherche: Examen rapide
Eléments examinés: 87955
Temps écoulé: 4 minute(s), 29 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 4
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\eeshellx.shellext (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f272845d-cec2-4f95-92ee-6d08fdfbd471} (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a7c6e906-b0b8-4810-ae82-71809ed409eb} (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{0e6117e2-c367-4be3-8045-52669e71b5df} (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

toujours moi,lol

aprés tout cela mon pc ne demarre s'éteint toujours pas .... bloque sur arrêt en cours