Rapport hijackthis : je fais quoi ??

bonjour regis,

pour l'antivirus j'en sais rien, un ami a bidouillé récemment et apparemment il a désactivé le lancement...

merci Regis de me conseiller, niveau boulet mon ami et moi on se defend bien tu as vu?lol
Voici donc le rapport bitdefender, chargé ! :

bonne soirée a +


BitDefender Online Scanner



Rapport d'analyse généré à: Fri, Aug 04, 2006 - 20:35:17





Voie d'analyse: C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;







Statistiques

Temps
00:39:54

Fichiers
249956

Directoires
5589

Secteurs de boot
4

Archives
9634

Paquets programmes
14403




Résultats

Virus identifiés
6

Fichiers infectés
23

Fichiers suspects
1

Avertissements
0

Désinfectés
0

Fichiers effacés
24




Info sur les moteurs

Définition virus
426755

Version des moteurs
AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38)

Analyse des plugins
13

Archive des plugins
39

Unpack des plugins
5

E-mail plugins
6

Système plugins
1




Paramètres d'analyse

Première action
Désinfecté

Seconde Action
Supprimé

Heuristique
Oui

Acceptez les avertissements
Oui

Extensions analysées
*;

Excludez les extensions


Analyse d'emails
Oui

Analyse des Archives
Oui

Analyser paquets programmes
Oui

Analyse des fichiers
Oui

Analyse de boot
Oui




Fichier analysé
Statut

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP282\A0068876.exe
Infecté par: Dropped:Generic.Zlob.E76A2E5C

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP282\A0068876.exe
Echec de la désinfection

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP282\A0068876.exe
Supprimé

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP282\A0068877.tlb
Infecté par: Trojan.Downloader.Zlob.OE

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP282\A0068877.tlb
Echec de la désinfection

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP282\A0068877.tlb
Supprimé

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP318\A0093515.sys
Infecté par: Trojan.Downloader.Zlob.QZ

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP318\A0093515.sys
Echec de la désinfection

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP318\A0093515.sys
Supprimé

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP319\A0093523.sys
Infecté par: Trojan.Downloader.Zlob.QZ

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP319\A0093523.sys
Echec de la désinfection

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP319\A0093523.sys
Supprimé

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP319\A0093536.sys
Infecté par: Trojan.Downloader.Zlob.QZ

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP319\A0093536.sys
Echec de la désinfection

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP319\A0093536.sys
Supprimé

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP319\A0093552.sys
Infecté par: Trojan.Downloader.Zlob.QZ

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP319\A0093552.sys
Echec de la désinfection

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP319\A0093552.sys
Supprimé

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP320\A0093569.sys
Infecté par: Trojan.Downloader.Zlob.QZ

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP320\A0093569.sys
Echec de la désinfection

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP320\A0093569.sys
Supprimé

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP320\A0093576.sys
Infecté par: Trojan.Downloader.Zlob.QZ

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP320\A0093576.sys
Echec de la désinfection

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP320\A0093576.sys
Supprimé

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP324\A0095739.exe
Infecté par: Trojan.Downloader.PurityScan.BA

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP324\A0095739.exe
Echec de la désinfection

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP324\A0095739.exe
Supprimé

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095940.exe
Infecté par: Trojan.Agent.CUR

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095940.exe
Echec de la désinfection

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095940.exe
Supprimé

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095943.exe
Infecté par: Trojan.Agent.CUR

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095943.exe
Echec de la désinfection

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095943.exe
Supprimé

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095947.exe
Infecté par: Trojan.Agent.CUR

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095947.exe
Echec de la désinfection

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095947.exe
Supprimé

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095948.sys
Infecté par: Trojan.Downloader.Zlob.QZ

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095948.sys
Echec de la désinfection

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095948.sys
Supprimé

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095949.exe
Infecté par: Trojan.Downloader.Zlob.QZ

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095949.exe
Echec de la désinfection

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095949.exe
Supprimé

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095950.exe
Infecté par: Trojan.Downloader.Zlob.QZ

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095950.exe
Echec de la désinfection

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095950.exe
Supprimé

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095951.exe
Infecté par: Trojan.Downloader.Zlob.QZ

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095951.exe
Echec de la désinfection

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095951.exe
Supprimé

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095957.exe
Infecté par: Trojan.Downloader.Zlob.QZ

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095957.exe
Echec de la désinfection

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095957.exe
Supprimé

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095965.exe
Infecté par: Trojan.Downloader.Zlob.QZ

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095965.exe
Echec de la désinfection

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095965.exe
Supprimé

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095968.exe
Infecté par: Trojan.Downloader.Zlob.QZ

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095968.exe
Echec de la désinfection

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095968.exe
Supprimé

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095969.exe
Infecté par: Trojan.Downloader.Zlob.QZ

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095969.exe
Echec de la désinfection

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095969.exe
Supprimé

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095973.exe
Infecté par: Trojan.Downloader.Zlob.QZ

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095973.exe
Echec de la désinfection

C:\System Volume Information\_restore{F600EB76-36C2-42A6-AEB9-4496F7A72FEE}\RP326\A0095973.exe
Supprimé

C:\WINDOWS\system32\oins.exe
Infecté par: Trojan.Downloader.PurityScan.BA

C:\WINDOWS\system32\oins.exe
Echec de la désinfection

C:\WINDOWS\system32\oins.exe
Supprimé

C:\WINDOWS\Temp\ddl902.tmp.exe
Suspecté de: Generic.Malware.Sdld.8E162F22

C:\WINDOWS\Temp\ddl902.tmp.exe
Echec de la désinfection

C:\WINDOWS\Temp\ddl902.tmp.exe
Supprimé

C:\WINDOWS\Temp\win14DD.tmp.exe
Infecté par: Dropped:Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\win14DD.tmp.exe
Echec de la désinfection

C:\WINDOWS\Temp\win14DD.tmp.exe
Supprimé

lol ! c'eetait pas de la triche, je pensais que c'etait la même version que j'avais déja en effet ; voici donc le rapport avec la bonne version :


SmitFraudFix v2.79

Rapport fait à 23:13:24,95, 04/08/2006
Executé à partir de C:\Documents and Settings\SLVV\Mes documents\Mes eBooks\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\SLVV\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\SLVV\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

merci pour ta disponibilité !

voila le rapport hijackthis :

bonne nuit à toi .


Logfile of HijackThis v1.99.1
Scan saved at 23:27:23, on 04/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
c:\WINDOWS\system32\wisptis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {AC7D851A-04F0-4AE6-9A19-83245664641C} - C:\WINDOWS\system32\awvvs.dll (file missing)
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: ShopperReports - Compare travel rates - {946B3E9E-E21A-49c8-9F63-900533FAFE15} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.targa.gmbh/eng/targa/
O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cab
O16 - DPF: Interface Chat Voila - http://chat7.x-echo.com/version6/Applet/vchatsign.cab
O16 - DPF: Interface Chat Wanadoo - http://chat7.x-echo.com/version6/Applet/wchatsign.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O16 - DPF: {68A2C3BD-7809-11D3-8ACF-0050046F2F9A} (AXELPlayer Class) - http://www.mindavenue.com/
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\chkdsk.dll C:\WINDOWS\system32\ntvdm.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winepi32 - winepi32.dll (file missing)
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe

salut,

voila :


"Silent Runners.vbs", revision 46, https://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"msnmsgr" = ""C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background" [MS]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{00C6482D-C502-44C8-8409-FCE54AD9C208}\(Default) = (no title provided)
-> {HKLM...CLSID} = "HelperObject Class"
\InProcServer32\(Default) = "C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll" ["TechSmith Corporation"]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
{AC7D851A-04F0-4AE6-9A19-83245664641C}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\awvvs.dll" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{e57ce731-33e8-4c51-8354-bb4de9d215d1}" = "Périphériques Plug and Play universels"
-> {HKLM...CLSID} = "Périphériques Plug and Play universels"
\InProcServer32\(Default) = "C:\WINDOWS\system32\upnpui.dll" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}" = "SnagIt"
-> {HKLM...CLSID} = "SnagIt"
\InProcServer32\(Default) = "C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll" ["TechSmith Corporation"]
"{CF74B903-3389-469c-B3B6-0204D204FCBD}" = "SnagIt Shell Extension"
-> {HKLM...CLSID} = "SnagItShellExt Class"
\InProcServer32\(Default) = "C:\Program Files\TechSmith\SnagIt 7\SnagItShellExt.dll" ["TechSmith Corporation"]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {HKLM...CLSID} = "RealOne Player Context Menu Class"
\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"
-> {HKLM...CLSID} = "Mes dossiers de partage"
\InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.0.0792.00.dll" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{54D9498B-CF93-414F-8984-8CE7FDE0D391}" = "ewido shell guard"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-malware\shellhook.dll" ["TODO: <Firmenname>"]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\
INFECTION WARNING! "AppInit_DLLs" = " C:\WINDOWS\system32\chkdsk.dll C:\WINDOWS\system32\ntvdm.dll" [file not found]

HKLM\System\CurrentControlSet\Control\Session Manager\
INFECTION WARNING! "BootExecute" = "autocheck autochk * stera" [file not found], [MS], [file not found], [file not found]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! WgaLogon\DLLName = "WgaLogon.dll" [MS]
INFECTION WARNING! winepi32\DLLName = "winepi32.dll" [file not found]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
-> {HKLM...CLSID} = "Ctest Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-malware\context.dll" ["ewido networks"]
InoShell\(Default) = "{DCED20BE-3645-11D4-BC95-00C04F0E0588}"
-> {HKLM...CLSID} = "InoShell"
\InProcServer32\(Default) = "C:\Program Files\CA\eTrust Antivirus\InoShell.dll" ["Computer Associates International, Inc."]
SnagItMainShellExt\(Default) = "{CF74B903-3389-469c-B3B6-0204D204FCBD}"
-> {HKLM...CLSID} = "SnagItShellExt Class"
\InProcServer32\(Default) = "C:\Program Files\TechSmith\SnagIt 7\SnagItShellExt.dll" ["TechSmith Corporation"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
-> {HKLM...CLSID} = "Ctest Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-malware\context.dll" ["ewido networks"]
InoShell\(Default) = "{DCED20BE-3645-11D4-BC95-00C04F0E0588}"
-> {HKLM...CLSID} = "InoShell"
\InProcServer32\(Default) = "C:\Program Files\CA\eTrust Antivirus\InoShell.dll" ["Computer Associates International, Inc."]
SnagItMainShellExt\(Default) = "{CF74B903-3389-469c-B3B6-0204D204FCBD}"
-> {HKLM...CLSID} = "SnagItShellExt Class"
\InProcServer32\(Default) = "C:\Program Files\TechSmith\SnagIt 7\SnagItShellExt.dll" ["TechSmith Corporation"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\SLVV\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\system32\ssmypics.scr" [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 23
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}" = (no title provided)
-> {HKLM...CLSID} = "SnagIt"
\InProcServer32\(Default) = "C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll" ["TechSmith Corporation"]

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
{FE54FA40-D68C-11D2-98FA-00C0F0318AFE}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Real.com"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Shdocvw.dll" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{85D1F590-48F4-11D9-9669-0800200C9A66}\
"MenuText" = "Uninstall BitDefender Online Scanner v8"
"Exec" = "%windir%\bdoscandel.exe" [null data]

{946B3E9E-E21A-49C8-9F63-900533FAFE15}\
"ButtonText" = "ShopperReports - Compare travel rates"
"CLSIDExtension" = "{454b4812-e572-4703-a1bb-63490809eac0}"

{B205A35E-1FC4-4CE3-818B-899DBBB3388C}\

{CD67F990-D8E9-11D2-98FE-00C0F0318AFE}\
"ButtonText" = "Real.com"

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]


Miscellaneous IE Hijack Points
------------------------------

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

Added lines (compared with English-language version):
[Strings]: START_PAGE_URL=https://www.targa.gmbh/eng/targa/
[Strings]: SAFESITE_VALUE="https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fhome.microsoft.com%2fintl%2ffr%2f%3f"

Missing lines (compared with English-language version):
[Strings]: 2 lines


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

CyberLink Background Capture Service (CBCS), CLCapSvc, ""C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe"" [empty string]
CyberLink Media Library Service, CyberLink Media Library Service, ""C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe"" ["Cyberlink"]
CyberLink Task Scheduler (CTS), CLSched, ""C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe"" [empty string]
eTrust Antivirus Job Server, InoTask, ""C:\Program Files\CA\eTrust Antivirus\InoTask.exe"" ["Computer Associates International, Inc."]
eTrust Antivirus Realtime Server, InoRT, ""C:\Program Files\CA\eTrust Antivirus\InoRT.exe"" ["Computer Associates International, Inc."]
eTrust Antivirus RPC Server, InoRPC, ""C:\Program Files\CA\eTrust Antivirus\InoRpc.exe"" ["Computer Associates International, Inc."]
ewido security suite control, ewido security suite control, "C:\Program Files\ewido anti-malware\ewidoctrl.exe" ["ewido networks"]
HTTP SSL, HTTPFilter, "C:\WINDOWS\System32\svchost.exe -k HTTPFilter" {"C:\WINDOWS\System32\w3ssl.dll" [MS]}
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
EPSON V6 2KMonitor\Driver = "EBPMON24.DLL" ["SEIKO EPSON CORPORATION"]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 14 seconds, including 3 seconds for message boxes)

coucou Regis,

voila, j'ai suivi tous tes conseils et voici le rapport d'hijackthis :
merci pour ton aide et ta rapidité à me répondre, je sais à qui demander la prochaine fois ! ;o)
bon w-e.

Logfile of HijackThis v1.99.1
Scan saved at 17:15:04, on 05/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\SLVV\Mes documents\Mes eBooks\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: ShopperReports - Compare travel rates - {946B3E9E-E21A-49c8-9F63-900533FAFE15} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.targa.gmbh/eng/targa/
O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cab
O16 - DPF: Interface Chat Voila - http://chat7.x-echo.com/version6/Applet/vchatsign.cab
O16 - DPF: Interface Chat Wanadoo - http://chat7.x-echo.com/version6/Applet/wchatsign.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O16 - DPF: {68A2C3BD-7809-11D3-8ACF-0050046F2F9A} (AXELPlayer Class) - http://www.mindavenue.com/
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe

lol ! ben oui à toi ! avec tous tes conseils tout est rentré dans l'ordre, chapeau !

Merci encore à ++