Voici mon rapport hijackthis

salut,

fais ceci :

a l´aide de hijack this coche et fix les lignes suivantes :

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/

comment fixer :

Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)

-> http://pageperso.aol.fr/balltrap34/demohijack.htm

puis passe ceci :

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

Avant d'utiliser ComboFix :

-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.

Une fois fait, sur ton bureau double-clic sur Combofix.exe.

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message ainsi qu´un nouveau rapport hijack this.

-> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

dis moi aussi ce que tu pensses de ceci :

A propos de Boonty games

Utilises tu des jeux de boonty games depuis longtemps ?

Voici une petite information sur Boonty games

Leur politique :

"Il se peut que nous partageons aussi des informations payantes avec des tiers
qui fournissent des services payants et partage des données regroupées montrant le type
et le nombre de jeux vidéos que vous téléchargez, votre age, votre sexe, vos occupations,
niveau d'éducation, localité géographique, données sur l'équipement de votre ordinateur,
internet et intérêts pour les jeux vidéos, activités et entraînement des jeux édités.
De plus, nous partageons les adresses email avec des tiers fournisseurs de compte mails
qui nous assistent en envoyant nos mails a de nombreux clients en même temps..."

Si tu es d'accord avec eux, pas de problèmes sinon...

@+

Merci g!rly,

Je vais faire tout ça dès ce soir, ce matin j'ai peu de temps, je te tiens au courant.

Concernant boonty games, j'aimerais le supprimé, je ne joue pas au jeux video (ça doit être mon frangin qui la installé), mon ordi me sert essentiellement à faire ma musique.

A+ ;)

De rien kellyssa,

Ok tres bien, post les rapports quand tu auras le temps.

Cool, tu fais quoi comme musique ? J´en fais aussi ;-)

@+

Hello g!rly,

Désolé pour le retard, voici mon rapport de combofix:

ComboFix 08-03-14.4 - alex 2008-03-14 23:50:57.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1700 [GMT 1:00]
Endroit: F:\Documents and Settings\alex\Bureau\ComboFix.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\winupdates
C:\Program Files\winupdates\a.zip
C:\WINDOWS\system32\_000005_.tmp.dll
C:\WINDOWS\system32\_000013_.tmp.dll
C:\WINDOWS\system32\_000016_.tmp.dll
C:\WINDOWS\system32\_000017_.tmp.dll
C:\WINDOWS\system32\_000018_.tmp.dll
C:\WINDOWS\system32\_000019_.tmp.dll
C:\WINDOWS\system32\_000020_.tmp.dll
C:\WINDOWS\system32\_000023_.tmp.dll

.
((((((((((((((((((((((((((((( Fichiers créés 2008-02-14 to 2008-03-14 ))))))))))))))))))))))))))))))))))))
.

2008-03-14 20:57 . 2008-03-14 20:57 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-03-14 20:57 . 2008-03-14 20:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-03-14 20:57 . 2008-03-14 20:57 <REP> d-------- C:\Documents and Settings\alex\Application Data\Malwarebytes
2008-03-14 19:51 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-03-14 19:20 . 2008-03-14 19:20 382,352 --a------ C:\Documents and Settings\alex\jre-6u5-windows-i586-p-iftw.exe
2008-03-14 19:19 . 2008-03-14 19:19 0 --------- C:\Documents and Settings\alex\jre-6u5-windows-i586-p.exe
2008-03-13 00:06 . 2008-03-13 00:06 <REP> d-------- C:\Program Files\Microsoft
2008-03-13 00:06 . 2004-08-28 02:06 61,440 --a------ C:\WINDOWS\UnDeploy.exe
2008-03-12 20:59 . 2008-03-12 20:59 <REP> d-------- C:\Program Files\Trend Micro
2008-03-11 22:46 . 2008-01-28 14:20 142,982 --a------ C:\Documents and Settings\alex\BPROCIDF.COM
2008-03-11 22:46 . 2008-01-28 14:19 24,566 --a------ C:\Documents and Settings\alex\BTWRITE.EXE
2008-03-11 22:46 . 2008-01-28 14:20 3,218 --a------ C:\Documents and Settings\alex\SETUP.BAT
2008-03-11 21:58 . 2008-03-14 23:54 866,336 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-03-11 21:58 . 2008-03-14 21:01 12,920 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-03-11 21:50 . 2008-03-11 21:50 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-03-11 21:49 . 2007-12-13 19:27 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-03-11 21:49 . 2007-12-13 19:27 54,672 --a------ C:\WINDOWS\system32\vsutil_loc040c.dll
2008-03-11 21:49 . 2007-12-13 19:27 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll
2008-03-11 21:49 . 2007-12-13 19:27 21,904 --a------ C:\WINDOWS\system32\imsinstall_loc040c.dll
2008-03-11 21:49 . 2007-12-13 19:27 17,808 --a------ C:\WINDOWS\system32\imslsp_install_loc040c.dll
2008-03-11 21:49 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
2008-03-11 21:49 . 2008-03-11 21:54 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-03-11 21:48 . 2008-03-11 21:48 <REP> d-------- C:\Program Files\Zone Labs
2008-03-11 21:47 . 2008-03-14 23:48 <REP> d-------- C:\WINDOWS\Internet Logs
2008-03-11 19:10 . 2008-03-11 19:12 <REP> d-------- C:\Program Files\RegCleaner
2008-03-11 18:06 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-03-11 18:06 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-03-11 18:06 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-03-11 18:06 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-03-11 18:06 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-03-11 18:06 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-03-11 18:05 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-03-11 18:05 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-03-11 12:58 . 2008-03-11 15:56 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-03-10 23:19 . 2008-03-11 05:22 358 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
2008-03-10 23:15 . 2008-03-10 23:15 9,522 --a------ C:\WINDOWS\Retaften.bmp
2008-03-10 23:15 . 2008-03-10 23:15 0 --a------ C:\WINDOWS\system32\drivers\IsPubDrv.sys
2008-03-10 23:15 . 2008-03-10 23:15 0 --a------ C:\WINDOWS\system32\drivers\IsDrv118.sys
2008-03-10 21:56 . 2008-03-10 21:56 <REP> d-------- C:\Program Files\Sunbelt Software
2008-03-08 22:15 . 2008-03-11 23:01 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-08 22:15 . 2008-03-08 22:15 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-08 22:08 . 2008-03-08 22:08 <REP> d-------- C:\Program Files\Windows Resource Kits
2008-03-07 20:53 . 2008-03-14 20:57 <REP> d-------- C:\Documents and Settings\All Users\Bureau
2008-03-07 06:48 . 2008-03-07 06:48 <REP> d-------- C:\Program Files\TC Electronic
2008-03-07 06:44 . 2008-03-11 15:57 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-03-05 21:32 . 2008-03-05 21:32 <REP> d-------- C:\Documents and Settings\alex\Application Data\TC Electronic
2008-03-05 20:55 . 2008-03-05 20:55 <REP> d-------- C:\Documents and Settings\alex\Application Data\Steinberg
2008-03-05 20:44 . 2008-03-11 23:01 1,759 --a------ C:\WINDOWS\LE
2008-03-05 19:50 . 2008-03-11 22:59 <REP> d-------- C:\Program Files\Steinberg
2008-03-05 19:50 . 2008-03-05 19:50 <REP> d-------- C:\Program Files\DIFX
2008-03-05 19:50 . 2008-01-15 16:16 123,648 --a------ C:\WINDOWS\system32\drivers\TCNear.sys
2008-03-05 19:50 . 2008-01-15 16:16 106,496 --a------ C:\WINDOWS\system32\TCNearAsio.dll
2008-03-05 19:50 . 2008-01-15 16:16 20,992 --a------ C:\WINDOWS\system32\drivers\TCNearAudio.sys
2008-03-05 19:50 . 2008-01-15 16:16 20,352 --a------ C:\WINDOWS\system32\drivers\TCNearMidi.sys
2008-02-28 23:46 . 2008-02-29 06:02 <REP> d-------- C:\WINDOWS\SxsCaPendDel
2008-02-19 18:27 . 2005-08-13 01:11 61,312 --a------ C:\WINDOWS\system32\drivers\ohci1394.sys
2008-02-19 18:27 . 2005-08-13 01:11 61,312 --a--c--- C:\WINDOWS\system32\dllcache\ohci1394.sys
2008-02-19 18:27 . 2001-08-17 21:46 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2008-02-19 18:27 . 2001-08-17 21:46 6,400 --a--c--- C:\WINDOWS\system32\dllcache\enum1394.sys
2008-02-19 18:26 . 2004-08-03 23:10 53,248 --a------ C:\WINDOWS\system32\drivers\1394bus.sys
2008-02-19 18:26 . 2004-08-03 23:10 53,248 --a--c--- C:\WINDOWS\system32\dllcache\1394bus.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-14 22:41 --------- d-----w C:\Program Files\Virtools Web Player 3.5
2008-03-14 20:22 --------- d-----w C:\Program Files\Common Files
2008-03-14 19:47 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-03-14 19:25 --------- d-----w C:\Program Files\Java
2008-03-12 21:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-03-11 19:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-11 18:38 --------- d-----w C:\Program Files\CCleaner
2008-03-11 15:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-03-11 14:59 --------- d-----w C:\Program Files\Macrogaming
2008-03-06 19:37 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-28 23:01 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-02-27 19:37 --------- d-----w C:\Program Files\Mp3 My Mp3 2.0
2008-02-13 03:01 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-02-12 05:08 --------- d-----w C:\Program Files\ASIO4ALL v2
2008-02-10 08:18 --------- d-----w C:\Documents and Settings\alex\Application Data\LimeWire
2008-02-10 07:22 --------- d-----w C:\Program Files\Audacity
2008-02-10 07:19 --------- d-----w C:\Documents and Settings\alex\Application Data\Digidesign
2008-02-09 20:55 --------- d-----w C:\Program Files\Digidesign
2008-02-09 14:56 --------- d-----w C:\Documents and Settings\alex\Application Data\PACE Anti-Piracy
2008-02-08 03:27 --------- d-----w C:\Program Files\Ratajik Software
2008-02-06 05:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Propellerhead Software
2008-02-06 05:27 --------- d-----w C:\Documents and Settings\alex\Application Data\Propellerhead Software
2008-02-06 02:24 --------- d-----w C:\Program Files\Shareaza
2008-02-06 02:24 --------- d-----w C:\Documents and Settings\alex\Application Data\Shareaza
2008-01-27 18:45 --------- d-----w C:\Program Files\IrfanView
2008-01-25 19:06 --------- d-----w C:\Documents and Settings\alex\Application Data\Samsung
2008-01-25 18:48 --------- d-----w C:\Program Files\Samsung
2008-01-16 04:58 --------- d-----w C:\Program Files\QuickZip4
2008-01-16 04:57 --------- d-----w C:\Program Files\Lavalys
2008-01-15 15:17 155,648 ----a-w C:\WINDOWS\system32\EioPal.dll
2008-01-15 15:15 114,688 ----a-w C:\WINDOWS\system32\nsp.dll
2008-01-15 15:15 1,441,792 ----a-w C:\WINDOWS\system32\nspw7.dll
2008-01-15 15:15 1,429,504 ----a-w C:\WINDOWS\system32\nspa6.dll
2008-01-15 15:15 1,404,928 ----a-w C:\WINDOWS\system32\nspm6.dll
2008-01-15 15:15 1,335,296 ----a-w C:\WINDOWS\system32\nspm5.dll
2008-01-15 15:15 1,318,912 ----a-w C:\WINDOWS\system32\nspp6.dll
2008-01-15 15:15 1,306,624 ----a-w C:\WINDOWS\system32\nsppx.dll
2007-01-15 19:07 25,600 ----a-w C:\Documents and Settings\alex\usbsermptxp.sys
2007-01-15 19:07 22,768 ----a-w C:\Documents and Settings\alex\usbsermpt.sys
2003-06-25 15:05 120,832 ----a-w C:\Program Files\TweakUI_XP.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Free Download Manager"="...C:\Program Files\Free Download Manager\fdm.exe" [ ]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="...C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-23 20:58 68856]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 08:59 204288]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-07 08:19 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 08:07 114688]
"IMONTRAY"="...C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe" [ ]
"NeroFilterCheck"="...C:\WINDOWS\system32\NeroCheck.exe" [ ]
"DVDTray"="...C:\Program Files\HP DVD\Umbrella\DVDTray.exe" [ ]
"DVDBitSet"="...C:\Program Files\HP DVD\Umbrella\DVDBitSet.exe" [ ]
"CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2005-05-19 14:47 57344]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-05 14:52 849280]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41 282624]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-12-13 19:27 919016]
"ZNsoft Optimizer Xp"="C:\Program Files\ZNsoft Corporation\ZNsoft Optimizer Xp\ZNsoft Xp.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WDM_MIDISYNTH0"="streamci.dll" [2004-08-05 13:00 8192 C:\WINDOWS\system32\streamci.dll]
"WDM_MIDISYNTH1"="streamci.dll" [2004-08-05 13:00 8192 C:\WINDOWS\system32\streamci.dll]
"WDM_MIDISYNTH2"="streamci.dll" [2004-08-05 13:00 8192 C:\WINDOWS\system32\streamci.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-05 13:00 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
SyncML Desktop Server.lnk - C:\Program Files\TOSHIBA\MobilePhoneConnectivity\My Mobile\SyncML Desktop Server\SyncMLDesktopServer.exe [2006-02-03 15:59:32 3383296]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\policies\microsoft\windows\windowsupdate\au]
"NoAutoUpdate"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DigidesignMMERefresh]
D:\Digidesign\Drivers\MMERefresh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMConnectCDS"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\Bluewin\\Netopia_Router\\Wizard\\NetAgentBW.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6346:UDP"= 6346:UDP:shareaza
"6346:TCP"= 6346:TCP:shareaza

S0 black;black;C:\WINDOWS\system32\drivers\BlackDrv.sys []
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2003-12-19 20:15]
S3 dalwdmservice;dal service;C:\WINDOWS\system32\drivers\dalwdm.sys []
S3 kvpndev;Kerio VPN adapter;C:\WINDOWS\system32\DRIVERS\kvpndrv.sys [2005-07-26 12:39]
S3 MBAMCatchMe;MBAMCatchMe;C:\Program Files\Malwarebytes' Anti-Malware\catchme.sys [2008-03-09 17:29]
S3 MPD16USB;AKAIpro MPD16 Driver;C:\WINDOWS\system32\Drivers\MPD16USB.sys [2002-07-01 15:09]
S3 RapFile;RapFile;C:\WINDOWS\system32\drivers\RapFile.sys [2003-02-25 18:26]
S3 RapNet;RapNet;C:\WINDOWS\system32\drivers\RapNet.sys [2003-02-25 18:26]
S3 TCNear;TC Near;C:\WINDOWS\system32\Drivers\TCNear.sys [2008-01-15 16:16]
S3 TCNearAudio;TC Near Audio;C:\WINDOWS\system32\drivers\TCNearAudio.sys [2008-01-15 16:16]
S3 TCNearMidi;TC Near MIDI;C:\WINDOWS\system32\drivers\TCNearMidi.sys [2008-01-15 16:16]
S3 tsbenum;tsbenum;C:\WINDOWS\system32\DRIVERS\tsbenum.sys [2005-02-14 15:02]
S3 tsbvfatc;tsbvfatc;C:\WINDOWS\system32\DRIVERS\tsbvfatc.sys [2005-10-05 15:08]
S3 tsbvfmdm;tsbvfmdm;C:\WINDOWS\system32\DRIVERS\tsbvfmdm.sys [2005-10-05 15:08]
S3 tsbvfobe;tsbvfobe;C:\WINDOWS\system32\DRIVERS\tsbvfobe.sys [2005-10-05 15:08]
S3 USBSHGX;SHARP GSM GPRS USB Driver 1.0.0;C:\WINDOWS\system32\DRIVERS\usbshgx.sys [2004-01-25 22:49]

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-05-21 19:44:18 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job"
- C:\Program Files\Microsoft IntelliPoint\ipoint.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-14 23:54:47
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-03-14 23:56:23
ComboFix-quarantined-files.txt 2008-03-14 22:56:18
.
2008-02-13 05:42:00 --- E O F ---

Ensuite le rapport Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:25:43, on 15.03.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\TOSHIBA\MobilePhoneConnectivity\My Mobile\SyncML Desktop Server\SyncMLDesktopServer.exe
C:\Program Files\TOSHIBA\MobilePhoneConnectivity\My Mobile\SyncML Desktop Server\SyncController.exe
C:\Program Files\TOSHIBA\MobilePhoneConnectivity\My Mobile\Phone Monitor\epmworker.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ch/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [IMONTRAY] ...C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] ...C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DVDTray] ..."C:\Program Files\HP DVD\Umbrella\DVDTray.exe"
O4 - HKLM\..\Run: [DVDBitSet] ..."C:\Program Files\HP DVD\Umbrella\DVDBitSet.exe" /NOUI
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ZNsoft Optimizer Xp] C:\Program Files\ZNsoft Corporation\ZNsoft Optimizer Xp\ZNsoft Xp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\RunOnce: [WDM_MIDISYNTH0] rundll32.exe streamci.dll,StreamingDeviceSetup {B0C2EBA2-1099-4e80-A7F1-984910EB435E},MidiSyn,{2EB07EA0-7E70-11D0-A5D6-28DB04C10000},e:\software\drivers\audio\analog_devices__soundmax__cadenza_\5.12.01.3630_sm4_sf\sm_synth\sys\MidiSyn.inf,MIDI_SYNTH.Interface.Install
O4 - HKLM\..\RunOnce: [WDM_MIDISYNTH1] rundll32.exe streamci.dll,StreamingDeviceSetup {B0C2EBA2-1099-4e80-A7F1-984910EB435E},MidiSyn,{DFF220F3-F70F-11D0-B917-00A0C9223196},e:\software\drivers\audio\analog_devices__soundmax__cadenza_\5.12.01.3630_sm4_sf\sm_synth\sys\MidiSyn.inf,MIDI_SYNTH.Interface.Install
O4 - HKLM\..\RunOnce: [WDM_MIDISYNTH2] rundll32.exe streamci.dll,StreamingDeviceSetup {B0C2EBA2-1099-4e80-A7F1-984910EB435E},MidiSyn,{6994AD04-93EF-11D0-A3CC-00A0C9223196},e:\software\drivers\audio\analog_devices__soundmax__cadenza_\5.12.01.3630_sm4_sf\sm_synth\sys\MidiSyn.inf,MIDI_SYNTH.Interface.Install
O4 - HKCU\..\Run: [Free Download Manager] ...C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] ..."C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: SyncML Desktop Server.lnk = C:\Program Files\TOSHIBA\MobilePhoneConnectivity\My Mobile\SyncML Desktop Server\SyncMLDesktopServer.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://www.msn.com/fr-fr/
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by22fd.bay22.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

salut kellysa,

supprime ce programme :

C:\Program Files\Virtools Web Player 3.5

regarde ceci concernant avast :

antivir vs avast :

-> http://forum.malekal.com/ftopic3528.php

alors je te conseille de le desinstaller et d´installer antivir a la place

Telecharge et instales l'antivirus Antivir Personal Edition Classic :

->https://www.malekal.com/avira-free-security-antivirus-gratuit/

https://www.avira.com/en/prime

http://mickael.barroux.free.fr/securite/antivir.php
http://speedweb1.free.fr/frames2.php?page=tuto5
<- tutoriel configuration du scanner...

une fois antivir ouvert click surconfiguration et coche la case "expert mode" puis sur l´onglet scanner dans la fenetre du dessous tu va voir : rootkit search click sur le petit + pour deployer et coche la case a coté de ton disk dur
puis click sur configuration en haut a droite; dans la nouvelle fenetre a gauche >scanner > coche "scan all files" et en dessous >scanner priority = High
coche : allow stopping the scanner, comme cela tu peux faire une pause pendant le scan si tu le desir.
puis sur la droite coche les case suivantes :
scan boot sectors of selected drives
scan master boot sectors
scan memory
search foe rootkit before scan
decoche :
ignore off line files
toujours a gauche > scan > deploie > heuristique > macrovirus heuristic = coché et en dessous > win32 heuristic la case coché et high detection level

Je te dis tous ca car j´aimerais que tu performes un scan entier de ta machine a l´aide d´antivir avec les reglages stipulés ci dessus et que tu post le rapport généré ici stp

moi je suis plutot dans le downtempo ;-)

voici mon myspace si tu veux jetter un coup d oeuil o_Ö

https://myspace.com/periwigs

@+

Salut g!rly,

J'ai effectué le scan avec antivir, voici le résultat:

AntiVir PersonalEdition Classic
Report file date: samedi, 15. mars 2008 21:24

Scanning for 1147670 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: alex
Computer name: REPOND

Version information:
BUILD.DAT : 270 15603 Bytes 19.09.2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23.08.2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16.08.2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14.08.2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21.08.2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18.07.2007 14:27:15
ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07.03.2008 20:03:21
ANTIVIR2.VDF : 7.0.3.3 2048 Bytes 07.03.2008 20:03:21
ANTIVIR3.VDF : 7.0.3.31 158208 Bytes 14.03.2008 20:03:21
AVEWIN32.DLL : 7.6.0.73 3334656 Bytes 15.03.2008 20:03:23
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26.02.2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18.07.2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16.04.2007 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 15.03.2008 20:03:23
AVREG.DLL : 7.0.1.6 30760 Bytes 18.07.2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28.08.2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18.07.2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08.03.2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07.08.2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21.08.2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23.07.2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Rootkit search
Configuration file...............: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\rootkit.avp
Logging..........................: high
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Scan memory......................: off
Process scan.....................: off
Scan registry....................: off
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high
Expanded search settings.........: 0x00300922

Start of the scan: samedi, 15. mars 2008 21:24

Starting search for hidden objects.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32\threadingmodel
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32\cd042efbbd7f7af1647644e76e06692b
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32\threadingmodel
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32\bca643cdc5c2726b20d2ecedcc62c59b
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32\threadingmodel
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32\2c81e34222e8052573023a60d06dd016
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32\threadingmodel
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32\2582ae41fb52324423be06337561aa48
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32\threadingmodel
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32\caaeda5fd7a9ed7697d9686d4b818472
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32\threadingmodel
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32\a4a1bcf2cc2b8bc3716b74b2b4522f5d
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32\threadingmodel
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32\4d370831d2c43cd13623e232fed27b7b
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32\threadingmodel
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32\1d68fe701cdea33e477eb204b76f993d
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32\threadingmodel
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32\1fac81b91d8e3c5aa4b0a51804d844a3
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32\threadingmodel
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32\f5f62a6129303efb32fbe080bb27835b
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32\threadingmodel
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32\fd4e2e1a3940b94dceb5a6a021f2e3c6
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32\threadingmodel
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32\8a8aec57dd6508a385616fbc86791ec2
[NOTE] The registry entry is invisible.
'322812' objects were checked, '24' hidden objects were found.

End of the scan: samedi, 15. mars 2008 23:10
Used time: 1:46:23 min

The scan has been done completely.

0 Scanning directories
0 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
0 Files cannot be scanned
0 Files not concerned
0 Archives were scanned
0 Warnings
0 Notes
322812 Objects were scanned with rootkit scan
24 Hidden objects were found

J'espère ne pas m'être trompé, mais il me semble que ça été.

Encore merci, tes explications sont très claires.

J'ai jeté une oreille sur ton myspace, bon travail, c'est très planant comme musique.

Je te donnerais bien mon myspace mais il n'est qu'à l'état de construction, et ça, c'est une autre paire de manche, lol.

A+ ;-)

re,

merci de ton avis sur mon son ;-) dommage que ton myspace n´est pas terminé...

fais ceci :

Fix.reg

Ouvre le bloc-notes (click droit sur le bureau > dans l´arborescence choisie nouveau et nouveau fichier texte) et fais un copier coller de ce qui est en citation ci-dessous (copie tout d'un trait-sans les barres(x)) :

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
REGEDIT4

[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocSer­ver32\threadingmodel]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocSer­ver32\cd042efbbd7f7af1647644e76e06692b]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocSer­ver32\threadingmodel]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocSer­ver32\bca643cdc5c2726b20d2ecedcc62c59b]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocSer­ver32\threadingmodel]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocSer­ver32\2c81e34222e8052573023a60d06dd016]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocSer­ver32\threadingmodel]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocSer­ver32\2582ae41fb52324423be06337561aa48]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocSer­ver32\threadingmodel]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocSer­ver32\caaeda5fd7a9ed7697d9686d4b818472]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocSer­ver32\threadingmodel]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocSer­ver32\a4a1bcf2cc2b8bc3716b74b2b4522f5d]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocSer­ver32\threadingmodel]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocSer­ver32\4d370831d2c43cd13623e232fed27b7b]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocSer­ver32\threadingmodel]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocSer­ver32\1d68fe701cdea33e477eb204b76f993d]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocSer­ver32\threadingmodel]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocSer­ver32\1fac81b91d8e3c5aa4b0a51804d844a3]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocSer­ver32\threadingmodel]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocSer­ver32\f5f62a6129303efb32fbe080bb27835b]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocSer­ver32\threadingmodel]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocSer­ver32\fd4e2e1a3940b94dceb5a6a021f2e3c6]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocSer­ver32\threadingmodel]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocSer­ver32\8a8aec57dd6508a385616fbc86791ec2]

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Note : Regedit4 est sur la premiere ligne dans le bloc note et il y a une ligne blanche a la fin.
Puis click sur "fichier"/"enregistrer sous" :
dans : sur le bureau
Nom du fichier : fix.reg
Type de fichier : "tous les fichiers"
clique sur "enregistrer"

ca doit ressembler a ca une fois enrregistré :

http://img520.imageshack.us/img520/4251/screenshot005ps2.png

quitte internet et double clique sur fix.reg => tu dois obligatoirement avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?"
Si c'est bien le cas, clique sur "oui"

repost un nouveau hijack this stp

as tu bien supprimé : C:\Program Files\Virtools Web Player 3.5 ?

@+

Si tout c'est bien passé, ça donne ça:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:40:15, on 16.03.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\TOSHIBA\MobilePhoneConnectivity\My Mobile\SyncML Desktop Server\SyncMLDesktopServer.exe
C:\Program Files\TOSHIBA\MobilePhoneConnectivity\My Mobile\SyncML Desktop Server\SyncController.exe
C:\Program Files\TOSHIBA\MobilePhoneConnectivity\My Mobile\Phone Monitor\epmworker.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
F:\Reason\Reason.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avconfig.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ch/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [IMONTRAY] ...C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] ...C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DVDTray] ..."C:\Program Files\HP DVD\Umbrella\DVDTray.exe"
O4 - HKLM\..\Run: [DVDBitSet] ..."C:\Program Files\HP DVD\Umbrella\DVDBitSet.exe" /NOUI
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ZNsoft Optimizer Xp] C:\Program Files\ZNsoft Corporation\ZNsoft Optimizer Xp\ZNsoft Xp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Free Download Manager] ...C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] ..."C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: SyncML Desktop Server.lnk = C:\Program Files\TOSHIBA\MobilePhoneConnectivity\My Mobile\SyncML Desktop Server\SyncMLDesktopServer.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://www.msn.com/fr-fr/
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by22fd.bay22.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

bon tres bien kellysa,

on va en rester la,

comment ca va de ton coté ?

fais ceci pour supprimer les outils que nous avons utilisés

Télécharge ToolsCleaner sur ton bureau.
--> http://www.commentcamarche.net/telecharger/telechargement 34055291 toolsclean(...)
# Clique sur Recherche et laisse le scan agir ...
# Clique sur Suppression pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

@+

Voilà le rapport:

-->- Recherche:

C:\Qoobox: trouvé !
C:\Documents and Settings\alex\Recent\HijackThis.lnk: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\QooBox\Quarantine\C\Combofix: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\alex\Recent\HijackThis.lnk: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Qoobox: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Corbeille vidée!

A+

Ah, j'oubliais, j'ai lancé le scan antivir sur le disque local (C:) et il y à eu plusieurs alertes.

Voici le rapport, au cas où ça peux te renseigner, sinon tanpis.

AntiVir PersonalEdition Classic
Report file date: dimanche, 16. mars 2008 00:32

Scanning for 1147670 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: REPOND

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 20:03:21
ANTIVIR2.VDF : 7.0.3.3 2048 Bytes 07/03/2008 20:03:21
ANTIVIR3.VDF : 7.0.3.31 158208 Bytes 14/03/2008 20:03:21
AVEWIN32.DLL : 7.6.0.73 3334656 Bytes 15/03/2008 20:03:23
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 15/03/2008 20:03:23
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: F:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: dimanche, 16. mars 2008 00:32

Starting search for hidden objects.
'41443' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avconfig.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'Reason.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'epmworker.exe' - '1' Module(s) have been scanned
Scan process 'SyncController.exe' - '1' Module(s) have been scanned
Scan process 'SyncMLDesktopServer.exe' - '1' Module(s) have been scanned
Scan process 'wmpnscfg.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'zlclient.exe' - '0' Module(s) have been scanned
Scan process 'qttask.exe' - '1' Module(s) have been scanned
Scan process 'ipoint.exe' - '1' Module(s) have been scanned
Scan process 'hkcmd.exe' - '1' Module(s) have been scanned
Scan process 'igfxtray.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wmpnetwk.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'PnkBstrA.exe' - '1' Module(s) have been scanned
Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'brss01a.exe' - '1' Module(s) have been scanned
Scan process 'brsvc01a.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'vsmon.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
39 processes with 39 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[NOTE] No virus was found!
Master boot sector HD1
[NOTE] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'D:\'
[NOTE] No virus was found!
Boot sector 'F:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '27' files ).

Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20080314-212056-950.dll
[DETECTION] Is the Trojan horse TR/Delf.55296
[INFO] The file was moved to '483f61c8.qua'!
C:\System Volume Information\_restore{6F2388D4-64AC-4F12-9662-980ED64C089F}\RP455\A0022707.dll
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '480c6332.qua'!
C:\System Volume Information\_restore{6F2388D4-64AC-4F12-9662-980ED64C089F}\RP458\A0029119.dll
[DETECTION] Is the Trojan horse TR/Delf.55296
[INFO] The file was moved to '480c64bc.qua'!
C:\WINDOWS\_aleste.exe
[DETECTION] Contains detection pattern of the dropper DR/Python.Lesta.A
[INFO] The file was moved to '48486502.qua'!
Begin scan in 'D:\' <Other>
Begin scan in 'F:\' <Data>

End of the scan: dimanche, 16. mars 2008 01:38
Used time: 1:06:55 min

The scan has been done completely.

5483 Scanning directories
114917 Files were scanned
3 viruses and/or unwanted programs were found
1 Files were classified as suspicious:
0 files were deleted
0 files were repaired
4 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
114914 Files not concerned
889 Archives were scanned
1 Warnings
1 Notes
41443 Objects were scanned with rootkit scan
0 Hidden objects were found

A bientôt

re,

ok je n´avais pas fais gafe tout a l´heure que tu avais seulement scanné le registre...

cette fois ci :

antivir nous informe que l´une des clé fixé par hijack this etait verolé, donc elle se voie dans le back up.

la restauration est touché

mais on va reparé ca par une simple manip apres le scan de bit defender

par contre il a detecté une saletée de ver dans le dossier windows qu´il a mis en quarantaine...

peux tu perforemer encore ce scan en ligne comme cela on sera fixé :

Scan en ligne bitdefender :

https://www.bitdefender.com/toolbox/

Clicker sur " I agree " et suivre les indications

A faire imperativement sous internet explorer, en acceptant l´activ x

tutoriel en image en image

http://pageperso.aol.fr/rginformatique/mapage/defender.htm

@+

Hello,

Par précaution j'affiche le rapport de bitdefender
BitDefender Online Scanner

Scan report generated at: Sun, Mar 16, 2008 - 09:52:04

Scan path: A:\;C:\;D:\;E:\;F:\;

Statistics

Time

01:19:25

Files

129685

Folders

5475

Boot Sectors

5

Archives

1481

Packed Files

6186

Results

Identified Viruses

3

Infected Files

6

Suspect Files

0

Warnings

0

Disinfected

0

Deleted Files

6

Engines Info

Virus Definitions

999772

Engine build

AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Scan plugins

16

Archive plugins

41

Unpack plugins

7

E-mail plugins

6

System plugins

5

Scan Settings

First Action

Disinfect

Second Action

Delete

Heuristics

Yes

Enable Warnings

Yes

Scanned Extensions

*;

Exclude Extensions

Scan Emails

Yes

Scan Archives

Yes

Scan Packed

Yes

Scan Files

Yes

Scan Boot

Yes

Scanned File

Status

C:\Program Files\AxBx\VirusKeeper 2005 Pro\Quarantaine\cmesys.exe

Detected with: Application.VTesttool.A

C:\Program Files\AxBx\VirusKeeper 2005 Pro\Quarantaine\cmesys.exe

Deleted

C:\Program Files\AxBx\VirusKeeper 2005 Pro\Quarantaine\system32.exe

Detected with: Application.VTesttool.C

C:\Program Files\AxBx\VirusKeeper 2005 Pro\Quarantaine\system32.exe

Deleted

C:\Program Files\Microsoft AntiSpyware\Quarantine\209D51CC-841C-42A8-B042-D52988\7EF43775-B868-4403-A2BB-E72C10

Detected with: Application.Winfixer.DZ

C:\Program Files\Microsoft AntiSpyware\Quarantine\209D51CC-841C-42A8-B042-D52988\7EF43775-B868-4403-A2BB-E72C10

Disinfection failed

C:\Program Files\Microsoft AntiSpyware\Quarantine\209D51CC-841C-42A8-B042-D52988\7EF43775-B868-4403-A2BB-E72C10

Deleted

C:\Program Files\Microsoft AntiSpyware\Quarantine\9F66CA26-67BB-4F7D-ABAD-6A32F4\224BB794-EE05-4135-B7A6-8F10F9

Detected with: Application.VTesttool.C

C:\Program Files\Microsoft AntiSpyware\Quarantine\9F66CA26-67BB-4F7D-ABAD-6A32F4\224BB794-EE05-4135-B7A6-8F10F9

Deleted

C:\System Volume Information\_restore{6F2388D4-64AC-4F12-9662-980ED64C089F}\RP458\A0029227.exe

Detected with: Application.VTesttool.A

C:\System Volume Information\_restore{6F2388D4-64AC-4F12-9662-980ED64C089F}\RP458\A0029227.exe

Deleted

C:\System Volume Information\_restore{6F2388D4-64AC-4F12-9662-980ED64C089F}\RP458\A0029228.exe

Detected with: Application.VTesttool.C

C:\System Volume Information\_restore{6F2388D4-64AC-4F12-9662-980ED64C089F}\RP458\A0029228.exe

Deleted

Merci,

A+ ;-)

salut kellysa,

supprime ce programme : C:\Program Files\AxBx

puis

Désactive ta restauration système:
pour cela :
Click droit sur poste de travail, dans l´arborescence sur propriétés;
dans la nouvelle fenettre click sur l´onglet restauration système;
coche la case désactiver la restauration systèm et applique.
puis redemarre le pc et click droit sur poste de travail, dans l´arborescence sur propriétés;
dans la nouvelle fenettre click sur l´onglet restauration systèm
décoche la case désactiver la restauration systèm et applique.

puis instale ceci qui va bien te proteger en tache de fond sans consommer de processus :

anti spyware :

spywareblaster :

http://www.brightfort.com/spywareblaster.html

c´est un resident, il suffit de le mettre a jour de temps en temps car la version gratuite ne le fait pas toute seul , une fois installé et mis a jour tu mets toutes les protections sur "enable"

tuto : http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/question-spywareblaser-sujet_174747_1.htm

voila

@+

Merci, tes conseils me sont très précieux ;-)

A+

De rien kellyssa ;-)

dis moi comment ca va de ton coté maintenant ?

@+

Eh bien, du côté de la latence DPC sur Dpclat.exe, c'est toujours le même topo, des pics jusqu'à 20000us soit 20ms je crois, ce qui fais que le pilote audio plante toute les 10secondes.

Je sais pas quoi faire, comme j'ai pu lire sur des forum, j'ai dans l'idée que ce pourrait être un conflit entre des pilotes sur mon pc mais je ne sais pas comment effectuer la détection.

Autrement, déjà que mon pc soit propre c'est une bonne chose ;-)

Pour le reste je prends mon mal en patience, bien que ça fais mal d'avoir dépensé 300euros pour une carte son préamplifié qui me sert pour l'instant de décoration, lol.

A+

re,

tu peux essayer ce logiciel qui permet de regler la latence :

http://logiciel-musique-divers.michael-tippach.audiofanzine.com/produits/avis/index,idproduit,33709,mao,asio4all_freeware.html

dis moi quoi

@+

Ah oui, ce logiciel est excellent, je l'ai depuis presque un an.

Mon gros problème est le suivant, j'ai acheté ma carte son pour ses préampli micro, comme elle ne fonctionne pas correctement, je ne peux pas effectuer de prise de voix.

A+

ah ok ...

je craind que mes ressources s´arretent la ;-(

si tu post un message sur ce meme forum dans la rubrique audio numerique ou meme sur audio fanzine tu auras surement plus de chance...

@+