Gros probléme pc!,mon rappoert est il clean?? - Page 2

poste un rsit stp c'est les long rapport

voici le log rapport de malwaresbyte............ le long
t'as raison il y avait encore des merdes, mais mon probléme reste quand même............

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2820
Windows 6.0.6002 Service Pack 2

18/09/2009 22:15:35
mbam-log-2009-09-18 (22-15-35).txt

Type de recherche: Examen complet (C:\|D:\|E:\|H:\|)
Eléments examinés: 289763
Temps écoulé: 1 hour(s), 14 minute(s), 9 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 5

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Qoobox\Quarantine\C\WINDOWS\System32\rotscxsqqvitmk.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\System32\rotscxukfpxvrb.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\System32\rotscxxfvvcnic.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\alexdiane\Downloads\Pinnacle.Studio.Ultimate.v12.0.0.6163.Incl.Keymaker-AGAiN\Pinnacle.Studio.Ultimate.v12.0.0.6163.Incl.Keymaker-AGAiN\Keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\alexdiane\Downloads\Pinnacle.Studio.Ultimate.v12.0.0.6163.Incl.Keymaker-AGAiN\Pinnacle.Studio.Ultimate.v12.0.0.6163.Plugins.Addon-AGAiN\Keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

RSIT c'est sa :

* Télécharge Random's system information tool (RSIT) et enregistre le sur ton bureau.
http://images.malwareremoval.com/random/RSIT.exe
* Double clique sur RSIT.exe pour lancer l'outil.
* Clique sur ' continue ' à l'écran Disclaimer.
* Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.
* Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports.

( C:\RSIT\log.txt & C:\RSIT\info.txt )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

AVEC SA : Keygen.exe etc.... t'etonne pas d'etre infecté....

t'as raison.... excuse moi de ne pas avoir capté tout de suite,voila le rapport

Logfile of random's system information tool 1.06 (written by random/random)
Run by alexdiane at 2009-09-18 23:00:16
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 2
System drive C: has 64 GB (45%) free of 141 GB
Total RAM: 2046 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:00:20, on 18/09/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\taskeng.exe
C:\Users\alexdiane\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\alexdiane.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Steganos Password Manager AutoFill - {1427A821-7B93-4F08-9A34-9FA03A3D93DB} - C:\Program Files\Steganos Security Suite 2007\PasswordManagerBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\System32\acaptuser32.dll
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - QLogic Corporation - (no file)
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - QLogic Corporation - (no file)
O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Program Files\Advanced Registry Doctor\RegManServ.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\System32\ZoneLabs\vsmon.exe

au passage avant que je regarde ton log

ARRETE DE TELECHARGER N'IMPORTE QUOI sur le net surtout des logiciels qu'une publicité te propose et qui sont trés peu connu la plupart sont aranques...

clic ici http://www.cijoint.fr/cj200909/cijHhciCsI.txt

et suit les instruction et poste le rapport

ensuite avec internet explorer fait un scan en ligne ici et poste le rapport en entier avec les lignes detecté
http://www.bitdefender.fr/scan_fr/scan8/ie.html

ensuite

Télécharge ZHPDiag (de Nicolas Coolman) sur ton bureau :

-> https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html

!! déconnecte toi et ferme toutes tes applications en cours !!

- double-clique sur "ZHPDiag.exe" pour lancer l'installation de l'outil et laisse toi guider ( ne modifie pas les paramètres d'installe et coche bien la case "créer une icone sur le bureau" afin d'avoir les raccourcis "ZHPDiag" et "ZHPFix" ) .

- Lance ZHPDiag depuis le raccourci du bureau .

- Une fois ZHPDiag ouvert, clique sur le bouton "option" en haut sur la droite .
( celui avec le tournevis )

Une liste apparait dans l'encadré principal > clique en bas sur le bouton " Tous " et décoche la ligne 061 ( important ! ) .

- Puis clique sur le bouton de "la loupe" pour lancer le scan .

Laisses travailler l'outil ...

- Une fois terminé , le rapport s'affiche : clique sur bouton "disquette" pour sauvegarder le rapport obtenu ...

Enregistres bien ZHPDiag.txt de façon à le retrouver facilement ( sur le bureau par exemple ).

( Sinon le rapport sera en outre sauvegardé dans ce dossier > C:\Program files\ZHPDiag )

Puis ferme le programme ...

- rends toi ensuite sur ce site : http://www.cijoint.fr/

Clique sur "parcourir" et va jusqu'au rapport que tu as sauvegardé .
Clique ensuite sur "cliquer ici pour déposer le fichier" et patiente ...
Une fois l'upload finit , un lien apparait > copie/colle le dans ta prochaine réponse stp

tu as raison sage conseil...............
mais aussi hallucinant que cela puisse te paraitre quand j'avais avast tout allait bien,alors que tout le monde le trouve pourrit... pas de merde, sauf qu'il me crée un bug avec firefox... parent lock... j'avais cherché la solution partout ,rien ne marchait.. par hasard un jour je desinstal avast et firefox ne buggait plus....

merci...

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named TeaTimer.exe was found!
No active process named iexplorer.exe was found!
No active process named TeaTimer.exe was found!
========== FILES ==========
Folder move failed. c:\windows\vf_hip\chrome\skin scheduled to be moved on reboot.
Folder move failed. c:\windows\vf_hip\chrome\content scheduled to be moved on reboot.
Folder move failed. c:\windows\vf_hip\chrome scheduled to be moved on reboot.
Folder move failed. c:\windows\vf_hip scheduled to be moved on reboot.
Folder move failed. C:\found.001 scheduled to be moved on reboot.
Folder move failed. C:\found.000 scheduled to be moved on reboot.
File/Folder c:\users\alexdiane\AppData\Local\Evi­dence Eliminator not found.
c:\programdata\Zillatech\My\1.0.0.0\UPIYXUEWDBCNQ moved successfully.
c:\programdata\Zillatech\My\1.0.0.0 moved successfully.
c:\programdata\Zillatech\My moved successfully.
c:\programdata\Zillatech moved successfully.
File move failed. c:\windows\system32\perfc00C.dat scheduled to be moved on reboot.
File move failed. c:\windows\system32\perfh00C.dat scheduled to be moved on reboot.
File move failed. c:\windows\system32\Partizan.exe scheduled to be moved on reboot.
File move failed. C:\Windows\Partizan.txt scheduled to be moved on reboot.
File move failed. c:\windows\winstart.bat scheduled to be moved on reboot.
File move failed. c:\windows\System32\drivers\Partizan.sys scheduled to be moved on reboot.
File move failed. C:\Windows\system32\PARTIZAN.TXT scheduled to be moved on reboot.
Error: Unable to interpret <:serices> in the current context!
Error: Unable to interpret <Partizan> in the current context!
Error: Unable to interpret <WinRing0_1_2_0;> in the current context!
========== REGISTRY ==========
Registry delete failed. HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Evidence Eliminator\ scheduled to be deleted on reboot.
Registry delete failed. HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{485CAF81-C05D-7ACB-0F00-D4A0E08061AE}\ scheduled to be deleted on reboot.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{485CAF81-C05D-7ACB-0F00-D4A0E08061AE}\ not found.
Unable to set value : HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows\\"AppInit_DLLs"|"" /E!
Registry delete failed. HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\ scheduled to be deleted on reboot.
========== COMMANDS ==========

[EMPTYTEMP]

User: alexdiane
File delete failed. C:\Users\alexdiane\AppData\Local\Temp\~DF3D01.tmp scheduled to be deleted on reboot.
->Temp folder emptied: 425048 bytes
File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PN80MFZC(13)\v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;&timestamp=1245923319845;eid1=2;ecn1=1;etm1=6;eid2=110161;ecn2=1;etm2=0;&_dc_ck=try[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PN80MFZC(13)\v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;&timestamp=1245924887173;eid1=2;ecn1=1;etm1=4;eid2=110161;ecn2=1;etm2=0;&_dc_ck=try[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PN80MFZC(13)\v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;&timestamp=1245925254931;eid1=2;ecn1=1;etm1=3;eid2=110161;ecn2=1;etm2=0;&_dc_ck=try[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PN80MFZC(13)\v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;&timestamp=1245929380844;eid1=2;ecn1=1;etm1=4;eid2=110161;ecn2=1;etm2=0;&_dc_ck=try[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PN80MFZC(13)\v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;&timestamp=1245940645904;eid1=2;ecn1=1;etm1=2;eid2=110161;ecn2=1;etm2=0;&_dc_ck=try[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\O2EVIL1O(12)\ctivity;src=1800704;met=1;v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;&timestamp=1245926291139;eid1=2;ecn1=0;etm1=6;&_dc_ck=try[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1MMWTDUY(11)\0x250;kl=N;klg=fr;kt=K;kga=-1;kr=F;kw=0+minutes+insides+daniel+ducruet;kgg=-1;kcr=fr;dc_dedup=1;kmyd=ad_creative_1;tile=1;dcopt=ist;ord=4187216995221048[1].5 scheduled to be deleted on reboot.
File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1MMWTDUY(11)\celebrities;sz=300x250;kl=N;klg=fr;kt=K;kga=-1;kr=F;kw=daniel+ducruet;kgg=-1;kcr=fr;dc_dedup=1;kmyd=ad_creative_1;tile=1;dcopt=ist;ord=1578967659026528[1].2 scheduled to be deleted on reboot.
File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1MMWTDUY(11)\celebrities;sz=300x250;kl=N;klg=fr;kt=K;kga=-1;kr=F;kw=daniel+ducruet;kgg=-1;kcr=fr;dc_dedup=1;kmyd=ad_creative_1;tile=1;dcopt=ist;ord=974234971001763[1].9 scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 8174388 bytes
->Java cache emptied: 5292 bytes
->FireFox cache emptied: 84275703 bytes
->Apple Safari cache emptied: 602089677 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 134 bytes

User: Default User
->Temp folder emptied: 0 bytes
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 134 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
Folder delete failed. C:\Windows\msdownld.tmp scheduled to be deleted on reboot.
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
File delete failed. C:\Windows\temp\HTT10C4.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\HTT46DE.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\HTT767E.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\HTT8A7C.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\HTTC8E2.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\HTTECD0.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\HTTFF96.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\ZLT03196.TMP scheduled to be deleted on reboot.
Windows Temp folder emptied: 194349 bytes
RecycleBin emptied: 4100534 bytes

Total Files Cleaned = 666,87 mb

OTM by OldTimer - Version 3.0.0.6 log created on 09182009_232624
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named TeaTimer.exe was found!
No active process named iexplorer.exe was found!
No active process named TeaTimer.exe was found!
========== FILES ==========
Folder move failed. c:\windows\vf_hip\chrome\skin scheduled to be moved on reboot.
Folder move failed. c:\windows\vf_hip\chrome\content scheduled to be moved on reboot.
Folder move failed. c:\windows\vf_hip\chrome scheduled to be moved on reboot.
Folder move failed. c:\windows\vf_hip scheduled to be moved on reboot.
Folder move failed. C:\found.001 scheduled to be moved on reboot.
Folder move failed. C:\found.000 scheduled to be moved on reboot.
File/Folder c:\users\alexdiane\AppData\Local\Evi­dence Eliminator not found.
c:\programdata\Zillatech\My\1.0.0.0\UPIYXUEWDBCNQ moved successfully.
c:\programdata\Zillatech\My\1.0.0.0 moved successfully.
c:\programdata\Zillatech\My moved successfully.
c:\programdata\Zillatech moved successfully.
File move failed. c:\windows\system32\perfc00C.dat scheduled to be moved on reboot.
File move failed. c:\windows\system32\perfh00C.dat scheduled to be moved on reboot.
File move failed. c:\windows\system32\Partizan.exe scheduled to be moved on reboot.
File move failed. C:\Windows\Partizan.txt scheduled to be moved on reboot.
File move failed. c:\windows\winstart.bat scheduled to be moved on reboot.
File move failed. c:\windows\System32\drivers\Partizan.sys scheduled to be moved on reboot.
File move failed. C:\Windows\system32\PARTIZAN.TXT scheduled to be moved on reboot.
Error: Unable to interpret <:serices> in the current context!
Error: Unable to interpret <Partizan> in the current context!
Error: Unable to interpret <WinRing0_1_2_0;> in the current context!
========== REGISTRY ==========
Registry delete failed. HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Evidence Eliminator\ scheduled to be deleted on reboot.
Registry delete failed. HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{485CAF81-C05D-7ACB-0F00-D4A0E08061AE}\ scheduled to be deleted on reboot.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{485CAF81-C05D-7ACB-0F00-D4A0E08061AE}\ not found.
Unable to set value : HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows\\"AppInit_DLLs"|"" /E!
Registry delete failed. HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\ scheduled to be deleted on reboot.
========== COMMANDS ==========

[EMPTYTEMP]

User: alexdiane
File delete failed. C:\Users\alexdiane\AppData\Local\Temp\~DF3D01.tmp scheduled to be deleted on reboot.
->Temp folder emptied: 425048 bytes
File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PN80MFZC(13)\v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;&timestamp=1245923319845;eid1=2;ecn1=1;etm1=6;eid2=110161;ecn2=1;etm2=0;&_dc_ck=try[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PN80MFZC(13)\v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;&timestamp=1245924887173;eid1=2;ecn1=1;etm1=4;eid2=110161;ecn2=1;etm2=0;&_dc_ck=try[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PN80MFZC(13)\v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;&timestamp=1245925254931;eid1=2;ecn1=1;etm1=3;eid2=110161;ecn2=1;etm2=0;&_dc_ck=try[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PN80MFZC(13)\v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;&timestamp=1245929380844;eid1=2;ecn1=1;etm1=4;eid2=110161;ecn2=1;etm2=0;&_dc_ck=try[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PN80MFZC(13)\v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;&timestamp=1245940645904;eid1=2;ecn1=1;etm1=2;eid2=110161;ecn2=1;etm2=0;&_dc_ck=try[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\O2EVIL1O(12)\ctivity;src=1800704;met=1;v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;&timestamp=1245926291139;eid1=2;ecn1=0;etm1=6;&_dc_ck=try[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1MMWTDUY(11)\0x250;kl=N;klg=fr;kt=K;kga=-1;kr=F;kw=0+minutes+insides+daniel+ducruet;kgg=-1;kcr=fr;dc_dedup=1;kmyd=ad_creative_1;tile=1;dcopt=ist;ord=4187216995221048[1].5 scheduled to be deleted on reboot.
File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1MMWTDUY(11)\celebrities;sz=300x250;kl=N;klg=fr;kt=K;kga=-1;kr=F;kw=daniel+ducruet;kgg=-1;kcr=fr;dc_dedup=1;kmyd=ad_creative_1;tile=1;dcopt=ist;ord=1578967659026528[1].2 scheduled to be deleted on reboot.
File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1MMWTDUY(11)\celebrities;sz=300x250;kl=N;klg=fr;kt=K;kga=-1;kr=F;kw=daniel+ducruet;kgg=-1;kcr=fr;dc_dedup=1;kmyd=ad_creative_1;tile=1;dcopt=ist;ord=974234971001763[1].9 scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 8174388 bytes
->Java cache emptied: 5292 bytes
->FireFox cache emptied: 84275703 bytes
->Apple Safari cache emptied: 602089677 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 134 bytes

User: Default User
->Temp folder emptied: 0 bytes
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 134 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
Folder delete failed. C:\Windows\msdownld.tmp scheduled to be deleted on reboot.
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
File delete failed. C:\Windows\temp\HTT10C4.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\HTT46DE.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\HTT767E.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\HTT8A7C.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\HTTC8E2.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\HTTECD0.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\HTTFF96.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\ZLT03196.TMP scheduled to be deleted on reboot.
Windows Temp folder emptied: 194349 bytes
RecycleBin emptied: 4100534 bytes

Total Files Cleaned = 666,87 mb

OTM by OldTimer - Version 3.0.0.6 log created on 09182009_232624

désolé,j'ai essayé de desinstallé ie 8 par le passé vu que rien ne marchait... je l'ai effacé moi même ,dégagé du disk C des clefs de registre appdat.... mais comme microsoft fait bien les choses!! ils ont foutu un truc qui doit laissé des traces je ne sais ou... d'ou une impossibilité de réinstallé explorer!! ça refuse... donc le scan avec bitdefenter... je ne peux pas... j ai firefox

voila le log zhp.... tu m'as appris et fait decouvrir plein de choses ce soir un grand MERCI.....

http://www.cijoint.fr/cjlink.php?file=cj200909/cijkJpPvHR.txt

celui ci jme le met de coté jl'ai oubliai :: c:\windows\ruto32.exe

va dans demarrer/panneau de configuration et desinstalle ces programmes :

Advanced Registry Doctor
Advanced Registry Doctor Compatibility Patch
Auslogics BoostSpeed
Autorun Blocker 1.0.0.0
Java 6 Update 15
Java 6 Update 2
Shadow Defender
Registry Defragmentation Compatibility Patch
RAM Booster Expert 1.30
UnHackMe 5.00 release
Wise Disk Cleaner

puis clic ici https://www.virustotal.com/gui/
et clic sur parcourir en milieu de page et copie colle une a une les ligne ci desssous puis clic sur envoyer, un rapport va s'etablir copie colle le avec le nom du fichier en entete

C:\Windows\system32\drivers\AntiArpNdisProt.sys
c:\users\alexdiane\AppData\Local\d3d9caps­.dat

ensuite

/!\ Il faut impérativement désactiver tous tes logiciels de protection pour utiliser ce programme/!\

• Rends toi sur cette page, et clique sur "Download EXE" pour télécharger Gmer (sous un nom aléatoire, pour éviter qu'il soit bloqué par une infection)
http://www.gmer.net/
• Lance Gmer
• Dans l'onglet "Rootkit", clique sur "Scan" puis patiente.
• A la fin, clique sur "Save" et enregistre le rapport sur ton Bureau.

bonjour, voilci ce que tu m as demandé...

Fichier d2ebd9e9803e680052a20037e13036009cf83198.EXE reçu le 2009.07.02 00:52:58 (UTC)

Srpski | Македонски | العربية | Suomi | ihMdI | | עברית | | Slovenščina | Dansk | Русский | Română | Türkçe | Nederlands | Ελληνικά | Svenska | Português | Italiano | | | Magyar | Deutsch | Česky | Polski | Español | English
Virus Total
Virustotal est un service qui analyse les fichiers suspects et facilite la détection rapide des virus, vers, chevaux de Troie et toutes sortes de malwares détectés par les moteurs antivirus. Plus d'informations...
Fichier d2ebd9e9803e680052a20037e13036009cf83198.EXE reçu le 2009.07.02 00:52:58 (UTC)
Situation actuelle: terminé
Résultat: 0/40 (0.00%)
Formaté Formaté
Impression des résultats Impression des résultats
Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.18 2009.07.02 -
AhnLab-V3 5.0.0.2 2009.07.01 -
AntiVir 7.9.0.199 2009.07.01 -
Antiy-AVL 2.0.3.1 2009.07.01 -
Authentium 5.1.2.4 2009.07.01 -
Avast 4.8.1335.0 2009.07.01 -
AVG 8.5.0.386 2009.07.01 -
BitDefender 7.2 2009.07.02 -
CAT-QuickHeal 10.00 2009.07.01 -
ClamAV 0.94.1 2009.07.02 -
Comodo 1527 2009.07.01 -
DrWeb 5.0.0.12182 2009.07.02 -
eSafe 7.0.17.0 2009.06.29 -
eTrust-Vet 31.6.6592 2009.07.02 -
F-Prot 4.4.4.56 2009.07.01 -
F-Secure 8.0.14470.0 2009.07.02 -
Fortinet 3.117.0.0 2009.07.01 -
GData 19 2009.07.02 -
Ikarus T3.1.1.64.0 2009.07.02 -
Jiangmin 11.0.706 2009.07.01 -
K7AntiVirus 7.10.768 2009.06.19 -
McAfee 5663 2009.07.01 -
McAfee+Artemis 5663 2009.07.01 -
McAfee-GW-Edition 6.7.6 2009.07.01 -
Microsoft 1.4803 2009.07.01 -
NOD32 4206 2009.07.02 -
Norman 2009.07.01 -
nProtect 2009.1.8.0 2009.07.01 -
Panda 10.0.0.14 2009.07.01 -
PCTools 4.4.2.0 2009.07.01 -
Prevx 3.0 2009.07.02 -
Rising 21.36.24.00 2009.07.01 -
Sophos 4.43.0 2009.07.02 -
Sunbelt 3.2.1858.2 2009.07.01 -
Symantec 1.4.4.12 2009.07.02 -
TheHacker 6.3.4.3.359 2009.07.02 -
TrendMicro 8.950.0.1094 2009.07.01 -
VBA32 3.12.10.7 2009.07.02 -
ViRobot 2009.7.1.1814 2009.07.01 -
VirusBuster 4.6.5.0 2009.07.01 -
Information additionnelle
File size: 21120 bytes
MD5 : 5ba500977641728b26ebefa1873be730
SHA1 : 2dd6fb13b0d98fbcc49b45cae9e35c37636d0298
SHA256: c5dfe5b7704af6e4cdb1fbea988f8bc8327da5b8c0a2c09daf6df3d87929d14e
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4273
timedatestamp.....: 0x4625FE20 (Wed Apr 18 13:16:48 2007)
machinetype.......: 0x14C (Intel I386)

( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x480 0x1E4A 0x1E80 6.23 f71c99a3a9965517ca1d36a171b2be9c
.rdata 0x2300 0x66B 0x680 3.79 531917f3c145100ac4d32d119802cec2
.data 0x2980 0x1D0 0x200 1.75 f5b44af3d2db5a569574b848a4ba8854
PAGE 0x2B80 0x1444 0x1480 6.25 c21e588a653139136894eba64352dcaa
INIT 0x4000 0xA5E 0xA80 5.65 3f991388f8adfe112a9a92b3db0f8389
.rsrc 0x4A80 0x3C8 0x400 3.32 f65e6c1b3663efd9c9064f483999fe11
.reloc 0x4E80 0x384 0x400 5.52 d4c81524e71d0c5065449cd971080078

( 3 imports )

> hal.dll: KfReleaseSpinLock, KfAcquireSpinLock
> ndis.sys: NdisFreePacket, NdisReturnPackets, NdisAllocateBuffer, NdisOpenProtocolConfiguration, NdisReadConfiguration, NdisCloseConfiguration, NdisUnchainBufferAtFront, NdisAllocatePacketPoolEx, NdisAllocateBufferPool, NdisOpenAdapter, NdisQueryAdapterInstanceName, NdisCloseAdapter, NdisDeregisterProtocol, NdisCopyFromPacketToPacket, NdisAllocateMemoryWithTag, NdisAllocatePacket, NdisFreeMemory, NdisWaitEvent, NdisRegisterProtocol, NdisInitializeEvent, NdisSetEvent, NdisFreeBufferPool, NdisFreePacketPool
> ntoskrnl.exe: KeBugCheckEx, KeTickCount, MmMapLockedPagesSpecifyCache, IoFreeMdl, IoReleaseCancelSpinLock, InterlockedExchange, IoCreateSymbolicLink, KeInitializeSpinLock, InterlockedCompareExchange, IoDeleteDevice, InterlockedDecrement, InterlockedIncrement, IofCompleteRequest, RtlInitUnicodeString, IoDeleteSymbolicLink, MmGetSystemRoutineAddress, wcslen, ZwClose, ZwSetSecurityObject, ObOpenObjectByPointer, IoDeviceObjectType, IoCreateDevice, RtlGetDaclSecurityDescriptor, RtlGetSaclSecurityDescriptor, RtlGetGroupSecurityDescriptor, RtlGetOwnerSecurityDescriptor, _snwprintf, RtlLengthSecurityDescriptor, ExFreePoolWithTag, SeCaptureSecurityDescriptor, SeExports, IoIsWdmVersionAvailable, _wcsnicmp, RtlAddAccessAllowedAce, ExAllocatePoolWithTag, RtlLengthSid, wcschr, RtlAbsoluteToSelfRelativeSD, RtlSetDaclSecurityDescriptor, RtlCreateSecurityDescriptor, ZwOpenKey, ZwCreateKey, ZwQueryValueKey, ZwSetValueKey, RtlFreeUnicodeString

( 0 exports )
TrID : File type identification
Clipper DOS Executable (33.3%)
Generic Win/DOS Executable (33.0%)
DOS Executable Generic (33.0%)
VXD Driver (0.5%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
ssdeep: 384:ynCPx55OHsBHg7TVFkgTDTPjXvY8NA4/4UzouYE9Ijh6bNOYzem:lx/OoH0LkgTnLfY8qiNZ9ym
PEiD : -
packers (Kaspersky): PE_Patch
CWSandbox: http://research.sunbelt-software.com/...
RDS : NSRL Reference Data Set
-

ATENTION ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.

Autre fichier
VirusTotal © Hispasec Sistemas - Blog - Contact: info@virustotal.com - Terms of Service & Privacy Policy

Srpski | Македонски | العربية | Suomi | ihMdI | | עברית | | Slovenščina | Dansk | Русский | Română | Türkçe | Nederlands | Ελληνικά | Svenska | Português | Italiano | | | Magyar | Deutsch | Česky | Polski | Español | English
Virus Total
Virustotal est un service qui analyse les fichiers suspects et facilite la détection rapide des virus, vers, chevaux de Troie et toutes sortes de malwares détectés par les moteurs antivirus. Plus d'informations...
Fichier d3d9caps.dat reçu le 2009.09.19 08:50:56 (UTC)
Situation actuelle: terminé
Résultat: 0/41 (0.00%)
Formaté Formaté
Impression des résultats Impression des résultats
Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.24 2009.09.19 -
AhnLab-V3 5.0.0.2 2009.09.19 -
AntiVir 7.9.1.19 2009.09.18 -
Antiy-AVL 2.0.3.7 2009.09.18 -
Authentium 5.1.2.4 2009.09.19 -
Avast 4.8.1351.0 2009.09.18 -
AVG 8.5.0.412 2009.09.19 -
BitDefender 7.2 2009.09.19 -
CAT-QuickHeal 10.00 2009.09.19 -
ClamAV 0.94.1 2009.09.19 -
Comodo 2366 2009.09.19 -
DrWeb 5.0.0.12182 2009.09.19 -
eSafe 7.0.17.0 2009.09.17 -
eTrust-Vet 31.6.6746 2009.09.18 -
F-Prot 4.5.1.85 2009.09.18 -
F-Secure 8.0.14470.0 2009.09.18 -
Fortinet 3.120.0.0 2009.09.19 -
GData 19 2009.09.19 -
Ikarus T3.1.1.72.0 2009.09.19 -
Jiangmin 11.0.800 2009.09.19 -
K7AntiVirus 7.10.848 2009.09.18 -
Kaspersky 7.0.0.125 2009.09.19 -
McAfee 5745 2009.09.18 -
McAfee+Artemis 5745 2009.09.18 -
McAfee-GW-Edition 6.8.5 2009.09.18 -
Microsoft 1.5005 2009.09.19 -
NOD32 4439 2009.09.19 -
Norman 6.01.09 2009.09.18 -
nProtect 2009.1.8.0 2009.09.19 -
Panda 10.0.2.2 2009.09.18 -
PCTools 4.4.2.0 2009.09.18 -
Prevx 3.0 2009.09.19 -
Rising 21.47.51.00 2009.09.19 -
Sophos 4.45.0 2009.09.19 -
Sunbelt 3.2.1858.2 2009.09.19 -
Symantec 1.4.4.12 2009.09.19 -
TheHacker 6.5.0.2.012 2009.09.18 -
TrendMicro 8.950.0.1094 2009.09.18 -
VBA32 3.12.10.10 2009.09.18 -
ViRobot 2009.9.18.1943 2009.09.18 -
VirusBuster 4.6.5.0 2009.09.18 -
Information additionnelle
File size: 680 bytes

Fichier d3d9caps.dat reçu le 2009.09.19 08:50:56 (UTC)

le second...........

MD5 : 73634b25fd49b0030b966900f485bfdf
SHA1 : efdceb15d59b448df731f9fc3a666049fe7de608
SHA256: 6bbbd7c644ec638306da3937032ef08df8e24303cfff25b185241a8ecb852c58
TrID : File type identification
Unknown!
ssdeep: 3:spqNn+voW8jw//1lFlXm/lllelblll/Dlljlll/Dll:sAhTjw/e/l
PEiD : -
RDS : NSRL Reference Data Set
-

ATENTION ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.

Autre fichier
VirusTotal © Hispasec Sistemas - Blog - Contact: info@virustotal.com - Terms of Service & Privacy Policy

et voici le dernié rapport gmer............

GMER 1.0.15.15087 - http://www.gmer.net
Rootkit scan 2009-09-19 11:33:23
Windows 6.0.6002 Service Pack 2
Running: u37u6skt.exe; Driver: C:\Users\ALEXDI~1\AppData\Local\Temp\ffpyykog.sys

---- System - GMER 1.0.15 ----

SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwAlpcConnectPort [0x8D098880]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwConnectPort [0x8D0984E0]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateFile [0x8D095828]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateKey [0x8D0ABD9C]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreatePort [0x8D098C36]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateProcess [0x8D0A9AF8]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateProcessEx [0x8D0A9D12]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateSection [0x8D0AD780]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateWaitablePort [0x8D098CDE]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteFile [0x8D095D0A]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteKey [0x8D0AC698]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteValueKey [0x8D0AC414]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDuplicateObject [0x8D0A94F8]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey [0x8D0ACBC6]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey2 [0x8D0ACC3E]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKeyEx [0x8D0ACD2E]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwMapViewOfSection [0x8D0AD9D0]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenFile [0x8D095BA2]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenProcess [0x8D0AAF18]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRenameKey [0x8D0AD370]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwReplaceKey [0x8D0ACDA6]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRequestWaitReplyPort [0x8D09816A]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRestoreKey [0x8D0AD1B0]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSecureConnectPort [0x8D098680]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0x8D095EF8]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetValueKey [0x8D0AC11A]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSystemDebugControl [0x8D0AA486]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwTerminateProcess [0x8D0AA362]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateUserProcess [0x8D0A9F30]

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!KeSetEvent + 13D 820AE880 4 Bytes [80, 88, 09, 8D]
.text ntkrnlpa.exe!KeSetEvent + 1C1 820AE904 4 Bytes [E0, 84, 09, 8D]
.text ntkrnlpa.exe!KeSetEvent + 1D9 820AE91C 4 Bytes [28, 58, 09, 8D]
.text ntkrnlpa.exe!KeSetEvent + 1E9 820AE92C 4 Bytes [9C, BD, 0A, 8D]
.text ntkrnlpa.exe!KeSetEvent + 205 820AE948 12 Bytes [36, 8C, 09, 8D, F8, 9A, 0A, ...]
.text ...

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1588] kernel32.dll!SetUnhandledExceptionFilter 776EA84F 4 Bytes [C2, 04, 00, 00]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF dynamique/Microsoft Corporation)

---- Threads - GMER 1.0.15 ----

Thread System [4:364] 85F88790

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@FrequencyCorrectRate 4
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@PollAdjustFactor 5
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@LargePhaseOffset 50000000
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@SpikeWatchPeriod 900
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@LocalClockDispersion 10
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@HoldPeriod 5
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@PhaseCorrectRate 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@UpdateInterval 360000
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@EventLogFlags 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@AnnounceFlags 10
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@TimeJumpAuditOffset 28800
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@MinPollInterval 10
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@MaxPollInterval 15
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@MaxNegPhaseCorrection 54000
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@MaxPosPhaseCorrection 54000
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@MaxAllowedPhaseOffset 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@DllName %systemroot%\system32\w32time.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@Enabled 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@InputProvider 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@AllowNonstandardModeCombinations 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@CrossSiteSyncFlags 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@ResolvePeerBackoffMinutes 15
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@ResolvePeerBackoffMaxTimes 7
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@CompatibilityFlags -2147483648
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@EventLogFlags 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@LargeSampleSkew 3
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@SpecialPollInterval 604800
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@SpecialPollTimeRemaining time.windows.com,7b00b1e???????????
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer@DllName %systemroot%\system32\w32time.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer@Enabled 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer@InputProvider 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer@AllowNonstandardModeCombinations 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer@EventLogFlags 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer@ChainEntryTimeout 16
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer@ChainMaxEntries 128
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer@ChainMaxHostEntries 4
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer@ChainDisable 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer@ChainLoggingRate 30
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@FrequencyCorrectRate 4
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@PollAdjustFactor 5
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@LargePhaseOffset 50000000
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@SpikeWatchPeriod 900
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@LocalClockDispersion 10
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@HoldPeriod 5
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@PhaseCorrectRate 1
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@UpdateInterval 360000
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@EventLogFlags 2
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@AnnounceFlags 10
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@TimeJumpAuditOffset 28800
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@MinPollInterval 10
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@MaxPollInterval 15
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@MaxNegPhaseCorrection 54000
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@MaxPosPhaseCorrection 54000
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@MaxAllowedPhaseOffset 1
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@DllName %systemroot%\system32\w32time.dll
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@Enabled 1
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@InputProvider 1
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@AllowNonstandardModeCombinations 1
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@CrossSiteSyncFlags 2
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@ResolvePeerBackoffMinutes 15
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@ResolvePeerBackoffMaxTimes 7
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@CompatibilityFlags -2147483648
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@EventLogFlags 1
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@LargeSampleSkew 3
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@SpecialPollInterval 604800
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@SpecialPollTimeRemaining time.windows.com,7b00b1e???????????
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer@DllName %systemroot%\system32\w32time.dll
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer@Enabled 0
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer@InputProvider 0
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer@AllowNonstandardModeCombinations 1
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer@EventLogFlags 0
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer@ChainEntryTimeout 16
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer@ChainMaxEntries 128
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer@ChainMaxHostEntries 4
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer@ChainDisable 0
Reg HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer@ChainLoggingRate 30

---- EOF - GMER 1.0.15 ----

j'en ai trop marre de ce truc....
je reinitialise completement le pc.... merci quand même

salut

ok merci de prevenir

@+

salut

rien a voir avec les mises a jour (je pense) et rien a voir avec les elements que je t'ai fait desinstallé

Poste un RSIT pour voir après le formatage

regarde dans ces 2 liens aussi :

http://www.d2i.ch/pn/depannage/arret.html

https://support.microsoft.com/en-us

Logfile of random's system information tool 1.06 (written by random/random)
Run by alexandre at 2009-09-20 11:19:37
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
System drive C: has 107 GB (76%) free of 141 GB
Total RAM: 2046 MB (46% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:20:12, on 20/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\cg4ie\cg4ie.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\alexandre\Desktop\RSIT.exe
C:\Program Files\trend micro\alexandre.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\RunOnce: [srePostpone] rundll32.exe c:\windows\system32\zonelabs\srescan.dll,DoSpecialAction
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [CG4IE] C:\Program Files\cg4ie\cg4ie.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O23 - Service: BitDefender Arrakis Server (Arrakis3) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\System32\ZoneLabs\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

c'est quoi sa

poste un rapport GENPROC

http://ww11.genproc.com/tutorial_genproc/tutorial_genproc.html

et

* Télécharge Rooter (créé par l'équipe IDN) sur ton bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/Rooter.exe?attachauth=ANoY7cpzQksLcJt-e1z30LGu7t4JjUhh8amzWs_oSPSJpXbXp8ythGbW2WF8ysioh5NNlarrn7zMnYCRfsT5rCwNrfw5_CZYELApylTiY_MGu0G6uKzWpLEF2YXM3tF7nKZZAWj0JSAajXlZhd8dIyI3MrZ-lAIT5ZrAdcrct9_7bshwVpaZRPizuMTv9SDvmvY31BX4Vvvh2F2Brp1cy_K0jtTTfjttEA%3D%3D&attredirects=2
* /!\ Déconnecte toi d'internet et ferme toutes les applications en cours /!\
* Exécute Rooter et laisse le travailler jusqu'à l'apparition du rapport dans le bloc notes
* Ensuite poste le rapport dans ta prochaine réponse