VIRUS

Bienvenue sur le forum d’entraide de CommentCaMarche.net

Nous connaissons votre situation et nous vous conseillons de ne surtout pas vous inquiéter.
De plus, au vu du nombre croissant de désinfections effectuées sur le forum, nous vous demandons un peu de patience et surtout de ne pas créer plusieurs postes pour le même problème.
Merci de votre compréhension.

Télécharge HijackThis ici:
http://telechargement.zebulon.fr/138-hijackthis-1991.html

Dézippe le dans un dossier prévu à cet effet.
Par exemple C:\hijackthis < Enregistre-le bien dans c : !
Démo : (Merci a Balltrap34 pour cette réalisation)
http://pageperso.aol.fr/balltrap34/Hijenr.gif

Lance le puis:
Clique sur "do a system scan and save logfile" (cf démo)
Faire un copier coller du log entier sur le forum

Démo : (Merci a Balltrap34 pour cette réalisation)
http://pageperso.aol.fr/balltrap34/demohijack.htm

Bon courage

A+

Alors voilà le rapport (merci de l'aide)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:13:51, on 10/11/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\mdasvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\Program Files\Fichiers communs\07%2F06%2F2007\bm.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\FICHIE~1\07%2F0~1\uga6pcw.exe
C:\Program Files\Fichiers communs\07%2F06%2F2007\stmon.exe
C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe
C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\malka\Local Settings\Temp\Répertoire temporaire 1 pour HiJackThis.zip\HijackThis.exe
C:\WINDOWS\explorer.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\System32\wobnujql.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Logical Disk Awareness] mdasvc.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Fichiers communs\07%2F06%2F2007\bm.exe" dm=http://apu03c0.audientia.net; ad=http://apu03c0.audientia.net
O4 - HKLM\..\Run: [uga6pcw] "C:\PROGRA~1\FICHIE~1\07%2F0~1\uga6pcw.exe" -start
O4 - HKLM\..\Run: [Salestart(1)] "C:\Program Files\Fichiers communs\07%2F06%2F2007\stmon.exe" dm=http://apu03c0.audientia.net; ad=http://apu03c0.audientia.net
O4 - HKLM\..\Run: [Salestart(2)] "C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe" dm=http://defensedudisque.com; ad=http://defensedudisque.com
O4 - HKLM\..\Run: [Salestart(3)] "C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe" dm=http://moncontenuassistant.com; ad=http://moncontenuassistant.com
O4 - HKLM\..\Run: [ac18511d] rundll32.exe "C:\WINDOWS\System32\vjmppwqe.dll",b
O4 - HKLM\..\Run: [07%2F06%2F2007] C:\Program Files\07%2F06%2F2007\pgs.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

Re,

Télécharge MSNFix.zip (de !aur3n7) sur ton bureau:
http://sosvirus.changelog.fr/MSNFix.zip

Décompresse-le (clic droit >> Extraire ici) et place les fichiers dans C:\MSNFix (très important).

Double cliquer sur le fichier MSNFix.bat.
- Exécutez l'option R.
-- Si l'infection est détectée, un message l'indiquera et il suffira de presser une touche pour lancer le nettoyage

Note :
Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal

- Le rapport sera enregistré dans le même dossier que MSNFix sous forme date_heure.txt

A+

merci.

et ensuite je dois faire quoi?
poster le rapport?

Oui :-)

A+

MSNFix 1.573

C:\Documents and Settings\malka\Bureau\MSNFix\MSNFix
Fix exécuté le 11/11/2007 - 13:34:30,87 By malka
mode normal

************************ Recherche les fichiers présents

... C:\DOCUME~1\malka\LOCALS~1\Temp\image??.zip

************************ MSNCHK ***** /!\ beta test /!\

************************ Recherche les dossiers présents

Aucun dossier trouvé

************************ Suppression des fichiers

.. OK ... C:\DOCUME~1\malka\LOCALS~1\Temp\image??.zip

************************ Nettoyage du registre

************************ Fichiers suspects

/!\ ces fichiers nécessitent un avis expérimenté avant toute intervention

[C:\PROGRA~1\ACMonitor_X83.exe] 58A76DB344B6F8E04EC35837AD6ABCCE

[color=#FF0000][b]==>[/b][/color] SVP merci d'envoyer le fichier [b] C:\DOCUME~1\malka\Bureau\Upload_Me.zip [/b] sur http://upload.changelog.fr

Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 11112007_13345406.zip

------------------------------------------------------------------------
Auteur : !aur3n7 Contact: https://www.ionos.fr/
------------------------------------------------------------------------

--------------------------------------------- END ---------------------------------------------

Ok

Ou en sont tes soucis?

A+

j'ai toujours des alertes de virus network worm et d'autres
et des trojan....

Oui Normal.

Télécharge VirtumundoBegone sur le bureau:
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Double clique ensuite sur VirtumundoBeGone.exe et suis les instructions.
Une fois terminé, redémarre et poste le rapport VBG.TXT créé sur le bureau dans ta prochaine réponse avec un nouveau rapport HijackThis.
Ne t'inquiète pas si tu vois un message Ecran bleu "Erreur fatale", c'est normal et attendu.

et:

Télécharge VundoFix.exe (par Atribune) sur ton Bureau.
http://www.atribune.org/ccount/click.php?id=4

Double-clique VundoFix.exe afin de le lancer.
Clique sur le bouton Scan for Vundo.
Lorsque le scan est complété, clique sur le bouton Remove Vundo.
Une invite te demandera si tu veux supprimer les fichiers, clique YES
Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.
Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown") ; clique OK
Démarre ton PC à nouveau.
Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.

A+

Rapport VBG

[11/12/2007, 17:37:51] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\malka\Bureau\VirtumundoBeGone.exe" )
[11/12/2007, 17:38:02] - Detected System Information:
[11/12/2007, 17:38:02] - Windows Version: 5.1.2600,
[11/12/2007, 17:38:02] - Current Username: malka (Admin)
[11/12/2007, 17:38:02] - Windows is in NORMAL mode.
[11/12/2007, 17:38:02] - Searching for Browser Helper Objects:
[11/12/2007, 17:38:02] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/12/2007, 17:38:02] - BHO 2: {634BBAB7-3F60-4426-944F-A62B9007F67F} ()
[11/12/2007, 17:38:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/12/2007, 17:38:02] - Checking for HKLM\...\Winlogon\Notify\efccdaw
[11/12/2007, 17:38:02] - Found: HKLM\...\Winlogon\Notify\efccdaw - This is probably Virtumundo.
[11/12/2007, 17:38:02] - Assigning {634BBAB7-3F60-4426-944F-A62B9007F67F} MSEvents Object
[11/12/2007, 17:38:02] - BHO list has been changed! Starting over...
[11/12/2007, 17:38:02] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/12/2007, 17:38:02] - BHO 2: {634BBAB7-3F60-4426-944F-A62B9007F67F} (MSEvents Object)
[11/12/2007, 17:38:02] - ALERT: Found MSEvents Object!
[11/12/2007, 17:38:02] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/12/2007, 17:38:02] - BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/12/2007, 17:38:02] - BHO 5: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[11/12/2007, 17:38:02] - BHO 6: {A95B2816-1D7E-4561-A202-68C0DE02353A} ()
[11/12/2007, 17:38:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/12/2007, 17:38:02] - Checking for HKLM\...\Winlogon\Notify\wobnujql
[11/12/2007, 17:38:02] - Found: HKLM\...\Winlogon\Notify\wobnujql - This is probably Virtumundo.
[11/12/2007, 17:38:02] - Assigning {A95B2816-1D7E-4561-A202-68C0DE02353A} MSEvents Object
[11/12/2007, 17:38:03] - BHO list has been changed! Starting over...
[11/12/2007, 17:38:03] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/12/2007, 17:38:03] - BHO 2: {634BBAB7-3F60-4426-944F-A62B9007F67F} (MSEvents Object)
[11/12/2007, 17:38:03] - ALERT: Found MSEvents Object!
[11/12/2007, 17:38:03] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/12/2007, 17:38:03] - BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/12/2007, 17:38:03] - BHO 5: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[11/12/2007, 17:38:03] - BHO 6: {A95B2816-1D7E-4561-A202-68C0DE02353A} (MSEvents Object)
[11/12/2007, 17:38:03] - ALERT: Found MSEvents Object!
[11/12/2007, 17:38:03] - BHO 7: {B200FD97-F425-4D51-BCFA-3A19883DFACD} ()
[11/12/2007, 17:38:03] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/12/2007, 17:38:03] - Checking for HKLM\...\Winlogon\Notify\mllmn
[11/12/2007, 17:38:03] - Key not found: HKLM\...\Winlogon\Notify\mllmn, continuing.
[11/12/2007, 17:38:03] - BHO 8: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
[11/12/2007, 17:38:03] - Finished Searching Browser Helper Objects
[11/12/2007, 17:38:03] - *** Detected MSEvents Object
[11/12/2007, 17:38:03] - Trying to remove MSEvents Object...
[11/12/2007, 17:38:04] - Terminating Process: IEXPLORE.EXE
[11/12/2007, 17:38:05] - Terminating Process: RUNDLL32.EXE
[11/12/2007, 17:38:05] - Disabling Automatic Shell Restart
[11/12/2007, 17:38:05] - Terminating Process: EXPLORER.EXE
[11/12/2007, 17:38:05] - Suspending the NT Session Manager System Service
[11/12/2007, 17:38:05] - Terminating Windows NT Logon/Logoff Manager
[11/12/2007, 17:38:06] - Re-enabling Automatic Shell Restart
[11/12/2007, 17:38:06] - File to disable: C:\WINDOWS\System32\efccdaw.dll
[11/12/2007, 17:38:06] - Renaming C:\WINDOWS\System32\efccdaw.dll -> C:\WINDOWS\System32\efccdaw.dll.vir
[11/12/2007, 17:38:07] - File successfully renamed!
[11/12/2007, 17:38:07] - Removing HKLM\...\Browser Helper Objects\{634BBAB7-3F60-4426-944F-A62B9007F67F}
[11/12/2007, 17:38:07] - Removing HKCR\CLSID\{634BBAB7-3F60-4426-944F-A62B9007F67F}
[11/12/2007, 17:38:07] - Adding Kill Bit for ActiveX for GUID: {634BBAB7-3F60-4426-944F-A62B9007F67F}
[11/12/2007, 17:38:07] - Deleting ATLEvents/MSEvents Registry entries
[11/12/2007, 17:38:07] - Removing HKLM\...\Winlogon\Notify\efccdaw
[11/12/2007, 17:38:07] - Searching for Browser Helper Objects:
[11/12/2007, 17:38:07] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/12/2007, 17:38:07] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/12/2007, 17:38:07] - BHO 3: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/12/2007, 17:38:07] - BHO 4: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[11/12/2007, 17:38:07] - BHO 5: {A95B2816-1D7E-4561-A202-68C0DE02353A} (MSEvents Object)
[11/12/2007, 17:38:07] - ALERT: Found MSEvents Object!
[11/12/2007, 17:38:07] - BHO 6: {B200FD97-F425-4D51-BCFA-3A19883DFACD} ()
[11/12/2007, 17:38:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/12/2007, 17:38:07] - Checking for HKLM\...\Winlogon\Notify\mllmn
[11/12/2007, 17:38:07] - Key not found: HKLM\...\Winlogon\Notify\mllmn, continuing.
[11/12/2007, 17:38:07] - BHO 7: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
[11/12/2007, 17:38:07] - Finished Searching Browser Helper Objects
[11/12/2007, 17:38:07] - *** Detected MSEvents Object
[11/12/2007, 17:38:07] - Trying to remove MSEvents Object...
[11/12/2007, 17:38:08] - Terminating Process: IEXPLORE.EXE
[11/12/2007, 17:38:08] - Terminating Process: RUNDLL32.EXE
[11/12/2007, 17:38:08] - Disabling Automatic Shell Restart
[11/12/2007, 17:38:08] - Terminating Process: EXPLORER.EXE
[11/12/2007, 17:38:08] - Suspending the NT Session Manager System Service
[11/12/2007, 17:38:09] - Terminating Windows NT Logon/Logoff Manager
[11/12/2007, 17:38:09] - Re-enabling Automatic Shell Restart
[11/12/2007, 17:38:09] - File to disable: C:\WINDOWS\System32\wobnujql.dll
[11/12/2007, 17:38:09] - Renaming C:\WINDOWS\System32\wobnujql.dll -> C:\WINDOWS\System32\wobnujql.dll.vir
[11/12/2007, 17:38:09] - File successfully renamed!
[11/12/2007, 17:38:09] - Removing HKLM\...\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}
[11/12/2007, 17:38:09] - Removing HKCR\CLSID\{A95B2816-1D7E-4561-A202-68C0DE02353A}
[11/12/2007, 17:38:09] - Adding Kill Bit for ActiveX for GUID: {A95B2816-1D7E-4561-A202-68C0DE02353A}
[11/12/2007, 17:38:09] - Deleting ATLEvents/MSEvents Registry entries
[11/12/2007, 17:38:09] - Removing HKLM\...\Winlogon\Notify\wobnujql
[11/12/2007, 17:38:09] - Searching for Browser Helper Objects:
[11/12/2007, 17:38:09] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/12/2007, 17:38:09] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/12/2007, 17:38:09] - BHO 3: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/12/2007, 17:38:09] - BHO 4: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[11/12/2007, 17:38:09] - BHO 5: {B200FD97-F425-4D51-BCFA-3A19883DFACD} ()
[11/12/2007, 17:38:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/12/2007, 17:38:09] - Checking for HKLM\...\Winlogon\Notify\mllmn
[11/12/2007, 17:38:09] - Key not found: HKLM\...\Winlogon\Notify\mllmn, continuing.
[11/12/2007, 17:38:09] - BHO 6: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
[11/12/2007, 17:38:09] - Finished Searching Browser Helper Objects
[11/12/2007, 17:38:09] - Finishing up...
[11/12/2007, 17:38:09] - A restart is needed.
[11/12/2007, 17:38:16] - Attempting to Restart via STOP error (Blue Screen!)

Rapport VBG

[11/12/2007, 17:37:51] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\malka\Bureau\VirtumundoBeGone.exe" )
[11/12/2007, 17:38:02] - Detected System Information:
[11/12/2007, 17:38:02] - Windows Version: 5.1.2600,
[11/12/2007, 17:38:02] - Current Username: malka (Admin)
[11/12/2007, 17:38:02] - Windows is in NORMAL mode.
[11/12/2007, 17:38:02] - Searching for Browser Helper Objects:
[11/12/2007, 17:38:02] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/12/2007, 17:38:02] - BHO 2: {634BBAB7-3F60-4426-944F-A62B9007F67F} ()
[11/12/2007, 17:38:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/12/2007, 17:38:02] - Checking for HKLM\...\Winlogon\Notify\efccdaw
[11/12/2007, 17:38:02] - Found: HKLM\...\Winlogon\Notify\efccdaw - This is probably Virtumundo.
[11/12/2007, 17:38:02] - Assigning {634BBAB7-3F60-4426-944F-A62B9007F67F} MSEvents Object
[11/12/2007, 17:38:02] - BHO list has been changed! Starting over...
[11/12/2007, 17:38:02] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/12/2007, 17:38:02] - BHO 2: {634BBAB7-3F60-4426-944F-A62B9007F67F} (MSEvents Object)
[11/12/2007, 17:38:02] - ALERT: Found MSEvents Object!
[11/12/2007, 17:38:02] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/12/2007, 17:38:02] - BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/12/2007, 17:38:02] - BHO 5: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[11/12/2007, 17:38:02] - BHO 6: {A95B2816-1D7E-4561-A202-68C0DE02353A} ()
[11/12/2007, 17:38:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/12/2007, 17:38:02] - Checking for HKLM\...\Winlogon\Notify\wobnujql
[11/12/2007, 17:38:02] - Found: HKLM\...\Winlogon\Notify\wobnujql - This is probably Virtumundo.
[11/12/2007, 17:38:02] - Assigning {A95B2816-1D7E-4561-A202-68C0DE02353A} MSEvents Object
[11/12/2007, 17:38:03] - BHO list has been changed! Starting over...
[11/12/2007, 17:38:03] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/12/2007, 17:38:03] - BHO 2: {634BBAB7-3F60-4426-944F-A62B9007F67F} (MSEvents Object)
[11/12/2007, 17:38:03] - ALERT: Found MSEvents Object!
[11/12/2007, 17:38:03] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/12/2007, 17:38:03] - BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/12/2007, 17:38:03] - BHO 5: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[11/12/2007, 17:38:03] - BHO 6: {A95B2816-1D7E-4561-A202-68C0DE02353A} (MSEvents Object)
[11/12/2007, 17:38:03] - ALERT: Found MSEvents Object!
[11/12/2007, 17:38:03] - BHO 7: {B200FD97-F425-4D51-BCFA-3A19883DFACD} ()
[11/12/2007, 17:38:03] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/12/2007, 17:38:03] - Checking for HKLM\...\Winlogon\Notify\mllmn
[11/12/2007, 17:38:03] - Key not found: HKLM\...\Winlogon\Notify\mllmn, continuing.
[11/12/2007, 17:38:03] - BHO 8: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
[11/12/2007, 17:38:03] - Finished Searching Browser Helper Objects
[11/12/2007, 17:38:03] - *** Detected MSEvents Object
[11/12/2007, 17:38:03] - Trying to remove MSEvents Object...
[11/12/2007, 17:38:04] - Terminating Process: IEXPLORE.EXE
[11/12/2007, 17:38:05] - Terminating Process: RUNDLL32.EXE
[11/12/2007, 17:38:05] - Disabling Automatic Shell Restart
[11/12/2007, 17:38:05] - Terminating Process: EXPLORER.EXE
[11/12/2007, 17:38:05] - Suspending the NT Session Manager System Service
[11/12/2007, 17:38:05] - Terminating Windows NT Logon/Logoff Manager
[11/12/2007, 17:38:06] - Re-enabling Automatic Shell Restart
[11/12/2007, 17:38:06] - File to disable: C:\WINDOWS\System32\efccdaw.dll
[11/12/2007, 17:38:06] - Renaming C:\WINDOWS\System32\efccdaw.dll -> C:\WINDOWS\System32\efccdaw.dll.vir
[11/12/2007, 17:38:07] - File successfully renamed!
[11/12/2007, 17:38:07] - Removing HKLM\...\Browser Helper Objects\{634BBAB7-3F60-4426-944F-A62B9007F67F}
[11/12/2007, 17:38:07] - Removing HKCR\CLSID\{634BBAB7-3F60-4426-944F-A62B9007F67F}
[11/12/2007, 17:38:07] - Adding Kill Bit for ActiveX for GUID: {634BBAB7-3F60-4426-944F-A62B9007F67F}
[11/12/2007, 17:38:07] - Deleting ATLEvents/MSEvents Registry entries
[11/12/2007, 17:38:07] - Removing HKLM\...\Winlogon\Notify\efccdaw
[11/12/2007, 17:38:07] - Searching for Browser Helper Objects:
[11/12/2007, 17:38:07] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/12/2007, 17:38:07] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/12/2007, 17:38:07] - BHO 3: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/12/2007, 17:38:07] - BHO 4: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[11/12/2007, 17:38:07] - BHO 5: {A95B2816-1D7E-4561-A202-68C0DE02353A} (MSEvents Object)
[11/12/2007, 17:38:07] - ALERT: Found MSEvents Object!
[11/12/2007, 17:38:07] - BHO 6: {B200FD97-F425-4D51-BCFA-3A19883DFACD} ()
[11/12/2007, 17:38:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/12/2007, 17:38:07] - Checking for HKLM\...\Winlogon\Notify\mllmn
[11/12/2007, 17:38:07] - Key not found: HKLM\...\Winlogon\Notify\mllmn, continuing.
[11/12/2007, 17:38:07] - BHO 7: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
[11/12/2007, 17:38:07] - Finished Searching Browser Helper Objects
[11/12/2007, 17:38:07] - *** Detected MSEvents Object
[11/12/2007, 17:38:07] - Trying to remove MSEvents Object...
[11/12/2007, 17:38:08] - Terminating Process: IEXPLORE.EXE
[11/12/2007, 17:38:08] - Terminating Process: RUNDLL32.EXE
[11/12/2007, 17:38:08] - Disabling Automatic Shell Restart
[11/12/2007, 17:38:08] - Terminating Process: EXPLORER.EXE
[11/12/2007, 17:38:08] - Suspending the NT Session Manager System Service
[11/12/2007, 17:38:09] - Terminating Windows NT Logon/Logoff Manager
[11/12/2007, 17:38:09] - Re-enabling Automatic Shell Restart
[11/12/2007, 17:38:09] - File to disable: C:\WINDOWS\System32\wobnujql.dll
[11/12/2007, 17:38:09] - Renaming C:\WINDOWS\System32\wobnujql.dll -> C:\WINDOWS\System32\wobnujql.dll.vir
[11/12/2007, 17:38:09] - File successfully renamed!
[11/12/2007, 17:38:09] - Removing HKLM\...\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}
[11/12/2007, 17:38:09] - Removing HKCR\CLSID\{A95B2816-1D7E-4561-A202-68C0DE02353A}
[11/12/2007, 17:38:09] - Adding Kill Bit for ActiveX for GUID: {A95B2816-1D7E-4561-A202-68C0DE02353A}
[11/12/2007, 17:38:09] - Deleting ATLEvents/MSEvents Registry entries
[11/12/2007, 17:38:09] - Removing HKLM\...\Winlogon\Notify\wobnujql
[11/12/2007, 17:38:09] - Searching for Browser Helper Objects:
[11/12/2007, 17:38:09] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/12/2007, 17:38:09] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/12/2007, 17:38:09] - BHO 3: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/12/2007, 17:38:09] - BHO 4: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[11/12/2007, 17:38:09] - BHO 5: {B200FD97-F425-4D51-BCFA-3A19883DFACD} ()
[11/12/2007, 17:38:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/12/2007, 17:38:09] - Checking for HKLM\...\Winlogon\Notify\mllmn
[11/12/2007, 17:38:09] - Key not found: HKLM\...\Winlogon\Notify\mllmn, continuing.
[11/12/2007, 17:38:09] - BHO 6: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
[11/12/2007, 17:38:09] - Finished Searching Browser Helper Objects
[11/12/2007, 17:38:09] - Finishing up...
[11/12/2007, 17:38:09] - A restart is needed.
[11/12/2007, 17:38:16] - Attempting to Restart via STOP error (Blue Screen!)

Nouveau rapport hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:48:15, on 12/11/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\mdasvc.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\FICHIE~1\07%2F0~1\uga6pcw.exe
C:\Program Files\Fichiers communs\07%2F06%2F2007\stmon.exe
C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe
C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\sol.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\System32\bbkkorit.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Logical Disk Awareness] mdasvc.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Fichiers communs\07%2F06%2F2007\bm.exe" dm=http://apu03c0.audientia.net; ad=http://apu03c0.audientia.net
O4 - HKLM\..\Run: [uga6pcw] "C:\PROGRA~1\FICHIE~1\07%2F0~1\uga6pcw.exe" -start
O4 - HKLM\..\Run: [Salestart(1)] "C:\Program Files\Fichiers communs\07%2F06%2F2007\stmon.exe" dm=http://apu03c0.audientia.net; ad=http://apu03c0.audientia.net
O4 - HKLM\..\Run: [Salestart(2)] "C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe" dm=http://defensedudisque.com; ad=http://defensedudisque.com
O4 - HKLM\..\Run: [Salestart(3)] "C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe" dm=http://moncontenuassistant.com; ad=http://moncontenuassistant.com
O4 - HKLM\..\Run: [ac18511d] rundll32.exe "C:\WINDOWS\System32\slbaylia.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

Rapport VUNDO FIX

VundoFix V6.5.11

Checking Java version...

Scan started at 17:50:19 12/11/2007

Listing files found while scanning....

C:\WINDOWS\System32\bbkkorit.dll

Beginning removal...

Attempting to delete C:\WINDOWS\System32\bbkkorit.dll
C:\WINDOWS\System32\bbkkorit.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

Attempting to delete C:\WINDOWS\System32\bbkkorit.dll
C:\WINDOWS\System32\bbkkorit.dll Has been deleted!

Performing Repairs to the registry.
Done!

Nouveau nouveau rapport hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:01:31, on 12/11/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\mdasvc.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\FICHIE~1\07%2F0~1\uga6pcw.exe
C:\Program Files\Fichiers communs\07%2F06%2F2007\stmon.exe
C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe
C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Logical Disk Awareness] mdasvc.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Fichiers communs\07%2F06%2F2007\bm.exe" dm=http://apu03c0.audientia.net; ad=http://apu03c0.audientia.net
O4 - HKLM\..\Run: [uga6pcw] "C:\PROGRA~1\FICHIE~1\07%2F0~1\uga6pcw.exe" -start
O4 - HKLM\..\Run: [Salestart(1)] "C:\Program Files\Fichiers communs\07%2F06%2F2007\stmon.exe" dm=http://apu03c0.audientia.net; ad=http://apu03c0.audientia.net
O4 - HKLM\..\Run: [Salestart(2)] "C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe" dm=http://defensedudisque.com; ad=http://defensedudisque.com
O4 - HKLM\..\Run: [Salestart(3)] "C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe" dm=http://moncontenuassistant.com; ad=http://moncontenuassistant.com
O4 - HKLM\..\Run: [ac18511d] rundll32.exe "C:\WINDOWS\System32\slbaylia.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

Ok;

Télécharge Combofix sUBs : [url=http://download.bleepingcomputer.com/sUBs/ComboFix.exe]combofix.exe[/url]
et sauvegarde le sur ton bureau et pas ailleurs!

Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

Copie/colle un nouveau rapport HiJackThis avec.

A+

ComboFix 07-11-08.1 - malka 2007-11-13 13:49:57.1 - NTFSx86
Running from: C:\Documents and Settings\malka\Bureau\ComboFix.exe
* Created a new restore point
.

Incapable d'obtenir les privilèges Système

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\All Users\Menu Démarrer\Live Safety Center.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Online Security Guide.lnk
C:\Documents and Settings\malka\Application Data\install_en[1].exe
C:\Documents and Settings\malka\Bureau\Live Safety Center.lnk
C:\Documents and Settings\malka\Bureau\Online Security Guide.lnk
C:\Documents and Settings\malka\Favoris\Online Security Guide.lnk
C:\WINDOWS\system32\bbkkorit.dllbox
C:\WINDOWS\system32\mllmn.dll
C:\WINDOWS\system32\nmllm.ini
C:\WINDOWS\system32\nmllm.ini2
C:\WINDOWS\system32\wobnujql.dllbox
C:\WINDOWS\system32\xbdhonur.dll

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-13 to 2007-11-13 ))))))))))))))))))))))))))))))))))))
.

2007-11-13 13:49 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-12 17:50 <REP> d-------- C:\VundoFix Backups
2007-11-12 17:40 145,472 --a------ C:\WINDOWS\system32\fsccgijy.dll
2007-11-12 17:40 84,032 --a------ C:\WINDOWS\system32\slbaylia.dll
2007-11-11 11:59 <REP> d-------- C:\MSN FIXX
2007-11-11 02:19 <REP> d-------- C:\msnfix
2007-11-10 17:39 84,032 --a------ C:\WINDOWS\system32\vjmppwqe.dll
2007-11-09 17:31 <REP> d-------- C:\Program Files\Trend Micro
2007-11-09 16:41 84,032 --------- C:\WINDOWS\system32\oqorhbil.dll
2007-11-08 19:26 36,352 --a------ C:\WINDOWS\system32\ssqpmkh.dll
2007-11-08 18:16 36,352 --a------ C:\WINDOWS\system32\gebxxyw.dll
2007-11-08 17:53 36,352 --a------ C:\WINDOWS\system32\hggdcyw.dll
2007-11-08 17:43 36,352 --a------ C:\WINDOWS\system32\urqrsts.dll
2007-11-08 00:25 <REP> d-------- C:\Documents and Settings\malka\Application Data\MonContenuassistant
2007-11-07 21:31 <REP> d--hs---- C:\found.000
2007-11-07 13:14 <REP> d-------- C:\Program Files\Fichiers communs\MonContenuassistant
2007-11-07 13:13 <REP> d-------- C:\Documents and Settings\malka\Application Data\defensedudisque
2007-11-07 13:08 <REP> dr------- C:\Documents and Settings\All Users\Application Data\defensedudisque
2007-11-07 13:07 <REP> d-------- C:\Program Files\Fichiers communs\DefenseDuDisque
2007-11-07 13:07 <REP> d-------- C:\Program Files\DefenseDuDisque
2007-11-07 13:03 <REP> d-------- C:\Documents and Settings\malka\Application Data\[u]0[/u]7%2F06%2F2007
2007-11-07 12:56 681,984 --a------ C:\WINDOWS\is-P5HI2.exe
2007-11-07 12:54 681,984 --a------ C:\WINDOWS\is-NSG79.exe
2007-11-07 12:50 681,984 --a------ C:\WINDOWS\is-KJNGJ.exe
2007-11-07 12:39 681,984 --a------ C:\WINDOWS\is-LEKDT.exe
2007-11-07 12:36 681,984 --a------ C:\WINDOWS\is-DNTO1.exe
2007-11-07 12:34 681,984 --a------ C:\WINDOWS\is-BG01F.exe
2007-11-07 12:32 681,984 --a------ C:\WINDOWS\is-F0KPU.exe
2007-11-07 12:28 <REP> d-------- C:\Program Files\Fichiers communs\[u]0[/u]7%2F06%2F2007
2007-11-07 12:28 89,088 --a------ C:\WINDOWS\system32\atl71.dll
2007-11-07 12:19 145,472 --a------ C:\WINDOWS\system32\wobnujql.dll.vir
2007-11-07 12:19 145,472 --a------ C:\WINDOWS\system32\ihwmfyei.dll
2007-11-05 20:58 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-11-05 20:58 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-11-05 20:58 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-11-05 20:58 92,848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-11-05 20:58 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-11-05 20:58 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-05 20:58 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-11-05 20:50 36,352 --a------ C:\WINDOWS\system32\rqrsrrr.dll
2007-11-05 20:39 36,352 --a------ C:\WINDOWS\system32\qomklki.dll
2007-11-05 19:55 36,352 --a------ C:\WINDOWS\system32\wvuvtrq.dll
2007-11-05 19:53 36,352 --a------ C:\WINDOWS\system32\efccdaw.dll.vir
2007-11-04 21:20 10,752 -r-hs---- C:\WINDOWS\system32\mdasvc.exe
2007-11-02 17:39 56,448 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2007-11-02 17:39 56,448 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2007-11-02 17:38 50,688 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2007-11-02 17:38 50,688 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2007-11-02 17:38 45,568 --a------ C:\WINDOWS\system32\iyuv_32.dll
2007-11-02 17:38 45,568 --a--c--- C:\WINDOWS\system32\dllcache\iyuv_32.dll
2007-11-02 17:38 8,192 --a------ C:\WINDOWS\system32\tsbyuv.dll
2007-11-02 17:38 8,192 --a--c--- C:\WINDOWS\system32\dllcache\tsbyuv.dll
2007-11-01 19:32 26,528 -ra------ C:\WINDOWS\system32\drivers\lvuvcflt.sys
2007-11-01 19:32 24,960 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-11-01 19:32 24,960 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-12 18:39 --------- d-----w C:\Program Files\FoxTarot4
2007-11-08 20:07 --------- d-----w C:\Documents and Settings\malka\Application Data\LimeWire
2007-11-07 17:10 --------- d-----w C:\Program Files\MSN Messenger
2007-11-06 13:04 --------- d-----w C:\Program Files\Ubi Soft
2007-11-05 19:58 --------- d-----w C:\Program Files\Alwil Software
2007-09-14 20:32 --------- d-----w C:\Program Files\LimeWire
2007-09-14 20:32 --------- d-----w C:\Program Files\Java
2007-09-14 20:30 --------- d-----w C:\Program Files\Fichiers communs\Java
2006-11-11 14:07 17,144 ----a-w C:\Documents and Settings\malka\Application Data\GDIPFONTCACHEV1.DAT
2001-06-20 14:19 40,960 ----a-w C:\Program Files\ACMonitor_X83.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-04-23 11:24]
"nwiz"="nwiz.exe" [2004-04-23 11:24 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2004-04-23 11:24]
"Lexmark X83 Button Monitor"="C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe" [2001-10-12 17:36]
"Lexmark X83 Button Manager"="C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe" [2001-06-10 13:59]
"PrinTray"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe" [2001-10-25 19:20]
"SoundMan"="SOUNDMAN.EXE" [2003-08-14 23:34 C:\WINDOWS\SOUNDMAN.EXE]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 08:18]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00]
"Logical Disk Awareness"="mdasvc.exe" [2007-11-04 20:19 C:\WINDOWS\system32\mdasvc.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"Salestart(1)"="C:\Program Files\Fichiers communs\[u]0[/u]7%2F06%2F2007\stmon.exe" [2007-10-11 15:21]
"Salestart(2)"="C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe" [2007-10-09 18:00]
"Salestart(3)"="C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe" [2007-10-09 15:09]
"ac18511d"="C:\WINDOWS\System32\slbaylia.dll" [2007-11-12 17:40]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-08-28 13:00]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\System32\mllmn.dll

R0 PzWDM;PzWDM;C:\WINDOWS\System32\Drivers\PzWDM.sys
R3 WlanUIG;Sagem 802.11g Wireless LAN USB Adapter Driver;C:\WINDOWS\System32\DRIVERS\WlanUIG.sys
S2 BulkUsb;Genesys Logic USB Scanner Controller NT 5.0;C:\WINDOWS\System32\Drivers\usbscan.sys
S3 PAC7311;VGA SoC PC-Camer@;C:\WINDOWS\System32\DRIVERS\PA707UCM.SYS

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-11-02 14:16:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-13 13:57:41
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-13 13:59:56 - machine was rebooted
.
--- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:01:51, on 13/11/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\mdasvc.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\07%2F06%2F2007\stmon.exe
C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe
C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Logical Disk Awareness] mdasvc.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Salestart(1)] "C:\Program Files\Fichiers communs\07%2F06%2F2007\stmon.exe" dm=http://apu03c0.audientia.net; ad=http://apu03c0.audientia.net
O4 - HKLM\..\Run: [Salestart(2)] "C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe" dm=http://defensedudisque.com; ad=http://defensedudisque.com
O4 - HKLM\..\Run: [Salestart(3)] "C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe" dm=http://moncontenuassistant.com; ad=http://moncontenuassistant.com
O4 - HKLM\..\Run: [ac18511d] rundll32.exe "C:\WINDOWS\System32\slbaylia.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

je n'ai plus rien à faire??

Si lol

Dans ajout/suppression de programmes tu as ceci?
DefenseDuDisque
MonContenuassistant

A+

dsl j'ai posé la question comme je n'avais plus de réponse.

non je les ai pas dans ajout/suppression, j'avais dû les supprimer avant