Piratage ou "prendre la main" sur mon pc

Résolu
Bonjour, j'ai donné mon pc en réparation à une personne que je connais peu et depuis il y a des trucs bizzares qui se passent dessus :
Déconnexion automatique de msn
Double clic et mauvais contrôle de la souris
Fermeture intempestive de Lecteur Windows Média
Changement de paramètres dans msn principalement

Alors soit je suis devenu "folle" soit cette personne à introduit un logiciel ou à un contrôle sur mon pc.

Merci de votre aide !!!
Configuration: Windows XP
Internet Explorer 6.0

25 réponses

Résumé de la discussion

Plusieurs symptômes après réparation: déconnexions MSN, double clic erratique, fermeture du Lecteur Windows Média et modification des paramètres MSN, suggérant une possible infection ou contrôle à distance. Des réponses conseillent l’analyse avec HijackThis et la suppression d’entrées suspectes (BHO, barres d’outils) pour rétablir le fonctionnement et éviter des répercussions sur la navigation et le système. D’autres messages évoquent l’utilisation d’AVG Anti-Spyware ou d’Ewido pour supprimer les cookies de suivi et les débris restants, puis remet en place les paramètres et met à jour les logiciels. En parallèle, certaines interventions relèvent d’expériences d’arnaque par des réparateurs peu scrupuleux et insistent sur la nécessité d’un recours auprès des autorités ou services consommateurs.

Bobot (l’IA à votre service)
  1. salut,

    * Télécharge combofix.exe (par sUBs) sur ton Bureau.

    http://download.bleepingcomputer.com/sUBs/Beta/ComboFix.exe

    * Double clique combofix.exe.
    * Tape sur la touche 1 (Yes) pour démarrer le scan.
    * Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

    NOTE : Le rapport se trouve également ici : C:\Combofix.txt
    0
    1. ComboFix 07-08-17.2 - "Administrateur" 2007-08-18 12:19:47.2 - NTFSx86
      Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.88 [GMT 2:00]

      ((((((((((((((((((((((((( Files Created from 2007-07-18 to 2007-08-18 )))))))))))))))))))))))))))))))

      2007-08-18 12:09 51,200 --a------ C:\WINDOWS\nircmd.exe
      2007-08-18 11:53 <REP> d-------- C:\WINDOWS\system32\Panda Software
      2007-08-18 11:53 <REP> d-------- C:\WINDOWS\LastGood
      2007-08-17 21:59 <REP> d-------- C:\WINDOWS\system32\NtmsData
      2007-08-17 20:51 <REP> d--h----- C:\WINDOWS\system32\GroupPolicy
      2007-08-12 13:10 19,793 --a------ C:\WINDOWS\cc_20070812_1310.reg

      (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

      2007-08-16 19:26 --------- d-------- C:\Program Files\Fichiers communs\AOL
      2007-08-12 23:03 --------- d-------- C:\Program Files\AOL 9.0
      2007-08-12 16:04 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\AdobeUM
      2007-07-28 00:07 783224 --a------ C:\WINDOWS\system32\aswBoot.exe
      2007-07-28 00:02 94416 --a--c--- C:\WINDOWS\system32\drivers\aswmon2.sys
      2007-07-28 00:02 92848 --a--c--- C:\WINDOWS\system32\drivers\aswmon.sys
      2007-07-28 00:00 23152 --a--c--- C:\WINDOWS\system32\drivers\aswRdr.sys
      2007-07-27 23:59 42912 --a--c--- C:\WINDOWS\system32\drivers\aswTdi.sys
      2007-07-27 23:58 26624 --a--c--- C:\WINDOWS\system32\drivers\aavmker4.sys
      2007-07-27 23:57 95608 --a------ C:\WINDOWS\system32\AVASTSS.scr
      2007-06-21 12:01 103720 --a------ C:\WINDOWS\system32\AOLDial.dll

      ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

      *Note* empty entries & legit default entries are not shown

      [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF4DA5D4-805B-9066-3918-A21B9B156B2A}]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "SoundMan"="soundman.exe" [2002-03-22 19:48 C:\WINDOWS\soundman.exe]
      "HostManager"="C:\Program Files\Fichiers communs\AOL\1166697745\ee\AOLSoftware.exe" [2006-11-17 15:16]

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2005-06-14 18:05]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^AOL 9.0 Icône AOL.lnk]
      path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\AOL 9.0 Icône AOL.lnk
      backup=C:\WINDOWS\pss\AOL 9.0 Icône AOL.lnkCommon Startup

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^AOL Compagnon.lnk]
      path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\AOL Compagnon.lnk
      backup=C:\WINDOWS\pss\AOL Compagnon.lnkCommon Startup

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
      C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
      "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CapFax]
      C:\Program Files\Classic PhoneTools\CapFax.EXE

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
      C:\Program Files\Fichiers communs\AOL\1166697745\ee\AOLSoftware.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
      "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odebit Multimedia V3]
      C:\Program Files\Odebit Multimédia\V3\Odebit.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odebit Multimedia V3 - Services]
      C:\Program Files\Odebit Multimédia\V3\Odebit.exe /info

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
      "C:\Program Files\QuickTime\qttask.exe" -atboottime

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
      C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics]
      "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
      C:\Program Files\Winamp\winampa.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
      "TapiSrv"=3 (0x3)
      "BthServ"=2 (0x2)
      "avast! Web Scanner"=3 (0x3)
      "avast! Mail Scanner"=3 (0x3)
      "avast! Antivirus"=2 (0x2)

      R1 VIAPFD;VIAPFD;C:\WINDOWS\system32\Drivers\VIAPFD.SYS
      R3 alcan5ln;SpeedTouch(tm) USB ADSL RFC1483 Networking Driver (NDIS);C:\WINDOWS\system32\DRIVERS\alcan5ln.sys
      S3 AN983;Carte Fast Ethernet 10/100 Mbps ADMtek AN983/AN985/ADM951X;C:\WINDOWS\system32\DRIVERS\AN983.sys
      S3 Aox402Camera;SE402 Video Camera (WDM);C:\WINDOWS\system32\DRIVERS\se402vc.sys
      S3 driverhardwarev2;driverhardwarev2;\??\C:\Program Files\HardwareDetection\driverhardwarev2.sys
      S3 MR97310_USB_DUAL_CAMERA;XDC-Series;C:\WINDOWS\system32\DRIVERS\mr97310c.sys
      S3 SE402RefCameraStill;SE402 Still Camera (WDM);C:\WINDOWS\system32\DRIVERS\se402sc.sys

      *Newly Created Service* - CATCHME
      *Newly Created Service* - RKPAVPROC

      Contents of the 'Scheduled Tasks' folder
      2007-08-18 09:24:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE

      **************************************************************************

      catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2007-08-18 12:20:26
      Windows 5.1.2600 Service Pack 2 NTFS

      scanning hidden processes ...

      scanning hidden autostart entries ...

      scanning hidden files ...

      scan completed successfully
      hidden files: 0

      **************************************************************************

      Completion time: 2007-08-18 12:21:06
      C:\ComboFix-quarantined-files.txt ... 2007-08-18 12:20
      C:\ComboFix2.txt ... 2007-08-18 12:11

      --- E O F ---
      0
  2. Fichier joint téléchargé et installer, analyse faite mais comment savoir le résultat ?
    Plein de chiffre incompréhensible et langage anglais un peu technique !
    Merci de me dire si je peux savoir le résultat de l'analyse faite.
    Merci à nouveau de votre aide.
    Slts.
    0
    1. peux tu mettre un hijack this stp :

      * Télécharge HijackThis et poste le rapport stp

      http://pchelpbordeaux.free.fr/logiciels.html
      Tutorial
      http://pchelpbordeaux.free.fr/tuto.html
      Démo en image
      http://pageperso.aol.fr/balltrap34/demohijack.htm

      @+
      0
      1. Boomscud
        Boomscud
        1A23-0025-8030-1583-4629-7773

        Windows XP 5.1
        IA32
        WinAspi: File 'Wnaspi32.dll': Ver=4.71 (0002), size=45056 bytes, created 17/07/2002 12:20:56
        ahead WinASPI: File 'C:\Program Files\Ahead\nero\Wnaspi32.dll': Ver=2.0.1.68, size=160016 bytes, created 22/07/2004 17:33:44
        Nero version: 6.3.1.20
        Recorder: < Image Recorder> Version: Not available - HA -1 TA 0 - 6.3.1.20
        Adapter driver: <Virtual Device> HA -1
        Drive buffer :
        CD-ROM: <CD-R/RW CW079D CD-R/RW >Version: 11SJ - HA 1 TA 1 - 6.3.1.20
        Adapter driver: <atapi> HA 1

        === Scsi-Device-Map ===
        DiskPeripheral : ExcelStor Technology J240 atapi Port 0 ID 0 DMA: On
        DiskPeripheral : ST38410A atapi Port 0 ID 1 DMA: On
        CdRomPeripheral : IDE DVD-ROM 16X atapi Port 1 ID 0 DMA: On
        CdRomPeripheral : CD-R/RW CW079D CD-R/RW atapi Port 1 ID 1 DMA: On

        === CDRom-Device-Map ===
        IDE DVD-ROM 16X D: CDRom0
        CD-R/RW CW079D CD-R/RW E: CDRom1
        =======================

        AutoRun : 1
        Excluded drive IDs:
        WriteBufferSize: 57671680 (0) Byte
        ShowDrvBufStat : 0
        BUFE : 0
        Physical memory : 383MB (392688kB)
        Free physical memory: 115MB (118480kB)
        Memory in use : 69 %
        Uncached PFiles: 0x0
        Use Static Write Speed Table: 0
        Use Inquiry : 1
        Global Bus Type: default (0)
        Check supported media : Disabled (0)

        27.4.2007
        CD EXTRA
        10:29:32 #1 Text 0 File Isodoc.cpp, Line 6065
        Iso document burn settings
        ------------------------------------------
        Determine maximum speed : FALSE
        Simulate : FALSE
        Write : TRUE
        Finalize CD : TRUE
        Multisession : FALSE
        Burning mode : TAO
        Mode : 2 / XA
        ISO Level : 1 (Max. of 11 = 8 + 3 char)
        Character set : ISO 9660
        Joliet : TRUE
        Allow pathdepth more than 8 directories : TRUE
        Allow more than 255 characters in path : TRUE
        Write ISO9660 ;1 file extensions : TRUE

        10:29:32 #2 CDADOC -1 File Cdadoc.cpp, Line 1508
        Audio item log info:
        Audio document burn settings:
        =============================
        Burn mode: TAO,
        CD Text: Off,
        Cache disk or network files: Yes,
        Cache small files: Yes,
        Cache files smaller than 65536 bytes.
        Audio Multisession: No
        List of audio tracks:
        =====================
        Track 01: Length: 04:11.18, Pause frames: 150, Filters: 0, Name: '01. aimer est plus fort que d'être aimé.mp3'.
        Track 02: Length: 05:06.44, Pause frames: 150, Filters: 0, Name: '02. tous les cris les SOS.mp3'.
        Track 03: Length: 04:21.69, Pause frames: 150, Filters: 0, Name: '03. l'aziza.mp3'.
        Track 04: Length: 03:36.10, Pause frames: 150, Filters: 0, Name: '04. le blues est blanc.mp3'.
        Track 05: Length: 04:24.48, Pause frames: 150, Filters: 0, Name: '05. sauver l'amour.mp3'.
        Track 06: Length: 04:45.29, Pause frames: 150, Filters: 0, Name: '06. petite Angèle.mp3'.
        Track 07: Length: 04:58.51, Pause frames: 150, Filters: 0, Name: '07. petit homme mort au combat.mp3'.
        Track 08: Length: 04:34.68, Pause frames: 150, Filters: 0, Name: '08. ne parle pas de malheur.mp3'.
        Track 09: Length: 05:52.27, Pause frames: 150, Filters: 0, Name: '09. un enfant assis attend la pluie.mp3'.
        Track 10: Length: 03:46.38, Pause frames: 150, Filters: 0, Name: '01. les oiseaux (1ère partie).mp3'.
        Track 11: Length: 03:32.41, Pause frames: 150, Filters: 0, Name: '02. les oiseaux (2ème partie).mp3'.
        Track 12: Length: 03:20.58, Pause frames: 150, Filters: 0, Name: '03. France.mp3'.
        Track 13: Length: 03:05.03, Pause frames: 150, Filters: 0, Name: '04. c'est un voyou.mp3'.
        Track 14: Length: 05:27.15, Pause frames: 150, Filters: 0, Name: '05. Lucie.mp3'.
        Track 15: Length: 03:54.70, Pause frames: 150, Filters: 0, Name: '06. le chanteur.mp3'.
        Track 16: Length: 03:29.00, Pause frames: 150, Filters: 0, Name: '07. si je suis fou.mp3'.
        Track 17: Length: 04:48.09, Pause frames: 150, Filters: 0, Name: '08. oiseau de nuit.mp3'.
        Track 18: Length: 03:48.01, Pause frames: 150, Filters: 0, Name: '09. le pied par terre.mp3'.
        Total size: 77:39.74

        10:29:32 #3 Phase 73 File dlgbrnst.cpp, Line 1855
        Preparing items

        10:29:32 #4 Text 0 File Reader.cpp, Line 126
        Reader running

        10:29:32 #5 Text 0 File AudioCompilationImpl.cpp, Line 817
        DRM: StartDrmRecording(RealRec:0, ImageRec:1, Copies:1)
        DRM: Beginning burn process.

        10:29:32 #6 ISO9660GEN -11 File geniso.cpp, Line 3899
        First writeable address = 0 (0x00000000)

        10:29:32 #7 Text 0 File Burncd.cpp, Line 3173
        Turn on Track-at-once, using CD-R/RW media

        10:29:32 #8 Text 0 File DlgWaitCD.cpp, Line 247
        Last possible write address on media: 2147483646 (477218:37.21)
        Last address to be written: 361348 ( 80:19.73)

        10:29:32 #9 Text 0 File DlgWaitCD.cpp, Line 259
        Write in overburning mode: NO (enabled: CD)

        10:29:32 #10 Text 0 File DlgWaitCD.cpp, Line 2162
        Recorder: Image Recorder;
        CD type reading failed
        ATIP Data: ?

        10:29:32 #11 Text 0 File DlgWaitCD.cpp, Line 420
        >>> Protocol of DlgWaitCD activities: <<<
        =========================================

        10:29:32 #12 Text 0 File ThreadedTransferInterface.cpp, Line 813
        Setup items (after recorder preparation)
        0: TRM_AUDIO_NOPRE (01. aimer est plus fort que d'être aimé.mp3)
        2 indices, index0 (150) not provided
        original disc pos #0 + 18843 (18843) = #18843/4:11.18
        relocatable, disc pos for caching/writing not required/not required, no patch infos
        -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 18843 blocks [ Image Recorder ]
        1: TRM_AUDIO_NOPRE (02. tous les cris les SOS.mp3)
        2 indices, index0 (150) not provided
        original disc pos #0 + 22994 (22994) = #22994/5:6.44
        relocatable, disc pos for caching/writing not required/not required, no patch infos
        -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 22994 blocks [ Image Recorder ]
        2: TRM_AUDIO_NOPRE (03. l'aziza.mp3)
        2 indices, index0 (150) not provided
        original disc pos #0 + 19644 (19644) = #19644/4:21.69
        relocatable, disc pos for caching/writing not required/not required, no patch infos
        -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 19644 blocks [ Image Recorder ]
        3: TRM_AUDIO_NOPRE (04. le blues est blanc.mp3)
        2 indices, index0 (150) not provided
        original disc pos #0 + 16210 (16210) = #16210/3:36.10
        relocatable, disc pos for caching/writing not required/not required, no patch infos
        -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 16210 blocks [ Image Recorder ]
        4: TRM_AUDIO_NOPRE (05. sauver l'amour.mp3)
        2 indices, index0 (150) not provided
        original disc pos #0 + 19848 (19848) = #19848/4:24.48
        relocatable, disc pos for caching/writing not required/not required, no patch infos
        -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 19848 blocks [ Image Recorder ]
        5: TRM_AUDIO_NOPRE (06. petite Angèle.mp3)
        2 indices, index0 (150) not provided
        original disc pos #0 + 21404 (21404) = #21404/4:45.29
        relocatable, disc pos for caching/writing not required/not required, no patch infos
        -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 21404 blocks [ Image Recorder ]
        6: TRM_AUDIO_NOPRE (07. petit homme mort au combat.mp3)
        2 indices, index0 (150) not provided
        original disc pos #0 + 22401 (22401) = #22401/4:58.51
        relocatable, disc pos for caching/writing not required/not required, no patch infos
        -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 22401 blocks [ Image Recorder ]
        7: TRM_AUDIO_NOPRE (08. ne parle pas de malheur.mp3)
        2 indices, index0 (150) not provided
        original disc pos #0 + 20618 (20618) = #20618/4:34.68
        relocatable, disc pos for caching/writing not required/not required, no patch infos
        -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 20618 blocks [ Image Recorder ]
        8: TRM_AUDIO_NOPRE (09. un enfant assis attend la pluie.mp3)
        2 indices, index0 (150) not provided
        original disc pos #0 + 26427 (26427) = #26427/5:52.27
        relocatable, disc pos for caching/writing not required/not required, no patch infos
        -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 26427 blocks [ Image Recorder ]
        9: TRM_AUDIO_NOPRE (01. les oiseaux (1ère partie).mp3)
        2 indices, index0 (150) not provided
        original disc pos #0 + 16988 (16988) = #16988/3:46.38
        relocatable, disc pos for caching/writing not required/not required, no patch infos
        -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 16988 blocks [ Image Recorder ]
        10: TRM_AUDIO_NOPRE (02. les oiseaux (2ème partie).mp3)
        2 indices, index0 (150) not provided
        original disc pos #0 + 15941 (15941) = #15941/3:32.41
        relocatable, disc pos for caching/writing not required/not required, no patch infos
        -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 15941 blocks [ Image Recorder ]
        11: TRM_AUDIO_NOPRE (03. France.mp3)
        2 indices, index0 (150) not provided
        original disc pos #0 + 15058 (15058) = #15058/3:20.58
        relocatable, disc pos for caching/writing not required/not required, no patch infos
        -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 15058 blocks [ Image Recorder ]
        12: TRM_AUDIO_NOPRE (04. c'est un voyou.mp3)
        2 indices, index0 (150) not provided
        original disc pos #0 + 13878 (13878) = #13878/3:5.3
        relocatable, disc pos for caching/writing not required/not required, no patch infos
        -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 13878 blocks [ Image Recorder ]
        13: TRM_AUDIO_NOPRE (05. Lucie.mp3)
        2 indices, index0 (150) not provided
        original disc pos #0 + 24540 (24540) = #24540/5:27.15
        relocatable, disc pos for caching/writing not required/not required, no patch infos
        -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 24540 blocks [ Image Recorder ]
        14: TRM_AUDIO_NOPRE (06. le chanteur.mp3)
        2 indices, index0 (150) not provided
        original disc pos #0 + 17620 (17620) = #17620/3:54.70
        relocatable, disc pos for caching/writing not required/not required, no patch infos
        -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 17620 blocks [ Image Recorder ]
        15: TRM_AUDIO_NOPRE (07. si je suis fou.mp3)
        2 indices, index0 (150) not provided
        original disc pos #0 + 15675 (15675) = #15675/3:29.0
        relocatable, disc pos for caching/writing not required/not required, no patch infos
        -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 15675 blocks [ Image Recorder ]
        16: TRM_AUDIO_NOPRE (08. oiseau de nuit.mp3)
        2 indices, index0 (150) not provided
        original disc pos #0 + 21609 (21609) = #21609/4:48.9
        relocatable, disc pos for caching/writing not required/not required, no patch infos
        -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 21609 blocks [ Image Recorder ]
        17: TRM_AUDIO_NOPRE (09. le pied par terre.mp3)
        2 indices, index0 (150) not provided
        original disc pos #0 + 17101 (17101) = #17101/3:48.1
        relocatable, disc pos for caching/writing not required/not required, no patch infos
        -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 17101 blocks [ Image Recorder ]
        --------------------------------------------------------------
        18: TRM_DATA_MODE2_FORM1_NOSUB (CTransferItem)
        2 indices, index0 (150) not provided
        original disc pos #0 + 600 (600) = #600/0:8.0
        relocatable, disc pos for caching/writing not required/required, no patch infos
        -> TRM_DATA_MODE2_FORM1_NOSUB, 2048, config 0, wanted index0 0 blocks, length 600 blocks [ Image Recorder ]
        --------------------------------------------------------------

        10:29:36 #13 Phase 40 File dlgbrnst.cpp, Line 1855
        Aborted by user

        10:29:36 #14 Text 0 File AudioCompilationImpl.cpp, Line 828
        DRM: DRM burn session terminated.

        10:29:36 #15 Text 0 File AudioCompilationImpl.cpp, Line 857
        DRM: Closing entire DRM handling. Bye.

        Existing drivers:
        File 'Drivers\CDRALW2K.SYS': Ver=8.0.0.212 , size=2560 bytes, created 05/10/2006 04:42:42
        File 'Drivers\ASPI32.SYS': Ver=4.71 (0002), size=16877 bytes, created 17/07/2002 11:53:02
        File 'Drivers\PXHELP20.SYS': Ver=3.00.41a, size=36560 bytes, created 27/09/2006 23:53:22 (Prassi/Veritas driver for win 2K)
        File 'Drivers\atapi.sys': Ver=?.?.?.?, size=95360 bytes, created 03/08/2004 23:59:44 (Adapter driver for src)

        Registry Keys:
        HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\AllocateCDROMs : 0 (Security Option)

        Merci de votre aide
        0
        1. je voulais voie un log hijack this...
          0
          1. Boomscud
            Boomscud
            1A23-0025-8030-1583-4629-7773

            Windows XP 5.1
            IA32
            WinAspi: File 'Wnaspi32.dll': Ver=4.71 (0002), size=45056 bytes, created 17/07/2002 12:20:56
            ahead WinASPI: File 'C:\Program Files\Ahead\nero\Wnaspi32.dll': Ver=2.0.1.68, size=160016 bytes, created 22/07/2004 17:33:44
            Nero version: 6.3.1.20
            Recorder: < Image Recorder> Version: Not available - HA -1 TA 0 - 6.3.1.20
            Adapter driver: <Virtual Device> HA -1
            Drive buffer :
            CD-ROM: <CD-R/RW CW079D CD-R/RW >Version: 11SJ - HA 1 TA 1 - 6.3.1.20
            Adapter driver: <atapi> HA 1

            === Scsi-Device-Map ===
            DiskPeripheral : ExcelStor Technology J240 atapi Port 0 ID 0 DMA: On
            DiskPeripheral : ST38410A atapi Port 0 ID 1 DMA: On
            CdRomPeripheral : IDE DVD-ROM 16X atapi Port 1 ID 0 DMA: On
            CdRomPeripheral : CD-R/RW CW079D CD-R/RW atapi Port 1 ID 1 DMA: On

            === CDRom-Device-Map ===
            IDE DVD-ROM 16X D: CDRom0
            CD-R/RW CW079D CD-R/RW E: CDRom1
            =======================

            AutoRun : 1
            Excluded drive IDs:
            WriteBufferSize: 57671680 (0) Byte
            ShowDrvBufStat : 0
            BUFE : 0
            Physical memory : 383MB (392688kB)
            Free physical memory: 115MB (118480kB)
            Memory in use : 69 %
            Uncached PFiles: 0x0
            Use Static Write Speed Table: 0
            Use Inquiry : 1
            Global Bus Type: default (0)
            Check supported media : Disabled (0)

            27.4.2007
            CD EXTRA
            10:29:32 #1 Text 0 File Isodoc.cpp, Line 6065
            Iso document burn settings
            ------------------------------------------
            Determine maximum speed : FALSE
            Simulate : FALSE
            Write : TRUE
            Finalize CD : TRUE
            Multisession : FALSE
            Burning mode : TAO
            Mode : 2 / XA
            ISO Level : 1 (Max. of 11 = 8 + 3 char)
            Character set : ISO 9660
            Joliet : TRUE
            Allow pathdepth more than 8 directories : TRUE
            Allow more than 255 characters in path : TRUE
            Write ISO9660 ;1 file extensions : TRUE

            10:29:32 #2 CDADOC -1 File Cdadoc.cpp, Line 1508
            Audio item log info:
            Audio document burn settings:
            =============================
            Burn mode: TAO,
            CD Text: Off,
            Cache disk or network files: Yes,
            Cache small files: Yes,
            Cache files smaller than 65536 bytes.
            Audio Multisession: No
            List of audio tracks:
            =====================
            Track 01: Length: 04:11.18, Pause frames: 150, Filters: 0, Name: '01. aimer est plus fort que d'être aimé.mp3'.
            Track 02: Length: 05:06.44, Pause frames: 150, Filters: 0, Name: '02. tous les cris les SOS.mp3'.
            Track 03: Length: 04:21.69, Pause frames: 150, Filters: 0, Name: '03. l'aziza.mp3'.
            Track 04: Length: 03:36.10, Pause frames: 150, Filters: 0, Name: '04. le blues est blanc.mp3'.
            Track 05: Length: 04:24.48, Pause frames: 150, Filters: 0, Name: '05. sauver l'amour.mp3'.
            Track 06: Length: 04:45.29, Pause frames: 150, Filters: 0, Name: '06. petite Angèle.mp3'.
            Track 07: Length: 04:58.51, Pause frames: 150, Filters: 0, Name: '07. petit homme mort au combat.mp3'.
            Track 08: Length: 04:34.68, Pause frames: 150, Filters: 0, Name: '08. ne parle pas de malheur.mp3'.
            Track 09: Length: 05:52.27, Pause frames: 150, Filters: 0, Name: '09. un enfant assis attend la pluie.mp3'.
            Track 10: Length: 03:46.38, Pause frames: 150, Filters: 0, Name: '01. les oiseaux (1ère partie).mp3'.
            Track 11: Length: 03:32.41, Pause frames: 150, Filters: 0, Name: '02. les oiseaux (2ème partie).mp3'.
            Track 12: Length: 03:20.58, Pause frames: 150, Filters: 0, Name: '03. France.mp3'.
            Track 13: Length: 03:05.03, Pause frames: 150, Filters: 0, Name: '04. c'est un voyou.mp3'.
            Track 14: Length: 05:27.15, Pause frames: 150, Filters: 0, Name: '05. Lucie.mp3'.
            Track 15: Length: 03:54.70, Pause frames: 150, Filters: 0, Name: '06. le chanteur.mp3'.
            Track 16: Length: 03:29.00, Pause frames: 150, Filters: 0, Name: '07. si je suis fou.mp3'.
            Track 17: Length: 04:48.09, Pause frames: 150, Filters: 0, Name: '08. oiseau de nuit.mp3'.
            Track 18: Length: 03:48.01, Pause frames: 150, Filters: 0, Name: '09. le pied par terre.mp3'.
            Total size: 77:39.74

            10:29:32 #3 Phase 73 File dlgbrnst.cpp, Line 1855
            Preparing items

            10:29:32 #4 Text 0 File Reader.cpp, Line 126
            Reader running

            10:29:32 #5 Text 0 File AudioCompilationImpl.cpp, Line 817
            DRM: StartDrmRecording(RealRec:0, ImageRec:1, Copies:1)
            DRM: Beginning burn process.

            10:29:32 #6 ISO9660GEN -11 File geniso.cpp, Line 3899
            First writeable address = 0 (0x00000000)

            10:29:32 #7 Text 0 File Burncd.cpp, Line 3173
            Turn on Track-at-once, using CD-R/RW media

            10:29:32 #8 Text 0 File DlgWaitCD.cpp, Line 247
            Last possible write address on media: 2147483646 (477218:37.21)
            Last address to be written: 361348 ( 80:19.73)

            10:29:32 #9 Text 0 File DlgWaitCD.cpp, Line 259
            Write in overburning mode: NO (enabled: CD)

            10:29:32 #10 Text 0 File DlgWaitCD.cpp, Line 2162
            Recorder: Image Recorder;
            CD type reading failed
            ATIP Data: ?

            10:29:32 #11 Text 0 File DlgWaitCD.cpp, Line 420
            >>> Protocol of DlgWaitCD activities: <<<
            =========================================

            10:29:32 #12 Text 0 File ThreadedTransferInterface.cpp, Line 813
            Setup items (after recorder preparation)
            0: TRM_AUDIO_NOPRE (01. aimer est plus fort que d'être aimé.mp3)
            2 indices, index0 (150) not provided
            original disc pos #0 + 18843 (18843) = #18843/4:11.18
            relocatable, disc pos for caching/writing not required/not required, no patch infos
            -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 18843 blocks [ Image Recorder ]
            1: TRM_AUDIO_NOPRE (02. tous les cris les SOS.mp3)
            2 indices, index0 (150) not provided
            original disc pos #0 + 22994 (22994) = #22994/5:6.44
            relocatable, disc pos for caching/writing not required/not required, no patch infos
            -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 22994 blocks [ Image Recorder ]
            2: TRM_AUDIO_NOPRE (03. l'aziza.mp3)
            2 indices, index0 (150) not provided
            original disc pos #0 + 19644 (19644) = #19644/4:21.69
            relocatable, disc pos for caching/writing not required/not required, no patch infos
            -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 19644 blocks [ Image Recorder ]
            3: TRM_AUDIO_NOPRE (04. le blues est blanc.mp3)
            2 indices, index0 (150) not provided
            original disc pos #0 + 16210 (16210) = #16210/3:36.10
            relocatable, disc pos for caching/writing not required/not required, no patch infos
            -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 16210 blocks [ Image Recorder ]
            4: TRM_AUDIO_NOPRE (05. sauver l'amour.mp3)
            2 indices, index0 (150) not provided
            original disc pos #0 + 19848 (19848) = #19848/4:24.48
            relocatable, disc pos for caching/writing not required/not required, no patch infos
            -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 19848 blocks [ Image Recorder ]
            5: TRM_AUDIO_NOPRE (06. petite Angèle.mp3)
            2 indices, index0 (150) not provided
            original disc pos #0 + 21404 (21404) = #21404/4:45.29
            relocatable, disc pos for caching/writing not required/not required, no patch infos
            -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 21404 blocks [ Image Recorder ]
            6: TRM_AUDIO_NOPRE (07. petit homme mort au combat.mp3)
            2 indices, index0 (150) not provided
            original disc pos #0 + 22401 (22401) = #22401/4:58.51
            relocatable, disc pos for caching/writing not required/not required, no patch infos
            -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 22401 blocks [ Image Recorder ]
            7: TRM_AUDIO_NOPRE (08. ne parle pas de malheur.mp3)
            2 indices, index0 (150) not provided
            original disc pos #0 + 20618 (20618) = #20618/4:34.68
            relocatable, disc pos for caching/writing not required/not required, no patch infos
            -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 20618 blocks [ Image Recorder ]
            8: TRM_AUDIO_NOPRE (09. un enfant assis attend la pluie.mp3)
            2 indices, index0 (150) not provided
            original disc pos #0 + 26427 (26427) = #26427/5:52.27
            relocatable, disc pos for caching/writing not required/not required, no patch infos
            -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 26427 blocks [ Image Recorder ]
            9: TRM_AUDIO_NOPRE (01. les oiseaux (1ère partie).mp3)
            2 indices, index0 (150) not provided
            original disc pos #0 + 16988 (16988) = #16988/3:46.38
            relocatable, disc pos for caching/writing not required/not required, no patch infos
            -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 16988 blocks [ Image Recorder ]
            10: TRM_AUDIO_NOPRE (02. les oiseaux (2ème partie).mp3)
            2 indices, index0 (150) not provided
            original disc pos #0 + 15941 (15941) = #15941/3:32.41
            relocatable, disc pos for caching/writing not required/not required, no patch infos
            -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 15941 blocks [ Image Recorder ]
            11: TRM_AUDIO_NOPRE (03. France.mp3)
            2 indices, index0 (150) not provided
            original disc pos #0 + 15058 (15058) = #15058/3:20.58
            relocatable, disc pos for caching/writing not required/not required, no patch infos
            -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 15058 blocks [ Image Recorder ]
            12: TRM_AUDIO_NOPRE (04. c'est un voyou.mp3)
            2 indices, index0 (150) not provided
            original disc pos #0 + 13878 (13878) = #13878/3:5.3
            relocatable, disc pos for caching/writing not required/not required, no patch infos
            -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 13878 blocks [ Image Recorder ]
            13: TRM_AUDIO_NOPRE (05. Lucie.mp3)
            2 indices, index0 (150) not provided
            original disc pos #0 + 24540 (24540) = #24540/5:27.15
            relocatable, disc pos for caching/writing not required/not required, no patch infos
            -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 24540 blocks [ Image Recorder ]
            14: TRM_AUDIO_NOPRE (06. le chanteur.mp3)
            2 indices, index0 (150) not provided
            original disc pos #0 + 17620 (17620) = #17620/3:54.70
            relocatable, disc pos for caching/writing not required/not required, no patch infos
            -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 17620 blocks [ Image Recorder ]
            15: TRM_AUDIO_NOPRE (07. si je suis fou.mp3)
            2 indices, index0 (150) not provided
            original disc pos #0 + 15675 (15675) = #15675/3:29.0
            relocatable, disc pos for caching/writing not required/not required, no patch infos
            -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 15675 blocks [ Image Recorder ]
            16: TRM_AUDIO_NOPRE (08. oiseau de nuit.mp3)
            2 indices, index0 (150) not provided
            original disc pos #0 + 21609 (21609) = #21609/4:48.9
            relocatable, disc pos for caching/writing not required/not required, no patch infos
            -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 21609 blocks [ Image Recorder ]
            17: TRM_AUDIO_NOPRE (09. le pied par terre.mp3)
            2 indices, index0 (150) not provided
            original disc pos #0 + 17101 (17101) = #17101/3:48.1
            relocatable, disc pos for caching/writing not required/not required, no patch infos
            -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 17101 blocks [ Image Recorder ]
            --------------------------------------------------------------
            18: TRM_DATA_MODE2_FORM1_NOSUB (CTransferItem)
            2 indices, index0 (150) not provided
            original disc pos #0 + 600 (600) = #600/0:8.0
            relocatable, disc pos for caching/writing not required/required, no patch infos
            -> TRM_DATA_MODE2_FORM1_NOSUB, 2048, config 0, wanted index0 0 blocks, length 600 blocks [ Image Recorder ]
            --------------------------------------------------------------

            10:29:36 #13 Phase 40 File dlgbrnst.cpp, Line 1855
            Aborted by user

            10:29:36 #14 Text 0 File AudioCompilationImpl.cpp, Line 828
            DRM: DRM burn session terminated.

            10:29:36 #15 Text 0 File AudioCompilationImpl.cpp, Line 857
            DRM: Closing entire DRM handling. Bye.

            Existing drivers:
            File 'Drivers\CDRALW2K.SYS': Ver=8.0.0.212 , size=2560 bytes, created 05/10/2006 04:42:42
            File 'Drivers\ASPI32.SYS': Ver=4.71 (0002), size=16877 bytes, created 17/07/2002 11:53:02
            File 'Drivers\PXHELP20.SYS': Ver=3.00.41a, size=36560 bytes, created 27/09/2006 23:53:22 (Prassi/Veritas driver for win 2K)
            File 'Drivers\atapi.sys': Ver=?.?.?.?, size=95360 bytes, created 03/08/2004 23:59:44 (Adapter driver for src)

            Registry Keys:
            HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\AllocateCDROMs : 0 (Security Option)
            0
            1. bon on va pas etre copain a la fin :

              * Télécharge HijackThis et poste le rapport stp

              http://pchelpbordeaux.free.fr/logiciels.html
              Tutorial
              http://pchelpbordeaux.free.fr/tuto.html
              Démo en image
              http://pageperso.aol.fr/balltrap34/demohijack.htm
              0
              1. Désolé et merci de ton aide mais j'ai du mal avec ma souris....
                Voici le bon rapport J'ESPERE
                Slts

                ComboFix 07-08-17.2 - "Administrateur" 2007-08-18 12:19:47.2 - NTFSx86
                Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.88 [GMT 2:00]

                ((((((((((((((((((((((((( Files Created from 2007-07-18 to 2007-08-18 )))))))))))))))))))))))))))))))

                2007-08-18 12:09 51,200 --a------ C:\WINDOWS\nircmd.exe
                2007-08-18 11:53 <REP> d-------- C:\WINDOWS\system32\Panda Software
                2007-08-18 11:53 <REP> d-------- C:\WINDOWS\LastGood
                2007-08-17 21:59 <REP> d-------- C:\WINDOWS\system32\NtmsData
                2007-08-17 20:51 <REP> d--h----- C:\WINDOWS\system32\GroupPolicy
                2007-08-12 13:10 19,793 --a------ C:\WINDOWS\cc_20070812_1310.reg

                (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

                2007-08-16 19:26 --------- d-------- C:\Program Files\Fichiers communs\AOL
                2007-08-12 23:03 --------- d-------- C:\Program Files\AOL 9.0
                2007-08-12 16:04 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\AdobeUM
                2007-07-28 00:07 783224 --a------ C:\WINDOWS\system32\aswBoot.exe
                2007-07-28 00:02 94416 --a--c--- C:\WINDOWS\system32\drivers\aswmon2.sys
                2007-07-28 00:02 92848 --a--c--- C:\WINDOWS\system32\drivers\aswmon.sys
                2007-07-28 00:00 23152 --a--c--- C:\WINDOWS\system32\drivers\aswRdr.sys
                2007-07-27 23:59 42912 --a--c--- C:\WINDOWS\system32\drivers\aswTdi.sys
                2007-07-27 23:58 26624 --a--c--- C:\WINDOWS\system32\drivers\aavmker4.sys
                2007-07-27 23:57 95608 --a------ C:\WINDOWS\system32\AVASTSS.scr
                2007-06-21 12:01 103720 --a------ C:\WINDOWS\system32\AOLDial.dll

                ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

                *Note* empty entries & legit default entries are not shown

                [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF4DA5D4-805B-9066-3918-A21B9B156B2A}]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                "SoundMan"="soundman.exe" [2002-03-22 19:48 C:\WINDOWS\soundman.exe]
                "HostManager"="C:\Program Files\Fichiers communs\AOL\1166697745\ee\AOLSoftware.exe" [2006-11-17 15:16]

                [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2005-06-14 18:05]

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^AOL 9.0 Icône AOL.lnk]
                path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\AOL 9.0 Icône AOL.lnk
                backup=C:\WINDOWS\pss\AOL 9.0 Icône AOL.lnkCommon Startup

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^AOL Compagnon.lnk]
                path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\AOL Compagnon.lnk
                backup=C:\WINDOWS\pss\AOL Compagnon.lnkCommon Startup

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
                C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
                "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CapFax]
                C:\Program Files\Classic PhoneTools\CapFax.EXE

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
                C:\Program Files\Fichiers communs\AOL\1166697745\ee\AOLSoftware.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
                "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odebit Multimedia V3]
                C:\Program Files\Odebit Multimédia\V3\Odebit.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odebit Multimedia V3 - Services]
                C:\Program Files\Odebit Multimédia\V3\Odebit.exe /info

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
                "C:\Program Files\QuickTime\qttask.exe" -atboottime

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
                C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics]
                "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
                C:\Program Files\Winamp\winampa.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
                "TapiSrv"=3 (0x3)
                "BthServ"=2 (0x2)
                "avast! Web Scanner"=3 (0x3)
                "avast! Mail Scanner"=3 (0x3)
                "avast! Antivirus"=2 (0x2)

                R1 VIAPFD;VIAPFD;C:\WINDOWS\system32\Drivers\VIAPFD.SYS
                R3 alcan5ln;SpeedTouch(tm) USB ADSL RFC1483 Networking Driver (NDIS);C:\WINDOWS\system32\DRIVERS\alcan5ln.sys
                S3 AN983;Carte Fast Ethernet 10/100 Mbps ADMtek AN983/AN985/ADM951X;C:\WINDOWS\system32\DRIVERS\AN983.sys
                S3 Aox402Camera;SE402 Video Camera (WDM);C:\WINDOWS\system32\DRIVERS\se402vc.sys
                S3 driverhardwarev2;driverhardwarev2;\??\C:\Program Files\HardwareDetection\driverhardwarev2.sys
                S3 MR97310_USB_DUAL_CAMERA;XDC-Series;C:\WINDOWS\system32\DRIVERS\mr97310c.sys
                S3 SE402RefCameraStill;SE402 Still Camera (WDM);C:\WINDOWS\system32\DRIVERS\se402sc.sys

                *Newly Created Service* - CATCHME
                *Newly Created Service* - RKPAVPROC

                Contents of the 'Scheduled Tasks' folder
                2007-08-18 09:24:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE

                **************************************************************************

                catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                Rootkit scan 2007-08-18 12:20:26
                Windows 5.1.2600 Service Pack 2 NTFS

                scanning hidden processes ...

                scanning hidden autostart entries ...

                scanning hidden files ...

                scan completed successfully
                hidden files: 0

                **************************************************************************

                Completion time: 2007-08-18 12:21:06
                C:\ComboFix-quarantined-files.txt ... 2007-08-18 12:20
                C:\ComboFix2.txt ... 2007-08-18 12:11

                --- E O F ---
                0
                1. apparament tu as du mal la c´est un combo fix que tu m´a pondu

                  click sur mon lien du post 8 et post le rapport...
                  0
                  1. Logfile of HijackThis v1.99.1
                    Scan saved at 13:37, on 18/08/2007
                    Platform: Windows XP SP2 (WinNT 5.01.2600)
                    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                    Running processes:
                    C:\WINDOWS\System32\smss.exe
                    C:\WINDOWS\system32\winlogon.exe
                    C:\WINDOWS\system32\services.exe
                    C:\WINDOWS\system32\lsass.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                    C:\Program Files\Alwil Software\Avast4\ashServ.exe
                    C:\WINDOWS\system32\spoolsv.exe
                    C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
                    C:\WINDOWS\wanmpsvc.exe
                    C:\WINDOWS\soundman.exe
                    C:\Program Files\Fichiers communs\AOL\1166697745\ee\AOLSoftware.exe
                    C:\Program Files\MSN Messenger\msnmsgr.exe
                    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                    C:\WINDOWS\system32\wscntfy.exe
                    c:\program files\fichiers communs\aol\1166697745\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
                    c:\program files\fichiers communs\aol\1166697745\ee\aolsoftware.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\Program Files\AOL 9.0\waol.exe
                    C:\Program Files\AOL 9.0\shellmon.exe
                    C:\Program Files\Fichiers communs\Aol\aoltpspd.exe
                    C:\WINDOWS\explorer.exe
                    C:\Program Files\Internet Explorer\iexplore.exe
                    C:\WINDOWS\explorer.exe
                    C:\WINDOWS\system32\rundll32.exe
                    C:\WINDOWS\system32\wuauclt.exe
                    C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                    O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
                    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                    O2 - BHO: (no name) - {AF4DA5D4-805B-9066-3918-A21B9B156B2A} - (no file)
                    O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
                    O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                    O3 - Toolbar: (no name) - {e0e899ab-f487-11d5-8d29-0050ba6940e3} - (no file)
                    O4 - HKLM\..\Run: [SoundMan] soundman.exe
                    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1166697745\ee\AOLSoftware.exe
                    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                    O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
                    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office10\EXCEL.EXE/3000
                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
                    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
                    O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
                    O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
                    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
                    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                    O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
                    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                    O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} - http://by104fd.bay104.hotmail.msn.com/activex/HMAtchmt.ocx
                    O17 - HKLM\System\CCS\Services\Tcpip\..\{D3F0068D-338B-467B-A6D2-6D71CA41759B}: NameServer = 205.188.146.145
                    O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
                    O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
                    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
                    O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
                    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
                    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
                    0
                    1. fais ceci :

                      ¤ Télécharge Clean
                      ----> http://www.malekal.com/download/clean.zip

                      Dézippe tout le contenu dans le même dossier. Double clic sur clean ou clean.cmd choisissez l'option 1.
                      Un rapport va s'ouvrir, copie et colle le contenu ici
                      0
                      1. 18/08/2007 a 13:55:23,86

                        *** Recherche des fichiers dans C:

                        *** Recherche des fichiers dans C:\WINDOWS\

                        *** Recherche des fichiers dans C:\WINDOWS\system32

                        *** Recherche des fichiers dans C:\Program Files
                        "C:\Program Files\Viewpoint\" FOUND
                        *** Fin du rapport !
                        0
                        1. re,

                          ¤Démarre en mode sans échec :
                          Pour cela, tu tapote la touche F8 des le début de l allumage du pc sans t arrêter
                          Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
                          Une fois sur le bureau si il n y a pas toutes les couleurs et autres c est normal !
                          (Si F8 ne marche pas utilise la touche F5)

                          Puis ouvre le dossier clean et ouvre clean.cmd et choisis l'option 2.
                          Redémarre normalement et poste le log clean.
                          0
                          1. Script execute en mode sans echec
                            Rapport clean par Malekal_morte - http://www.malekal.com
                            Script execute en mode sans echec 21/08/2007 a 20:24:46,95

                            Microsoft Windows XP [version 5.1.2600]

                            *** Suppression des fichiers dans C:

                            *** Suppression des fichiers dans C:\WINDOWS\

                            *** Suppression des fichiers dans C:\WINDOWS\system32

                            *** Suppression des fichiers dans C:\Program Files
                            tentative de suppression de "C:\Program Files\Viewpoint\"

                            *** Suppression des clefs du registre effectuee..
                            *** Fin du rapport !
                            0
                            1. Désolée j'ai oublié de vous saluer avant tout.
                              Voici le rapport en mode sans echec que vous m'aviez demandé en date du samedi 18 août, encore un grand merci pour votre aide.

                              Script execute en mode sans echec
                              Rapport clean par Malekal_morte - http://www.malekal.com
                              Script execute en mode sans echec 21/08/2007 a 20:24:46,95

                              Microsoft Windows XP [version 5.1.2600]

                              *** Suppression des fichiers dans C:

                              *** Suppression des fichiers dans C:\WINDOWS\

                              *** Suppression des fichiers dans C:\WINDOWS\system32

                              *** Suppression des fichiers dans C:\Program Files
                              tentative de suppression de "C:\Program Files\Viewpoint\"

                              *** Suppression des clefs du registre effectuee..
                              *** Fin du rapport !
                              0
                              1. salut missitalienne,

                                télécharges smitfraudfix :

                                En image :
                                http://siri.urz.free.fr/Fix/SmitfraudFix.php

                                tu doubles cliques sur smitfraudfix.cmd et tu choisi l option 1
                                cela vas générer un rapport.

                                Copie/colle le rapport sur le forum stp.

                                @+
                                0
                                1. Voici le rapport que vous m'avez demandé.
                                  Merci.

                                  SmitFraudFix v2.214

                                  Rapport fait à 21:36:53,14, 21/08/2007
                                  Executé à partir de C:\Documents and Settings\Administrateur\Bureau\SmitfraudFix
                                  OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                                  Le type du système de fichiers est NTFS
                                  Fix executé en mode normal

                                  »»»»»»»»»»»»»»»»»»»»»»»» Process

                                  C:\WINDOWS\System32\smss.exe
                                  C:\WINDOWS\system32\winlogon.exe
                                  C:\WINDOWS\system32\services.exe
                                  C:\WINDOWS\system32\lsass.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\WINDOWS\System32\svchost.exe
                                  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                  C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                  C:\WINDOWS\system32\spoolsv.exe
                                  C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
                                  C:\WINDOWS\wanmpsvc.exe
                                  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                  C:\WINDOWS\Explorer.EXE
                                  C:\WINDOWS\soundman.exe
                                  C:\Program Files\Fichiers communs\AOL\1166697745\ee\AOLSoftware.exe
                                  C:\Program Files\MSN Messenger\msnmsgr.exe
                                  C:\WINDOWS\system32\wscntfy.exe
                                  C:\Program Files\AOL 9.0 VR\waol.exe
                                  C:\WINDOWS\System32\svchost.exe
                                  C:\WINDOWS\system32\wuauclt.exe
                                  c:\program files\fichiers communs\aol\1166697745\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
                                  c:\program files\fichiers communs\aol\1166697745\ee\aolsoftware.exe
                                  C:\Program Files\AOL 9.0 VR\shellmon.exe
                                  C:\Program Files\Fichiers communs\AOL\Topspeed\3.0\aoltpsd3.exe
                                  C:\Program Files\Internet Explorer\iexplore.exe
                                  c:\program files\aol\aol toolbar 4.0\AolTbServer.exe
                                  C:\WINDOWS\system32\cmd.exe

                                  »»»»»»»»»»»»»»»»»»»»»»»» hosts

                                  »»»»»»»»»»»»»»»»»»»»»»»» C:\

                                  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

                                  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

                                  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

                                  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

                                  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

                                  »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur

                                  »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur\Application Data

                                  »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

                                  »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\Favoris

                                  »»»»»»»»»»»»»»»»»»»»»»»» Bureau

                                  »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

                                  »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

                                  »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

                                  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
                                  "Source"="About:Home"
                                  "SubscribedURL"="About:Home"
                                  "FriendlyName"="Ma page d'accueil"

                                  »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
                                  !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                  SrchSTS.exe by S!Ri
                                  Search SharedTaskScheduler's .dll

                                  »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
                                  !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
                                  "AppInit_DLLs"=""

                                  »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
                                  !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
                                  "System"=""

                                  »»»»»»»»»»»»»»»»»»»»»»»» Rustock

                                  »»»»»»»»»»»»»»»»»»»»»»»» DNS

                                  Description: WAN (PPP/SLIP) Interface
                                  DNS Server Search Order: 205.188.146.145

                                  Description: SpeedTouch(tm) USB ADSL RFC1483 - Miniport d'ordonnancement de paquets
                                  DNS Server Search Order: 192.168.1.1

                                  Description: SpeedTouch(tm) USB ADSL RFC1483 - Miniport d'ordonnancement de paquets
                                  DNS Server Search Order: 10.0.0.138

                                  HKLM\SYSTEM\CCS\Services\Tcpip\..\{0590B5B0-4949-4A4D-8A75-D31526EBA095}: DhcpNameServer=192.168.1.1
                                  HKLM\SYSTEM\CCS\Services\Tcpip\..\{C122CB97-51F1-4C95-AC6C-C33BA3EE3915}: DhcpNameServer=10.0.0.138
                                  HKLM\SYSTEM\CCS\Services\Tcpip\..\{D3F0068D-338B-467B-A6D2-6D71CA41759B}: NameServer=205.188.146.145
                                  HKLM\SYSTEM\CS1\Services\Tcpip\..\{0590B5B0-4949-4A4D-8A75-D31526EBA095}: DhcpNameServer=192.168.1.1
                                  HKLM\SYSTEM\CS1\Services\Tcpip\..\{C122CB97-51F1-4C95-AC6C-C33BA3EE3915}: DhcpNameServer=10.0.0.138
                                  HKLM\SYSTEM\CS1\Services\Tcpip\..\{D3F0068D-338B-467B-A6D2-6D71CA41759B}: NameServer=205.188.146.145
                                  HKLM\SYSTEM\CS2\Services\Tcpip\..\{0590B5B0-4949-4A4D-8A75-D31526EBA095}: DhcpNameServer=192.168.1.1
                                  HKLM\SYSTEM\CS2\Services\Tcpip\..\{C122CB97-51F1-4C95-AC6C-C33BA3EE3915}: DhcpNameServer=10.0.0.138
                                  HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138
                                  HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138
                                  HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138

                                  »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

                                  »»»»»»»»»»»»»»»»»»»»»»»» Fin
                                  0
                                2. Voici le rapport avec un peu de mal désolée et merci pour l'aide.

                                  SmitFraudFix v2.214

                                  Rapport fait à 21:36:53,14, 21/08/2007
                                  Executé à partir de C:\Documents and Settings\Administrateur\Bureau\SmitfraudFix
                                  OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                                  Le type du système de fichiers est NTFS
                                  Fix executé en mode normal

                                  »»»»»»»»»»»»»»»»»»»»»»»» Process

                                  C:\WINDOWS\System32\smss.exe
                                  C:\WINDOWS\system32\winlogon.exe
                                  C:\WINDOWS\system32\services.exe
                                  C:\WINDOWS\system32\lsass.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\WINDOWS\System32\svchost.exe
                                  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                  C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                  C:\WINDOWS\system32\spoolsv.exe
                                  C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
                                  C:\WINDOWS\wanmpsvc.exe
                                  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                  C:\WINDOWS\Explorer.EXE
                                  C:\WINDOWS\soundman.exe
                                  C:\Program Files\Fichiers communs\AOL\1166697745\ee\AOLSoftware.exe
                                  C:\Program Files\MSN Messenger\msnmsgr.exe
                                  C:\WINDOWS\system32\wscntfy.exe
                                  C:\Program Files\AOL 9.0 VR\waol.exe
                                  C:\WINDOWS\System32\svchost.exe
                                  C:\WINDOWS\system32\wuauclt.exe
                                  c:\program files\fichiers communs\aol\1166697745\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
                                  c:\program files\fichiers communs\aol\1166697745\ee\aolsoftware.exe
                                  C:\Program Files\AOL 9.0 VR\shellmon.exe
                                  C:\Program Files\Fichiers communs\AOL\Topspeed\3.0\aoltpsd3.exe
                                  C:\Program Files\Internet Explorer\iexplore.exe
                                  c:\program files\aol\aol toolbar 4.0\AolTbServer.exe
                                  C:\WINDOWS\system32\cmd.exe

                                  »»»»»»»»»»»»»»»»»»»»»»»» hosts

                                  »»»»»»»»»»»»»»»»»»»»»»»» C:\

                                  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

                                  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

                                  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

                                  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

                                  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

                                  »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur

                                  »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur\Application Data

                                  »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

                                  »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\Favoris

                                  »»»»»»»»»»»»»»»»»»»»»»»» Bureau

                                  »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

                                  »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

                                  »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

                                  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
                                  "Source"="About:Home"
                                  "SubscribedURL"="About:Home"
                                  "FriendlyName"="Ma page d'accueil"

                                  »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
                                  !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                  SrchSTS.exe by S!Ri
                                  Search SharedTaskScheduler's .dll

                                  »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
                                  !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
                                  "AppInit_DLLs"=""

                                  »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
                                  !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
                                  "System"=""

                                  »»»»»»»»»»»»»»»»»»»»»»»» Rustock

                                  »»»»»»»»»»»»»»»»»»»»»»»» DNS

                                  Description: WAN (PPP/SLIP) Interface
                                  DNS Server Search Order: 205.188.146.145

                                  Description: SpeedTouch(tm) USB ADSL RFC1483 - Miniport d'ordonnancement de paquets
                                  DNS Server Search Order: 192.168.1.1

                                  Description: SpeedTouch(tm) USB ADSL RFC1483 - Miniport d'ordonnancement de paquets
                                  DNS Server Search Order: 10.0.0.138

                                  HKLM\SYSTEM\CCS\Services\Tcpip\..\{0590B5B0-4949-4A4D-8A75-D31526EBA095}: DhcpNameServer=192.168.1.1
                                  HKLM\SYSTEM\CCS\Services\Tcpip\..\{C122CB97-51F1-4C95-AC6C-C33BA3EE3915}: DhcpNameServer=10.0.0.138
                                  HKLM\SYSTEM\CCS\Services\Tcpip\..\{D3F0068D-338B-467B-A6D2-6D71CA41759B}: NameServer=205.188.146.145
                                  HKLM\SYSTEM\CS1\Services\Tcpip\..\{0590B5B0-4949-4A4D-8A75-D31526EBA095}: DhcpNameServer=192.168.1.1
                                  HKLM\SYSTEM\CS1\Services\Tcpip\..\{C122CB97-51F1-4C95-AC6C-C33BA3EE3915}: DhcpNameServer=10.0.0.138
                                  HKLM\SYSTEM\CS1\Services\Tcpip\..\{D3F0068D-338B-467B-A6D2-6D71CA41759B}: NameServer=205.188.146.145
                                  HKLM\SYSTEM\CS2\Services\Tcpip\..\{0590B5B0-4949-4A4D-8A75-D31526EBA095}: DhcpNameServer=192.168.1.1
                                  HKLM\SYSTEM\CS2\Services\Tcpip\..\{C122CB97-51F1-4C95-AC6C-C33BA3EE3915}: DhcpNameServer=10.0.0.138
                                  HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138
                                  HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138
                                  HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138

                                  »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

                                  »»»»»»»»»»»»»»»»»»»»»»»» Fin
                                  0
                              2. ok

                                peux tu poster un nouveau hijack this stp
                                0
                                1. Voici le rapport, merci.

                                  Logfile of HijackThis v1.99.1
                                  Scan saved at 21:49, on 21/08/2007
                                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                                  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                                  Running processes:
                                  C:\WINDOWS\System32\smss.exe
                                  C:\WINDOWS\system32\winlogon.exe
                                  C:\WINDOWS\system32\services.exe
                                  C:\WINDOWS\system32\lsass.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\WINDOWS\System32\svchost.exe
                                  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                  C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                  C:\WINDOWS\system32\spoolsv.exe
                                  C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
                                  C:\WINDOWS\wanmpsvc.exe
                                  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                  C:\WINDOWS\Explorer.EXE
                                  C:\WINDOWS\soundman.exe
                                  C:\Program Files\Fichiers communs\AOL\1166697745\ee\AOLSoftware.exe
                                  C:\Program Files\MSN Messenger\msnmsgr.exe
                                  C:\WINDOWS\system32\wscntfy.exe
                                  C:\Program Files\AOL 9.0 VR\waol.exe
                                  C:\WINDOWS\System32\svchost.exe
                                  c:\program files\fichiers communs\aol\1166697745\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
                                  c:\program files\fichiers communs\aol\1166697745\ee\aolsoftware.exe
                                  C:\Program Files\AOL 9.0 VR\shellmon.exe
                                  C:\Program Files\Fichiers communs\AOL\Topspeed\3.0\aoltpsd3.exe
                                  C:\Program Files\Internet Explorer\iexplore.exe
                                  c:\program files\aol\aol toolbar 4.0\AolTbServer.exe
                                  C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

                                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                  R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
                                  O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
                                  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                                  O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
                                  O2 - BHO: (no name) - {AF4DA5D4-805B-9066-3918-A21B9B156B2A} - (no file)
                                  O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                                  O3 - Toolbar: (no name) - {e0e899ab-f487-11d5-8d29-0050ba6940e3} - (no file)
                                  O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
                                  O4 - HKLM\..\Run: [SoundMan] soundman.exe
                                  O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1166697745\ee\AOLSoftware.exe
                                  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                                  O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.0 VR\AOL.EXE" -b
                                  O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 4.0\resources\fr-FR\local\search.html
                                  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office10\EXCEL.EXE/3000
                                  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
                                  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
                                  O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
                                  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
                                  O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
                                  O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} - http://by104fd.bay104.hotmail.msn.com/activex/HMAtchmt.ocx
                                  O17 - HKLM\System\CCS\Services\Tcpip\..\{D3F0068D-338B-467B-A6D2-6D71CA41759B}: NameServer = 205.188.146.145
                                  O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
                                  O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                                  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                  O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
                                  O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
                                  O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
                                  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
                                  O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
                                  0
                              3. re,

                                a l´aide de hijack this coche ceci :

                                O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
                                O2 - BHO: (no name) - {AF4DA5D4-805B-9066-3918-A21B9B156B2A} - (no file)
                                O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                                O3 - Toolbar: (no name) - {e0e899ab-f487-11d5-8d29-0050ba6940e3} - (no file)
                                O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)

                                quitte tes applications et fix les lignes ci dessus.

                                * télécharge AVG Anti-Spyware (ewido)

                                https://www.avg.com/en-ww/free-antivirus-download
                                http://www.infos-du-net.com/telecharger/Ewido-Security-Suite,0301-734.html

                                * tu l'installes

                                * lance AVG Anti-Spyware et clique sur le bouton Mise à jour. Patiente
                                si tu n'arrives pas à le mettre à jour prends ici les màj

                                http://downloads.ewido.net/avgas-signatures-full-current.exe

                                Sur la page "analyse":

                                •- tu choisis d'abord l'onglet "paramètres".
                                - sous « Comment réagir » clic sur « Actions recommandées » et dans le menu déroulant, choisir « Supprimer »

                                Copie Et colle le rapport ici

                                @+
                                0
                                1. Bonjour, voici le rapport.

                                  AVG Anti-Spyware - Rapport d'analyse
                                  ---------------------------------------------------------

                                  + Créé à: 06:51 22/08/2007

                                  + Résultat de l'analyse:

                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@2o7[2].txt -> TrackingCookie.2o7 : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@aolfr.122.2o7[1].txt -> TrackingCookie.2o7 : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@msnaccountservices.112.2o7[1].txt -> TrackingCookie.2o7 : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@adtech[2].txt -> TrackingCookie.Adtech : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@atdmt[2].txt -> TrackingCookie.Atdmt : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Local Settings\Temp\Cookies\administrateur@atdmt[1].txt -> TrackingCookie.Atdmt : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@bluestreak[2].txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Local Settings\Temp\Cookies\administrateur@bluestreak[1].txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@doubleclick[1].txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Local Settings\Temp\Cookies\administrateur@doubleclick[2].txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@estat[1].txt -> TrackingCookie.Estat : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@ehg-telecomitalia.hitbox[2].txt -> TrackingCookie.Hitbox : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@hitbox[2].txt -> TrackingCookie.Hitbox : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@mediaplex[1].txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@revsci[2].txt -> TrackingCookie.Revsci : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@serving-sys[2].txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@smartadserver[2].txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Local Settings\Temp\Cookies\administrateur@statcounter[2].txt -> TrackingCookie.Statcounter : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@weborama[1].txt -> TrackingCookie.Weborama : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Local Settings\Temp\Cookies\administrateur@weborama[1].txt -> TrackingCookie.Weborama : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@m.webtrends[2].txt -> TrackingCookie.Webtrends : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
                                  C:\Documents and Settings\Administrateur\Cookies\administrateur@zedo[1].txt -> TrackingCookie.Zedo : Aucune action entreprise.

                                  Fin du rapport
                                  0
                                  1. salut missitalienne,

                                    tu as supprimé les tracking cookie?

                                    encore des soucis?

                                    @+
                                    0
                                    • 1
                                    • 2