PC lent sur internet.

Bonsoir jacques.gache,

très bien ;-)

mais il faut procéder par étapes

et pour ceci tu propose quoi?
Saxo.exe regstart

@+

Bonsoir

très infecté!!!

je ne te promet rien il faut que tu sache qu'un pc très infectés peut se retrouver avec des disfonctionnement

suit les étapes dans l'ordre stp et poste tout les rapports demandé

pour commencer

* Télécharge malwarebytes
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

=> Installe le
=> Ensuite va en mode sans echec

Relance le Pc et tapote la touche F8 ( ou F5 pour certains) , jusqu’à l’apparition des inscriptions avec choix de démarrage
Avec les touches « flèches », sélectionne Mode sans échec ==> entrée ==>nom utilisateur habituel

=> Lance malwarebytes
=> Coche "Executer un examen complet"
=> Si tu es en présence d'une infection à la fin de l'examen clique sur "ok"
=> Clique sur Supprimer la sélection
=> Pour poster le rapport Clique sur l'onglet Rapports/Logs, sélectionne celui t'intéresse et clique sur Ouvrir
=> Fait copier coller et poste le rapport

--------------------------

ensuite

* Télécharge CCleaner
https://filehippo.com/download_ccleaner/
=> Aide toi de ce tuto pour l'utiliser
https://www.malekal.com/tutoriel-ccleaner/

------------------------------------

ensuite

Télécharge BTFix 1.057 (de bibi26)
http://cluster1.easy-hebergement.net/
* Décompresse l'archive sur ton Bureau
* Ouvre le dossier BTFix
* Double clique sur BTFix.exe
* Clique sur Rechercher
* Un rapport va apparaître, copie/colle-le dans ta prochaine réponse

-------------------------------

ensuite

Télécharge sur le bureau : [url=http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe]navilog.exe/url

= installe le
= Double-Clic navilog1 qui est sur le bureau
= Appuyer sur une touche jusqu' arriver aux options
= Choisir option 1 ( = taper 1 )
ne pas utiliser les autres sans avis , il peut y avoir des processus légitimes

le rapport se trouve dans c: fixnavi.txt

tu postes ce rapport.

---------------------
Télecharge http://www.malekal.com/download/clean.zip sur le bureau
Dézippe sur le bureau.
= ouvrir le dossier clean
= clique sur le symbole roue dentée avec le nom clean
= choisir l'option 1 et laisser clean travailler jusqu'à l'apparition du texte "appuyer sur une touche pour continuer"
= ensuite colle le rapport que tu trouveras dans C:

ensuite mous verrons le reste

@+

slt
tu es infécté

sio tu as avast et f secure vire un des deux sinon cela va planter

_________

# télécharger Hoster :
http://www.funkytoad.com/download/HostsXpert.zip

# Dézipper le dossier sur le bureau.
# Lancer Hoster et cliquer sur Restore Microsoft's Hosts File

___________

scan avec
MalwareByte's Anti-Malware et vire ce qui est trouvé et colle le rapport

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
____________

Télécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !

Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic

Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.
______________
recolle un hijackhtis et dis tes soucis

a plus

salut

oula oui grand ménage à faire!!

commence par installer ce parefeu stp :

http://kerio.probb.fr/logiciels-et-tutoriels-f6/tutoriel-sunbelt-personal-firewall-45916-ex-kerio-t248.htm

c'est important!

ensuite lance ceci:

1) Imprime ces instructions ou copie les sur bloc note car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

2) Télécharge Malwarebytes' Anti-Malware (MBAM) et enregistre le sur ton bureau à partir de ce lien :

https://www.malwarebytes.com/

3) A la fin du téléchargement, ferme toutes les fenêtres et programmes, y compris celui-ci.

4) Double-clique sur l'icône Download_mbam-setup.exe sur ton bureau pour démarrer le programme d'installation.

5) Pendant l'installation, suis les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet). N'apporte aucune modification aux réglages par défaut et, en fin d'installation, vérifie que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware sont cochées.

6) MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse. Comme MBAM se met automatiquement à jour en fin d'installation, clique sur OK pour fermer la boîte de dialogue. La fenêtre principale de MBAM s'affiche :

7) Dans l'onglet analyse, vérifie que "Exécuter une analyse rapide" est coché et clique sur le bouton Rechercher pour démarrer l'analyse.

8) MBAM analyse ton ordinateur. L'analyse peut prendre un certain teps. Il suffit de vérifier de temps en temps son avancement.

9) A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.

10) Si des malwares ont été détectés, leur liste s'affiche.
En cliquant sur Suppression (?) , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

11) MBAM va ouvrir le bloc-notes et y copier le rapport d'analyse. Ferme le bloc-note. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)

12) Ferme MBAN en cliquant sur Quitter.

poste le rapport et relance hijack stp puis reposte le rapport

bises

bonjour ep44, j'aurais proposé combofix, navilog1,SDfix, et btfix @+

slt

ep44

je te laisse la main

bonne suite a tous

Hello à vous deux ;-)
je compte sur vos yeux avisés ;-)

Bonne soirée

Bonne nuit...

Comme je n'arrive pas à fermer l'oeil,je vais me lancer et faire la chasse aux virus sous vos commandements.
J'ai imprimé vos commentaires et les tutos de kério et ccleaner.
Maintenant,vous êtes plusieurs à donner une marche à suivre et je ne voudrai froisser personne,donc,qui suis-je?(ahahaha...euh pardon...).

Je vais commencer par installer kério,après je verrai si l'un de vous est aussi insomniaque.
En tous cas merci et à tout de suite(normalement)!

Ayé,j'en ai été quitte pour une petite frayeur.

Après avoir installé Kério et Malwarebytes,j'ai fait comme ep44 à écrit.
Mais le mode sans echec à été un échec,je me suis retrouvé à devoir faire un choix de cession entre "administrateur" et "HP je ne sais plus quoi" avec 5 messages pour ce dernier.De mémoire,il ne me semble pas avoir ouvert plusieurs comptes utilisateurs donc,j'ai cliqué sur administrateur.
J'ai eu droit à un fond d'écran noir et les raccourcis en grand format et sans barre d'outils.J'ai essayé de lancer Malwarebytes,mais j'ai eu un message d'erreur.
J'ai cliqué sur l'icône de wanadoo,erreur là aussi,j'ai donc fait un arrêt forcé à deux reprises car à la première tentative tout était bon sauf la barre d'outils et que rien ne se passait lorsque je bougeait la souris.
Maintenant,tout fonctionne "normalement",je vais voir ce que raconte Malwarebytes et je reviens.

A plus.

Me revoilà,donc,voici le rapport Malwarebytes et le Hijack est plus bas.

Malwarebytes' Anti-Malware 1.11
Version de la base de données: 721

Type de recherche: Examen rapide
Eléments examinés: 50096
Temps écoulé: 17 minute(s), 36 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 2
Clé(s) du Registre infectée(s): 29
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 6
Fichier(s) infecté(s): 12

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
c:\WINDOWS\system32\WinNt32.dll (Trojan.Downloader) -> Unloaded module successfully.
C:\WINDOWS\system32\WLCtrl32.dll (Trojan.Agent) -> Unloaded module successfully.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winnt32 (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{8d71eeb8-a1a7-4733-8fa2-1cac015c967d} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{014da6cc-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1e0de227-5ce4-4ea3-ab0c-8b03e1aa76bc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{53ced2d0-5e9a-4761-9005-648404e6f7e5} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7473d292-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7473d296-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tcpsr (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\tcpsr (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tcpsr (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\Sidebar.DLL (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1648e328-3e5a-4ea5-a9c6-e5f09ee272da} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1648e328-3e5a-4ea5-a9c6-e5f09ee272da} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{315108e4-e3af-460f-b264-f2acc9e1aceb} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{315108e4-e3af-460f-b264-f2acc9e1aceb} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WLCtrl32 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\HID_Layer (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\WR (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Carlson (Dialer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_FMTR (Rogue.Multiple) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\WinAble (Trojan.Adloader) -> Quarantined and deleted successfully.
C:\Program Files\Fichiers communs\Carlson (Dialer) -> Quarantined and deleted successfully.
C:\Program Files\Temporary (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2006 (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\SalesMonitor (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\SalesMonitor\Data (Rogue.Multiple) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
c:\WINDOWS\system32\WinNt32.dll (Trojan.Downloader) -> Delete on reboot.
C:\WINDOWS\system32\WinData.cab (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\Emt07.sys (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\tcpsr.sys (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\Vel18.sys (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\BN3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\BN4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\BN6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2006\AVScheduler.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\adssite_sidebar.dll (Adware.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\WLCtrl32.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\Temp\BN1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

Voilà le rapport Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:24:38, on 06/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\hphmon06.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\ps2.exe
C:\Program Files\QuickTime\QTTask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Securitoo\av_fw\fswsclds.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\PROGRA~1\MICROS~4\wcescomm.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Saxo\Saxo.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://french.ircfast2.com/index.php?rvs=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O1 - Hosts: 88.191.49.16 www.google.com
O1 - Hosts: 88.191.49.16 www.google.fr
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\MYGAME~1\eoRezo\EoAdv\EOREZO~1.DLL (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0\bin\ssv.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {C432CF91-1D08-3F1A-769A-72EDB22C7113} - C:\DOCUME~1\HP_PRO~1\APPLIC~1\CAKEJU~1\ace time.exe (file missing)
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [mfwgxvnyrq] c:\windows\system32\mfwgxvnyrq.exe mfwgxvnyrq
O4 - HKLM\..\Run: [dtewxvs] c:\windows\system32\dtewxvs.exe dtewxvs
O4 - HKLM\..\Run: [EoEngine] "C:\My Games\eoRezo\EoEngine.exe"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~4\wcescomm.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [WinAble] C:\Program Files\WinAble\winable.exe
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [Saxo] C:\Program Files\Saxo\Saxo.exe regstart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Startup: wkcalrem.LNK = C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxdm414YYFR
O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~2\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~2\Wanadoo Messager.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-30.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/10.20.0002/OCI/setup.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {A13516A3-BE86-4517-813C-B5FF0C8ACDF3} (Toontown Installer ActiveX Control French) - http://downloadtoontown.goa.com/sv1.5.11.6/ttinst-french.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {FD40EC41-D860-4579-8BA4-52671A45C71C} (AxHtChat Class) - http://images.goa.com/it/Woo2/fr/chat/nPaxChat.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O24 - Desktop Component 0: (no name) - https://www.microsoft.com/fr-fr/windows

Bon,désolé pour les posts à répétition,je ne suis pas nombriliste hein!

Juste pour dire que depuis que j'ai installé Kério,j'ai toujours des fenêtre d'"alerte de connexion sortante(zone sécurisée)" qui s'ouvrent.
Je suppose que je dois cocher "créer une règle...",mais comme je suis un peu parano depuis tout-à-l'heure,j'attendrai une confirmation.

Sur ce,je vais aller siester moi aussi,comme ça je ne ferai pas de boulette supplémentaire en votre absence.

Merci encore et à plus tard.

slt
pour avancer ep44

# télécharger Hoster :
http://www.funkytoad.com/download/HostsXpert.zip

# Dézipper le dossier sur le bureau.
# Lancer Hoster et cliquer sur Restore Microsoft's Hosts File

___________

Télécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !

Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic

Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.
______________
recolle un hijackhtis et dis tes soucis

Bon,comme je ne peux rien faire correctement,j'ai oublié de désactiver kério,ce qui fait que j'ai eu quelques messages,et je l'ai coupé en cours d'inspection de combofix.
Je poste donc le rapport combofix et le hijackthis plus bas.
Faites moi savoir si je dois relancer combofix suite à mon oubli.Entre parenthèses,mon pc rame beaucoup moins,et ça fait bien plaisir:) mais pas de quoi crier victoire encore...

Combofix

ComboFix 08-05-01.3 - HP_Propriétaire 2008-05-06 12:29:47.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.102 [GMT 2:00]
Endroit: C:\Documents and Settings\HP_Propriétaire\Bureau\killbaggle.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\HP_Propriétaire\Application Data\macromedia\Flash Player\#SharedObjects\U7T34VWR\www.broadcaster.com
C:\Documents and Settings\HP_Propriétaire\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\HP_Propriétaire\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Program Files\mediapipe
C:\Program Files\mediapipe\ItBill_terms.txt
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\system32\rightonadz-uninst.exe
C:\WINDOWS\system32\stera.log
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_FMTR

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-06 to 2008-05-06 ))))))))))))))))))))))))))))))))))))
.

2008-05-06 12:25 . 2008-05-06 12:27 <REP> d-------- C:\combo-fix
2008-05-06 02:48 . 2005-01-02 01:04 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS
2008-05-06 02:48 . 2004-11-24 03:37 <REP> d-------- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-05-06 02:48 . 2004-11-24 03:37 <REP> d-------- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-05-06 02:48 . 2005-02-01 10:06 <REP> d-------- C:\Documents and Settings\Administrateur\ModŠles
2008-05-06 02:48 . 2005-01-02 01:35 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-05-06 02:48 . 2004-11-25 05:26 <REP> d-------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-05-06 02:48 . 2005-08-25 21:47 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-05-06 02:48 . 2005-01-02 01:08 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-05-06 02:48 . 2008-05-06 02:48 <REP> d-------- C:\Documents and Settings\Administrateur
2008-05-06 02:48 . 2008-05-06 12:26 1,024 --ah----- C:\Documents and Settings\Administrateur\ntuser.dat.LOG
2008-05-06 02:47 . 2008-05-06 11:12 293 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
2008-05-06 02:43 . 2008-05-06 02:43 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-06 02:43 . 2008-05-06 02:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-06 01:28 . 2008-05-06 01:28 <REP> d-------- C:\Program Files\Sunbelt Software
2008-05-05 21:00 . 2008-05-05 21:00 <REP> d-------- C:\Program Files\Trend Micro
2008-04-30 17:50 . 2004-01-14 11:25 81,920 --a------ C:\WINDOWS\system32\ZDPN50.DLL
2008-04-30 17:50 . 2005-03-18 15:35 31,744 --a------ C:\WINDOWS\system32\drivers\ZDPSp50a64.sys
2008-04-30 17:50 . 2005-06-08 18:44 29,184 --a------ C:\WINDOWS\system32\drivers\BRGSp50a64.sys
2008-04-30 17:50 . 2004-03-23 16:38 28,672 --a------ C:\WINDOWS\system32\InsDrvZD.dll
2008-04-30 17:50 . 2003-03-14 12:24 24,576 --a------ C:\WINDOWS\system32\ZyDelReg.exe
2008-04-30 17:50 . 2005-06-08 18:44 20,608 --a------ C:\WINDOWS\system32\drivers\BRGSp50.sys
2008-04-30 17:50 . 2004-10-25 13:40 17,664 --a------ C:\WINDOWS\system32\drivers\ZDPSp50.sys
2008-04-30 17:50 . 2004-01-14 11:30 17,151 --a------ C:\WINDOWS\system32\ZDPNDIS5.SYS
2008-04-30 17:50 . 2005-07-12 14:44 15,872 --a------ C:\WINDOWS\system32\InsDrvZD64.DLL
2008-04-30 17:50 . 2006-02-15 13:45 13,312 --a------ C:\WINDOWS\system32\VistaRundll.exe
2008-04-30 17:49 . 2008-04-30 17:49 <REP> d-------- C:\Program Files\Datel
2008-04-29 12:12 . 2008-05-02 07:19 <REP> d-------- C:\Program Files\SM
2008-04-21 14:08 . 2008-04-21 14:08 <REP> d-------- C:\Program Files\PhotoFiltre
2008-04-17 12:51 . 2008-05-06 12:42 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-17 12:51 . 2008-04-17 12:51 1,409 --a------ C:\WINDOWS\QTFont.for
2008-04-09 13:27 . 2008-04-09 13:27 206 --a------ C:\WINDOWS\system32\MRT.INI

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-06 10:44 --------- d-----w C:\Program Files\Saxo
2008-05-06 10:43 --------- d-----w C:\Program Files\Wanadoo
2008-05-03 19:34 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-03 08:35 --------- d-----w C:\Program Files\eBay
2008-05-02 19:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\WholeSecurity
2008-04-25 10:50 --------- d-----w C:\Program Files\Mindscape
2008-04-11 17:46 --------- d-----w C:\Program Files\MSN Messenger
2008-04-03 15:17 --------- d-----w C:\Program Files\PCStitch 7
2008-03-26 13:42 --------- d-----w C:\Program Files\ViaMichelin
2008-03-22 19:37 --------- d-----w C:\Program Files\iTunes
2008-03-22 19:37 --------- d-----w C:\Program Files\iPod
2008-03-22 19:35 --------- d-----w C:\Program Files\QuickTime
2008-03-22 19:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-03-22 19:33 --------- d-----w C:\Program Files\Fichiers communs\Apple
2008-03-22 19:33 --------- d-----w C:\Program Files\Apple Software Update
2008-03-22 19:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
2008-03-01 16:28 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-02-29 08:57 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-02-29 08:56 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll
2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
2008-02-20 05:35 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-02-15 05:44 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2006-12-07 12:54 774,144 ----a-w C:\Program Files\RngInterstitial.dll
2006-04-27 13:41 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
2006-03-07 14:57 26,958 ----a-w C:\Program Files\MovieLand Terms.html
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C432CF91-1D08-3F1A-769A-72EDB22C7113}]
C:\DOCUME~1\HP_PRO~1\APPLIC~1\CAKEJU~1\ace time.exe

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 20:00 15360]
"H/PC Connection Agent"="C:\PROGRA~1\MICROS~4\wcescomm.exe" [2006-06-26 21:45 1211176]
"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [ ]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 21:15 103712]
"Saxo"="C:\Program Files\Saxo\Saxo.exe" [2008-02-05 10:59 314880]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-14 01:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 18:04 52736]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-06 05:05 339968]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 19:06 88363 C:\WINDOWS\AGRSMMSG.exe]
"HPHUPD06"="c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 20:53 49152]
"HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [2004-06-07 20:43 659456]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 22:43 233472]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 22:47 57344 C:\WINDOWS\ALCXMNTR.EXE]
"PS2"="C:\WINDOWS\system32\ps2.exe" [2004-10-25 23:17 90112]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 22:54 253952]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024]
"mfwgxvnyrq"="c:\windows\system32\mfwgxvnyrq.exe" [ ]
"EoEngine"="C:\My Games\eoRezo\EoEngine.exe" [ ]
"EoWeather"="" []
"EoClock"="" []
"EoComputer"="" []
"EoRss"="" []
"EoNet"="" []
"EoSudoku"="" []
"EoPhoto"="" []
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 21:15 103712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Cls42.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Enb42.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Fqx76.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Gpx54.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Kry42.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ktb54.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Luc75.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Mub18.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Nvd18.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Nyg42.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Rek86.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Tbi20.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Vel20.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Vfm20.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wfl08.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wfm07.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"=
"C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"C:\\StubInstaller.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Messenger\\MsMsgs.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"7000:UDP"= 7000:UDP:Windows Media Format SDK (rundll32.exe)
"7001:UDP"= 7001:UDP:Windows Media Format SDK (rundll32.exe)

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R2 Fswsclds;F-Secure Windows Security Center Legacy Detection Service;C:\Program Files\Securitoo\av_fw\fswsclds.exe [2006-06-29 14:34]
R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [2007-04-26 10:21]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 07:08]
S0 Cls42;Cls42;C:\WINDOWS\system32\Drivers\Cls42.sys []
S0 Enb42;Enb42;C:\WINDOWS\system32\Drivers\Enb42.sys []
S0 Fqx76;Fqx76;C:\WINDOWS\system32\Drivers\Fqx76.sys []
S0 Kry42;Kry42;C:\WINDOWS\system32\Drivers\Kry42.sys []
S0 Ktb54;Ktb54;C:\WINDOWS\system32\Drivers\Ktb54.sys []
S0 Mub18;Mub18;C:\WINDOWS\system32\Drivers\Mub18.sys []
S0 Nvd18;Nvd18;C:\WINDOWS\system32\Drivers\Nvd18.sys []
S0 Tbi20;Tbi20;C:\WINDOWS\system32\Drivers\Tbi20.sys []
S3 AR5523;NETGEAR WG111T USB2.0 Wireless Card Service;C:\WINDOWS\system32\DRIVERS\wg11tnd5.sys []
S3 ATHFMWDL;NETGEAR WG111T bootloader driver;C:\WINDOWS\system32\Drivers\ATHFMWDL.sys []
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\DNINDIS5.SYS [2003-07-24 12:10]
S3 gkmixern;gkmixern;C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\gkmixern.sys []
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS []

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-05-02 19:58:23 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-06 12:40:09
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 63

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\FTRTSVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-05-06 12:50:00 - machine was rebooted [HP_Propri‚taire]
ComboFix-quarantined-files.txt 2008-05-06 10:49:45

Pre-Run: 130,594,435,072 octets libres
Post-Run: 131,918,462,976 octets libres

243 --- E O F --- 2008-04-30 12:35:03

Hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:01:45, on 06/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Securitoo\av_fw\fswsclds.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\hphmon06.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\ps2.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Saxo\Saxo.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Wanadoo\EspaceWanadoo.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\Program Files\Wanadoo\Watch.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://french.ircfast2.com/index.php?rvs=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\MYGAME~1\eoRezo\EoAdv\EOREZO~1.DLL (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0\bin\ssv.dll (file missing)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {C432CF91-1D08-3F1A-769A-72EDB22C7113} - C:\DOCUME~1\HP_PRO~1\APPLIC~1\CAKEJU~1\ace time.exe (file missing)
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [mfwgxvnyrq] c:\windows\system32\mfwgxvnyrq.exe mfwgxvnyrq
O4 - HKLM\..\Run: [EoEngine] "C:\My Games\eoRezo\EoEngine.exe"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~4\wcescomm.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [Saxo] C:\Program Files\Saxo\Saxo.exe regstart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Startup: wkcalrem.LNK = C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxdm414YYFR
O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~2\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~2\Wanadoo Messager.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-30.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/10.20.0002/OCI/setup.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {A13516A3-BE86-4517-813C-B5FF0C8ACDF3} (Toontown Installer ActiveX Control French) - http://downloadtoontown.goa.com/sv1.5.11.6/ttinst-french.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {FD40EC41-D860-4579-8BA4-52671A45C71C} (AxHtChat Class) - http://images.goa.com/it/Woo2/fr/chat/nPaxChat.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O24 - Desktop Component 0: (no name) - https://www.microsoft.com/fr-fr/windows

C'est encore moi...
Je n'ai plus la protection résidente d'avast(l'icône a disparu de la barre des tâches après le redémarrage du PC dû à Combofix) et je n'arrive pas non plus à trouver où est le fichier pour le réinstaller.
Le raccourci qu'il me reste me permet juste de faire un scan.
Est-ce que je dois le désinstaller et le re-télécharger?

Toujours et encore merci pour votre aide:)

si tu as F SECURE et avast vire avast : https://www.avast.com/fr-fr/uninstall-utility

sinon pour remettre avast:

pour remetre votre icone a coté de l'horloge il vous suffi juste d'aller a la partition C /Progamme Files/Awil .../Avast et cliqué juste sur l'icone ashDisp

_________________

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked".

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://french.ircfast2.com/index.php?rvs=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp

R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\MYGAME~1\eoRezo\EoAdv\EOREZO~1.DLL (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0\bin\ssv.dll (file missing)
O2 - BHO: (no name) - {C432CF91-1D08-3F1A-769A-72EDB22C7113} - C:\DOCUME~1\HP_PRO~1\APPLIC~1\CAKEJU~1\ace time.exe (file missing)
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [mfwgxvnyrq] c:\windows\system32\mfwgxvnyrq.exe mfwgxvnyrq
O4 - HKLM\..\Run: [EoEngine] "C:\My Games\eoRezo\EoEngine.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxdm414YYFR

O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-30.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/10.20.0002/OCI/setup.exe

__________________

pour fusionner:

http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

__________________

telecharge combofix:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !

Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

File::
c:\windows\system32\mfwgxvnyrq.exe
C:\My Games\eoRezo\EoEngine.exe
C:\DOCUME~1\HP_PRO~1\APPLIC~1\CAKEJU~1\ace time.exe
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
C:\Program Files\MyWebSearch
C:\DOCUME~1\HP_PRO~1\APPLIC~1\CAKEJU~1\ace time.exe

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C432CF91-1D08-3F1A-769A-72EDB22C7113}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mfwgxvnyrq"=-
"EoEngine"=-
"EoWeather"="-
"EoClock"="-
"EoComputer"="-
"EoRss"="-
"EoNet"="-
"EoSudoku"="-
"EoPhoto"="-

Enregistre ce fichier sous le nom CFscript

Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis

Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

_____________________

analyse ces fichiers sur virus total et colle les rapports:
https://www.virustotal.com/gui/

C:\WINDOWS\system32\drivers\fwdrv.err
C:\Program Files\Saxo\Saxo.exe

______________________

Pour ce qui est de F-Secure,il est désactivé est censé être supprimé aussi mais comme il y a des fichiers planqués un peu n'importe où...

Sinon,la suite:

Combofix

ComboFix 08-05-01.3 - HP_Propriétaire 2008-05-06 16:24:24.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.122 [GMT 2:00]
Endroit: C:\Documents and Settings\HP_Propriétaire\Bureau\killbaggle.exe
Command switches used :: C:\Documents and Settings\HP_Propriétaire\Bureau\CFscript.txt
* Création d'un nouveau point de restauration

FILE ::
C:\DOCUME~1\HP_PRO~1\APPLIC~1\CAKEJU~1\ace time.exe
C:\My Games\eoRezo\EoEngine.exe
C:\Program Files\MyWebSearch
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
c:\windows\system32\mfwgxvnyrq.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2008-04-06 to 2008-05-06 ))))))))))))))))))))))))))))))))))))
.

2008-05-06 12:50 . 2008-05-06 12:50 <REP> d-------- C:\Documents and Settings\HP_PropriÚtaire
2008-05-06 12:25 . 2008-05-06 12:27 <REP> d-------- C:\combo-fix
2008-05-06 02:48 . 2005-01-02 01:04 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS
2008-05-06 02:48 . 2004-11-24 03:37 <REP> d-------- C:\Documents and Settings\Administrateur\Voisinage réseau
2008-05-06 02:48 . 2004-11-24 03:37 <REP> d-------- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-05-06 02:48 . 2005-02-01 10:06 <REP> d-------- C:\Documents and Settings\Administrateur\Modèles
2008-05-06 02:48 . 2005-01-02 01:35 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-05-06 02:48 . 2004-11-25 05:26 <REP> d-------- C:\Documents and Settings\Administrateur\Menu Démarrer
2008-05-06 02:48 . 2005-08-25 21:47 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-05-06 02:48 . 2005-01-02 01:08 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-05-06 02:48 . 2008-05-06 02:48 <REP> d-------- C:\Documents and Settings\Administrateur
2008-05-06 02:48 . 2008-05-06 12:26 1,024 --ah----- C:\Documents and Settings\Administrateur\ntuser.dat.LOG
2008-05-06 02:47 . 2008-05-06 11:12 293 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
2008-05-06 02:44 . 2008-05-06 02:44 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\Malwarebytes
2008-05-06 02:43 . 2008-05-06 02:43 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-06 02:43 . 2008-05-06 02:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-06 01:28 . 2008-05-06 01:28 <REP> d-------- C:\Program Files\Sunbelt Software
2008-05-05 21:00 . 2008-05-05 21:00 <REP> d-------- C:\Program Files\Trend Micro
2008-04-30 17:50 . 2004-01-14 11:25 81,920 --a------ C:\WINDOWS\system32\ZDPN50.DLL
2008-04-30 17:50 . 2005-03-18 15:35 31,744 --a------ C:\WINDOWS\system32\drivers\ZDPSp50a64.sys
2008-04-30 17:50 . 2005-06-08 18:44 29,184 --a------ C:\WINDOWS\system32\drivers\BRGSp50a64.sys
2008-04-30 17:50 . 2004-03-23 16:38 28,672 --a------ C:\WINDOWS\system32\InsDrvZD.dll
2008-04-30 17:50 . 2003-03-14 12:24 24,576 --a------ C:\WINDOWS\system32\ZyDelReg.exe
2008-04-30 17:50 . 2005-06-08 18:44 20,608 --a------ C:\WINDOWS\system32\drivers\BRGSp50.sys
2008-04-30 17:50 . 2004-10-25 13:40 17,664 --a------ C:\WINDOWS\system32\drivers\ZDPSp50.sys
2008-04-30 17:50 . 2004-01-14 11:30 17,151 --a------ C:\WINDOWS\system32\ZDPNDIS5.SYS
2008-04-30 17:50 . 2005-07-12 14:44 15,872 --a------ C:\WINDOWS\system32\InsDrvZD64.DLL
2008-04-30 17:50 . 2006-02-15 13:45 13,312 --a------ C:\WINDOWS\system32\VistaRundll.exe
2008-04-30 17:49 . 2008-04-30 17:49 <REP> d-------- C:\Program Files\Datel
2008-04-29 12:12 . 2008-05-02 07:19 <REP> d-------- C:\Program Files\SM
2008-04-21 14:08 . 2008-04-21 14:08 <REP> d-------- C:\Program Files\PhotoFiltre
2008-04-17 12:51 . 2008-05-06 15:58 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-17 12:51 . 2008-04-17 12:51 1,409 --a------ C:\WINDOWS\QTFont.for
2008-04-09 13:27 . 2008-04-09 13:27 206 --a------ C:\WINDOWS\system32\MRT.INI

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-06 14:22 --------- d-----w C:\Program Files\Wanadoo
2008-05-06 13:59 --------- d-----w C:\Program Files\Saxo
2008-05-03 19:34 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-03 08:35 --------- d-----w C:\Program Files\eBay
2008-05-02 19:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\WholeSecurity
2008-04-25 10:50 --------- d-----w C:\Program Files\Mindscape
2008-04-25 05:57 2,400 ----a-w C:\Documents and Settings\HP_Propriétaire\Application Data\wklnhst.dat
2008-04-11 17:46 --------- d-----w C:\Program Files\MSN Messenger
2008-04-03 15:17 --------- d-----w C:\Program Files\PCStitch 7
2008-03-26 13:42 --------- d-----w C:\Program Files\ViaMichelin
2008-03-22 19:40 --------- d-----w C:\Documents and Settings\HP_Propriétaire\Application Data\Apple Computer
2008-03-22 19:37 --------- d-----w C:\Program Files\iTunes
2008-03-22 19:37 --------- d-----w C:\Program Files\iPod
2008-03-22 19:35 --------- d-----w C:\Program Files\QuickTime
2008-03-22 19:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-03-22 19:33 --------- d-----w C:\Program Files\Fichiers communs\Apple
2008-03-22 19:33 --------- d-----w C:\Program Files\Apple Software Update
2008-03-22 19:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
2008-03-01 16:28 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-02-29 08:57 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-02-29 08:56 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll
2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
2008-02-20 05:35 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-02-15 05:44 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-11-19 12:35 191,512 ----a-w C:\Documents and Settings\HP_Propriétaire\Application Data\install_fr[1].exe
2007-06-27 17:47 26,424 ----a-w C:\Documents and Settings\HP_Propriétaire\TB2Categories000.dat
2007-06-27 17:47 26,424 ----a-w C:\Documents and Settings\HP_Propriétaire\TB2Categories000.dat
2006-12-07 12:54 774,144 ----a-w C:\Program Files\RngInterstitial.dll
2006-04-27 13:41 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
2006-03-07 14:57 26,958 ----a-w C:\Program Files\MovieLand Terms.html
.

((((((((((((((((((((((((((((( snapshot@2008-05-06_12.48.36.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-05-06 11:11:10 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_604.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 20:00 15360]
"H/PC Connection Agent"="C:\PROGRA~1\MICROS~4\wcescomm.exe" [2006-06-26 21:45 1211176]
"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [ ]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 21:15 103712]
"Saxo"="C:\Program Files\Saxo\Saxo.exe" [2008-02-05 10:59 314880]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-14 01:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 18:04 52736]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-06 05:05 339968]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 19:06 88363 C:\WINDOWS\AGRSMMSG.exe]
"HPHUPD06"="c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 20:53 49152]
"HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [2004-06-07 20:43 659456]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 22:43 233472]
"PS2"="C:\WINDOWS\system32\ps2.exe" [2004-10-25 23:17 90112]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 22:54 253952]
"EoWeather"="" []
"EoClock"="" []
"EoComputer"="" []
"EoRss"="" []
"EoNet"="" []
"EoSudoku"="" []
"EoPhoto"="" []
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 21:15 103712]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]

C:\Documents and Settings\HP_Propri‚taire\Menu D‚marrer\Programmes\D‚marrage\
wkcalrem.LNK - C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe [2004-07-11 18:54:26 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-05 03:28:24 258048]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Cls42.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Enb42.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Fqx76.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Gpx54.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Kry42.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ktb54.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Luc75.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Mub18.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Nvd18.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Nyg42.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Rek86.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Tbi20.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Vel20.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Vfm20.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wfl08.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wfm07.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"=
"C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"C:\\StubInstaller.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Messenger\\MsMsgs.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"7000:UDP"= 7000:UDP:Windows Media Format SDK (rundll32.exe)
"7001:UDP"= 7001:UDP:Windows Media Format SDK (rundll32.exe)

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R2 Fswsclds;F-Secure Windows Security Center Legacy Detection Service;C:\Program Files\Securitoo\av_fw\fswsclds.exe [2006-06-29 14:34]
R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [2007-04-26 10:21]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 07:08]
S0 Cls42;Cls42;C:\WINDOWS\system32\Drivers\Cls42.sys []
S0 Enb42;Enb42;C:\WINDOWS\system32\Drivers\Enb42.sys []
S0 Fqx76;Fqx76;C:\WINDOWS\system32\Drivers\Fqx76.sys []
S0 Kry42;Kry42;C:\WINDOWS\system32\Drivers\Kry42.sys []
S0 Ktb54;Ktb54;C:\WINDOWS\system32\Drivers\Ktb54.sys []
S0 Mub18;Mub18;C:\WINDOWS\system32\Drivers\Mub18.sys []
S0 Nvd18;Nvd18;C:\WINDOWS\system32\Drivers\Nvd18.sys []
S0 Tbi20;Tbi20;C:\WINDOWS\system32\Drivers\Tbi20.sys []
S3 AR5523;NETGEAR WG111T USB2.0 Wireless Card Service;C:\WINDOWS\system32\DRIVERS\wg11tnd5.sys []
S3 ATHFMWDL;NETGEAR WG111T bootloader driver;C:\WINDOWS\system32\Drivers\ATHFMWDL.sys []
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\DNINDIS5.SYS [2003-07-24 12:10]
S3 gkmixern;gkmixern;C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\gkmixern.sys []
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS []

*Newly Created Service* - CATCHME
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-05-02 19:58:23 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-06 16:29:59
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 63

**************************************************************************
.
Temps d'accomplissement: 2008-05-06 16:37:04
ComboFix-quarantined-files.txt 2008-05-06 14:36:53
ComboFix2.txt 2008-05-06 10:50:03

Pre-Run: 131,804,917,760 octets libres
Post-Run: 131,856,482,304 octets libres

223 --- E O F --- 2008-04-30 12:35:03

Et un Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:40:48, on 06/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Securitoo\av_fw\fswsclds.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\hphmon06.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\ps2.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MICROS~4\wcescomm.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Saxo\Saxo.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Wanadoo\EspaceWanadoo.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Wanadoo\Watch.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~4\wcescomm.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [Saxo] C:\Program Files\Saxo\Saxo.exe regstart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Startup: wkcalrem.LNK = C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~2\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~2\Wanadoo Messager.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {A13516A3-BE86-4517-813C-B5FF0C8ACDF3} (Toontown Installer ActiveX Control French) - http://downloadtoontown.goa.com/sv1.5.11.6/ttinst-french.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {FD40EC41-D860-4579-8BA4-52671A45C71C} (AxHtChat Class) - http://images.goa.com/it/Woo2/fr/chat/nPaxChat.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O24 - Desktop Component 0: (no name) - https://www.microsoft.com/fr-fr/windows

pour virer F SECURE:

http://support.f-secure.fr/fra/corporate/downloads/removeav.shtml

________________

analyse ces fichiers sur virus total et colle les rapports:
https://www.virustotal.com/gui/

C:\WINDOWS\system32\drivers\fwdrv.err
C:\Program Files\Saxo\Saxo.exe

______________________

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

Résultat d'analyses sur virus total:

Pour C:\WINDOWS\system32\drivers\fwdrv.err

Fichier fwdrv.err reçu le 2008.05.06 16:50:15 (CET)Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.5.3.0 2008.05.06 -
AntiVir 7.8.0.11 2008.05.06 -
Authentium 4.93.8 2008.05.06 -
Avast 4.8.1169.0 2008.05.05 -
AVG 7.5.0.516 2008.05.06 -
BitDefender 7.2 2008.05.06 -
CAT-QuickHeal 9.50 2008.05.06 -
ClamAV 0.92.1 2008.05.06 -
DrWeb 4.44.0.09170 2008.05.06 -
eSafe 7.0.15.0 2008.04.28 -
eTrust-Vet 31.3.5763 2008.05.06 -
Ewido 4.0 2008.05.06 -
F-Prot 4.4.2.54 2008.05.05 -
F-Secure 6.70.13260.0 2008.05.06 -
Fortinet 3.14.0.0 2008.05.06 -
Ikarus T3.1.1.26.0 2008.05.06 -
Kaspersky 7.0.0.125 2008.05.06 -
McAfee 5288 2008.05.05 -
Microsoft 1.3408 2008.04.22 -
NOD32v2 3079 2008.05.06 -
Norman 5.80.02 2008.05.06 -
Panda 9.0.0.4 2008.05.06 -
Prevx1 V2 2008.05.06 -
Rising 20.43.12.00 2008.05.06 -
Sophos 4.29.0 2008.05.06 -
Sunbelt 3.0.1097.0 2008.05.03 -
Symantec 10 2008.05.06 -
TheHacker 6.2.92.300 2008.05.03 -
VBA32 3.12.6.5 2008.05.06 -
VirusBuster 4.3.26:9 2008.05.05 -
Webwasher-Gateway 6.6.2 2008.05.06 -

Information additionnelle
File size: 293 bytes
MD5...: 27a4fd422b20139f8c210b3942c9ce73
SHA1..: 14b97197e9f243705b884f08554734c49f4a191c
SHA256: 984bbcc1a48d9737db0261f0ce49b0bc499d035d50dcf7cf3c95af4c1bd7ae83
SHA512: 3af02e390f903ca85391646917dbd680adc76d8873938a1050a0520598c8e942<BR>8885347e7148831ca52b7caca04060669bb0f0c0cacb254ff3404ef23b004f8a
PEiD..: -
PEInfo: -

Pour C:\Program Files\Saxo\Saxo.exe

Fichier Saxo.exe reçu le 2008.05.06 17:03:45 (CET)Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.5.3.0 2008.05.06 -
AntiVir 7.8.0.11 2008.05.06 -
Authentium 4.93.8 2008.05.06 -
Avast 4.8.1169.0 2008.05.05 -
AVG 7.5.0.516 2008.05.06 -
BitDefender 7.2 2008.05.06 -
CAT-QuickHeal 9.50 2008.05.06 -
ClamAV 0.92.1 2008.05.06 -
DrWeb 4.44.0.09170 2008.05.06 -
eSafe 7.0.15.0 2008.04.28 -
eTrust-Vet 31.3.5763 2008.05.06 -
Ewido 4.0 2008.05.06 -
F-Prot 4.4.2.54 2008.05.05 -
F-Secure 6.70.13260.0 2008.05.06 -
Fortinet 3.14.0.0 2008.05.06 -
Ikarus T3.1.1.26.0 2008.05.06 -
Kaspersky 7.0.0.125 2008.05.06 -
McAfee 5288 2008.05.05 -
Microsoft 1.3408 2008.05.06 -
NOD32v2 3079 2008.05.06 -
Norman 5.80.02 2008.05.06 -
Panda 9.0.0.4 2008.05.06 -
Rising 20.43.12.00 2008.05.06 -
Sophos 4.29.0 2008.05.06 -
Sunbelt 3.0.1097.0 2008.05.03 -
Symantec 10 2008.05.06 -
TheHacker 6.2.92.300 2008.05.03 -
VBA32 3.12.6.5 2008.05.06 -
VirusBuster 4.3.26:9 2008.05.05 -
Webwasher-Gateway 6.6.2 2008.05.06 -

Information additionnelle
File size: 314880 bytes
MD5...: 239878dd5891bd60c1a542159f49bb0b
SHA1..: d5145075726ce51fd75ae16915f97a0d431e010c
SHA256: cf9f38ffb136a22b1277bf415350e70a9752f8a808a8c1512b28a8c9a140597a
SHA512: 853028938fc30e14b633451f562f7c4cdbac4bf2e74054dc5313785257add43c<BR>afc992fa1bdb0c6564d86e0ca85043cd264eda091c3e10402675a4764bfc0fde
PEiD..: BobSoft Mini Delphi -> BoB / BobSoft
PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x4348e4<BR>timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 9 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>CODE 0x1000 0x33990 0x33a00 6.48 f6dbd7a626c4df90080febf711b51481<BR>DATA 0x35000 0x1c94 0x1e00 4.93 62448943f622047d355829d2dd950518<BR>BSS 0x37000 0xe01 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e<BR>.idata 0x38000 0x8caa 0x8e00 5.19 28367cec43defa8ef82fdb8df3b7c435<BR>.edata 0x41000 0x75 0x200 1.41 4f0a146b252a4f2793c22edb8414ddc2<BR>.tls 0x42000 0xda 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e<BR>.rdata 0x43000 0x34 0x200 0.68 f9f1a9024163ad0452cdfa9612efccdd<BR>.reloc 0x44000 0x339c 0x3400 6.75 a5a3b48054bf7af3409d53290431b609<BR>.rsrc 0x48000 0xac00 0xac00 5.54 80ebeab5935857cbfe96edf332a90980<BR><BR>( 132 imports ) <BR>> rtl70.bpl: @System@initialization$qqrv, @System@Finalization$qqrv, @System@@CheckAutoResult$qqrl, @System@RegisterModule$qqrp17System@TLibModule, @System@FindClassHInstance$qqrp17System@TMetaClass, @System@FindHInstance$qqrpv, @System@@ValInt64$qqrx17System@AnsiStringri, @System@@Dispose$qqrpvt1, @System@@New$qqripv, @System@@AddRefArray$qqrv, @System@@AddRefRecord$qqrv, @System@@FinalizeArray$qqrpvt1ui, @System@@FinalizeRecord$qqrpvt1, @System@@InitializeArray$qqrpvt1ui, @System@@InitializeRecord$qqrpvt1, @System@@Write0LString$qqrr15System@TTextRecx17System@AnsiString, @System@@LStrSetLength$qqrv, @System@@LStrPos$qqrv, @System@@LStrInsert$qqrv, @System@@LStrDelete$qqrv, @System@@LStrCopy$qqrv, @System@@UniqueStringA$qqrr17System@AnsiString, @System@@LStrToPChar$qqrx17System@AnsiString, @System@@LStrAddRef$qqrpv, @System@@LStrCmp$qqrv, @System@@LStrCatN$qqrv, @System@@LStrCat3$qqrv, @System@@LStrCat$qqrv, @System@@LStrLen$qqrx17System@AnsiString, @System@@LStrToString$qqrv, @System@@LStrFromWArray$qqrr17System@AnsiStringpbi, @System@@LStrFromArray$qqrr17System@AnsiStringpci, @System@@LStrFromString$qqrr17System@AnsiStringrx28System@_SmallString$iuc$255_, @System@@LStrFromPChar$qqrr17System@AnsiStringpc, @System@@LStrFromChar$qqrr17System@AnsiStringc, @System@@LStrFromPCharLen$qqrr17System@AnsiStringpci, @System@@LStrLAsg$qqrpvpxv, @System@@LStrAsg$qqrpvpxv, @System@@LStrArrayClr$qqrpvi, @System@@LStrClr$qqrpv, @System@BeginThread$qqrpvuipqqrpv$it1uirui, @System@@Assert$qqrx17System@AnsiStringt1i, @System@@RunError$qqruc, @System@@Halt$qqri, @System@@Halt0$qqrv, @System@@StartExe$qqrp23System@PackageInfoTablep17System@TLibModule, @System@@TryFinallyExit$qqrv, @System@@DoneExcept$qqrv, @System@@RaiseAgain$qqrv, @System@@RaiseExcept$qqrv, @System@@HandleAutoException$qqrv, @System@@HandleFinally$qqrv, @System@@HandleOnException$qqrv, @System@@HandleAnyException$qqrv, @System@@BeforeDestruction$qqrp14System@TObjectzc, @System@@AfterConstruction$qqrp14System@TObject, @System@@ClassDestroy$qqrp14System@TObject, @System@@ClassCreate$qqrp17System@TMetaClasso, @System@TObject@Dispatch$qqrpv, @System@TObject@BeforeDestruction$qqrv, @System@TObject@AfterConstruction$qqrv, @System@TObject@DefaultHandler$qqrpv, @System@TObject@SafeCallException$qqrp14System@TObjectpv, @System@TObject@ClassInfo$qqrp17System@TMetaClass, @System@@CallDynaInst$qqrv, @System@@AsClass$qqrp14System@TObjectp17System@TMetaClass, @System@@IsClass$qqrp14System@TObjectp17System@TMetaClass, @System@TObject@Free$qqrv, @System@TObject@$bdtr$qqrv, @System@TObject@$bctr$qqrv, @System@TObject@FreeInstance$qqrv, @System@TObject@NewInstance$qqrp17System@TMetaClass, @System@TObject@ClassParent$qqrp17System@TMetaClass, @System@TObject@ClassName$qqrp17System@TMetaClass, @System@TObject@ClassType$qqrv, @System@@WriteLn$qqrr15System@TTextRec, @System@@ValLong$qqrx17System@AnsiStringri, @System@@RandInt$qqrv, @System@@FillChar$qqrpvic, @System@@AStrCmp$qqrv, @System@@PStrNCpy$qqrp28System@_SmallString$iuc$255_t1uc, @System@@PStrCpy$qqrp28System@_SmallString$iuc$255_t1, @System@@AbstractError$qqrv, @System@@TRUNC$qqrv, @System@@ROUND$qqrv, @System@@SetLength$qqrp28System@_SmallString$iuc$255_uc, @System@@Pos$qqrv, @System@ParamStr$qqri, @System@ParamCount$qqrv, @System@Move$qqrpxvpvi, @System@@Insert$qqrv, @System@@Copy$qqrv, @System@ChDir$qqrx17System@AnsiString, @System@@_IOTest$qqrv, @System@ExceptAddr$qqrv, @System@ExceptObject$qqrv, @System@@ReallocMem$qqrrpvi, @System@@FreeMem$qqrpv, @System@@GetMem$qqri, @System@AllocMemSize, @System@DebugHook, @System@Output, @System@IsConsole, @System@IsLibrary, @System@MainThreadID, @System@MainInstance, @System@ExceptObjProc, @System@ExceptProc, @$xp$14System@TObject, @System@TObject@, @$xp$13System@String, @$xp$15System@Cardinal, @$xp$14System@Integer, @$xp$14System@Boolean<BR>> kernel32.dll: TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA<BR>> user32.dll: WaitForInputIdle, TranslateMessage, SystemParametersInfoA, ShowWindow, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetForegroundWindow, SetFocus, SetCursor, SetClipboardData, SendMessageTimeoutA, SendMessageA, ScreenToClient, ReleaseDC, RegisterWindowMessageA, PtInRect, PostMessageA, PeekMessageA, OpenClipboard, OffsetRect, MoveWindow, MessageBoxA, MessageBeep, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsWindowVisible, IsWindow, IsIconic, InvalidateRgn, InvalidateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetSystemMetrics, GetSysColor, GetLastActivePopup, GetIconInfo, GetForegroundWindow, GetFocus, GetDoubleClickTime, GetDlgItem, GetDesktopWindow, GetDC, GetCursorPos, GetCursor, GetClassNameA, GetAsyncKeyState, FrameRect, FindWindowA, FillRect, EnumWindows, EndDialog, EnableWindow, EmptyClipboard, DrawTextA, DrawIconEx, DispatchMessageA, DialogBoxParamA, DestroyWindow, DefWindowProcA, CreateDialogParamA, CopyRect, CloseClipboard, CallWindowProcA<BR>> gdi32.dll: TextOutA, SetTextColor, SetMapMode, SetBkMode, SetBkColor, SelectPalette, SelectObject, GetTextExtentPoint32A, GetSystemPaletteEntries, GetPixel, GetObjectA, GetMapMode, GetDeviceCaps, GetDIBits, GetCurrentObject, DeleteObject, DeleteDC, CreateSolidBrush, CreateRectRgnIndirect, CreateRectRgn, CreatePalette, CreateFontIndirectA, CreateFontA, CreateCompatibleDC, CreateCompatibleBitmap, CreateBitmap, CombineRgn, BitBlt<BR>> version.dll: VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA<BR>> kernel32.dll: WritePrivateProfileStringA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtect, UnmapViewOfFile, TerminateThread, TerminateProcess, SuspendThread, Sleep, SizeofResource, SetLastError, ResumeThread, ReleaseMutex, OutputDebugStringA, OpenProcess, MulDiv, MoveFileA, MapViewOfFile, LockResource, LoadResource, LoadLibraryExA, LoadLibraryA, LeaveCriticalSection, IsBadReadPtr, InitializeCriticalSection, GlobalUnlock, GlobalMemoryStatus, GlobalLock, GlobalFree, GlobalAlloc, GetVersionExA, GetTickCount, GetThreadPriority, GetThreadContext, GetTempPathA, GetSystemTime, GetSystemDefaultLangID, GetStartupInfoA, GetProcAddress, GetPrivateProfileStringA, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoW, GetLocaleInfoA, GetLocalTime, GetLastError, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentThreadId, GetCurrentThread, GetCurrentProcessId, GetCurrentProcess, GetComputerNameA, GetCommandLineA, GetACP, FreeLibrary, FlushInstructionCache, FindResourceA, FindFirstFileA, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, FileTimeToDosDateTime, ExpandEnvironmentStringsA, ExitThread, EnumSystemLocalesA, EnterCriticalSection, DuplicateHandle, DeleteCriticalSection, CreateProcessA, CreateMutexA, CreateFileMappingA, CreateFileA, CloseHandle<BR>> advapi32.dll: RegQueryValueExA, RegOpenKeyExA, RegCloseKey, GetUserNameA<BR>> rtl70.bpl: @Types@initialization$qqrv, @Types@Finalization$qqrv<BR>> kernel32.dll: Sleep<BR>> rtl70.bpl: @Sysutils@initialization$qqrv, @Sysutils@Finalization$qqrv, @Sysutils@FreeAndNil$qqrpv, @Sysutils@TMultiReadExclusiveWriteSynchronizer@EndRead$qqrv, @Sysutils@TMultiReadExclusiveWriteSynchronizer@BeginRead$qqrv, @Sysutils@TMultiReadExclusiveWriteSynchronizer@EndWrite$qqrv, @Sysutils@TMultiReadExclusiveWriteSynchronizer@BeginWrite$qqrv, @Sysutils@TMultiReadExclusiveWriteSynchronizer@$bctr$qqrv, @Sysutils@Beep$qqrv, @Sysutils@Exception@$bctr$qqrx17System@AnsiStringpx14System@TVarRecxi, @Sysutils@Exception@$bctr$qqrx17System@AnsiString, @Sysutils@Abort$qqrv, @Sysutils@SysErrorMessage$qqri, @Sysutils@StrToDateTime$qqrx17System@AnsiString, @Sysutils@FormatDateTime$qqrx17System@AnsiString16System@TDateTime, @Sysutils@DateTimeToStr$qqrx16System@TDateTime, @Sysutils@Now$qqrv, @Sysutils@DayOfWeek$qqrx16System@TDateTime, @Sysutils@SystemTimeToDateTime$qqrrx11_SYSTEMTIME, @Sysutils@DecodeDate$qqrx16System@TDateTimerust2t2, @Sysutils@EncodeDate$qqrususus, @Sysutils@DecodeTime$qqrx16System@TDateTimerust2t2t2, @Sysutils@EncodeTime$qqrusususus, @Sysutils@FormatFloat$qqrx17System@AnsiStringg, @Sysutils@Format$qqrx17System@AnsiStringpx14System@TVarRecxi, @Sysutils@StrPas$qqrpxc, @Sysutils@StrPos$qqrpxct1, @Sysutils@StrPCopy$qqrpcx17System@AnsiString, @Sysutils@StrLCopy$qqrpcpxcui, @Sysutils@StrCopy$qqrpcpxc, @Sysutils@StrMove$qqrpcpxcui, @Sysutils@StrLen$qqrpxc, @Sysutils@CreateDir$qqrx17System@AnsiString, @Sysutils@GetCurrentDir$qqrv, @Sysutils@FileDateToDateTime$qqri, @Sysutils@ExtractRelativePath$qqrx17System@AnsiStringt1, @Sysutils@ExpandFileName$qqrx17System@AnsiString, @Sysutils@ExtractFileExt$qqrx17System@AnsiString, @Sysutils@ExtractFileName$qqrx17System@AnsiString, @Sysutils@ExtractFileDrive$qqrx17System@AnsiString, @Sysutils@ExtractFilePath$qqrx17System@AnsiString, @Sysutils@ChangeFileExt$qqrx17System@AnsiStringt1, @Sysutils@RenameFile$qqrx17System@AnsiStringt1, @Sysutils@DeleteFile$qqrx17System@AnsiString, @Sysutils@FindClose$qqrr19Sysutils@TSearchRec, @Sysutils@FindNext$qqrr19Sysutils@TSearchRec, @Sysutils@FindFirst$qqrx17System@AnsiStringir19Sysutils@TSearchRec, @Sysutils@DirectoryExists$qqrx17System@AnsiString, @Sysutils@FileExists$qqrx17System@AnsiString, @Sysutils@FileClose$qqri, @Sysutils@FileWrite$qqripxvui, @Sysutils@FileCreate$qqrx17System@AnsiString, @Sysutils@StrToIntDef$qqrx17System@AnsiStringi, @Sysutils@StrToInt$qqrx17System@AnsiString, @Sysutils@IntToHex$qqrji, @Sysutils@IntToHex$qqrii, @Sysutils@IntToStr$qqrj, @Sysutils@IntToStr$qqri, @Sysutils@Trim$qqrx17System@AnsiString, @Sysutils@LowerCase$qqrx17System@AnsiString, @Sysutils@UpperCase$qqrx17System@AnsiString, @Sysutils@AllocMem$qqrui, @Sysutils@TMultiReadExclusiveWriteSynchronizer@, @Sysutils@Win32CSDVersion, @Sysutils@Win32BuildNumber, @Sysutils@Win32MinorVersion, @Sysutils@Win32MajorVersion, @Sysutils@Win32Platform, @Sysutils@EConvertError@, @Sysutils@EExternal@, @Sysutils@EAbort@, @Sysutils@Exception@, @$xp$19Sysutils@TSearchRec<BR>> rtl70.bpl: @Sysconst@initialization$qqrv, @Sysconst@Finalization$qqrv<BR>> rtl70.bpl: @Classes@initialization$qqrv, @Classes@Finalization$qqrv, @Classes@DeallocateHWnd$qqrui, @Classes@AllocateHWnd$qqrynpqqrr17Messages@TMessage$v, @Classes@FreeObjectInstance$qqrpv, @Classes@MakeObjectInstance$qqrynpqqrr17Messages@TMessage$v, @Classes@TComponent@QueryInterface$qqsrx5_GUIDpv, @Classes@TComponent@UpdateRegistry$qqrp17System@TMetaClassox17System@AnsiStringt3, @Classes@TComponent@SafeCallException$qqrp14System@TObjectpv, @Classes@TComponent@SetName$qqrx17System@AnsiString, @Classes@TComponent@ValidateRename$qqrp18Classes@TComponentx17System@AnsiStringt2, @Classes@TComponent@WriteState$qqrp15Classes@TWriter, @Classes@TComponent@ReadState$qqrp15Classes@TReader, @Classes@TComponent@Loaded$qqrv, @Classes@TComponent@DefineProperties$qqrp14Classes@TFiler, @Classes@TComponent@Notification$qqrp18Classes@TComponent18Classes@TOperation, @Classes@TComponent@BeforeDestruction$qqrv, @Classes@TComponent@$bdtr$qqrv, @Classes@TComponent@$bctr$qqrp18Classes@TComponent, @Classes@TThread@Terminate$qqrv, @Classes@TThread@Resume$qqrv, @Classes@TThread@Synchronize$qqrp17System@TMetaClassp15Classes@TThreadynpqqrv$v, @Classes@TThread@SetPriority$qqr23Classes@TThreadPriority, @Classes@TThread@DoTerminate$qqrv, @Classes@TThread@AfterConstruction$qqrv, @Classes@TThread@$bdtr$qqrv, @Classes@TThread@$bctr$qqro, @Classes@TMemoryStream@Write$qqrpxvi, @Classes@TMemoryStream@Realloc$qqrri, @Classes@TMemoryStream@SetSize$qqri, @Classes@TMemoryStream@LoadFromFile$qqrx17System@AnsiString, @Classes@TMemoryStream@LoadFromStream$qqrp15Classes@TStream, @Classes@TMemoryStream@$bdtr$qqrv, @Classes@TCustomMemoryStream@SaveToFile$qqrx17System@AnsiString, @Classes@TCustomMemoryStream@Seek$qqrius, @Classes@TCustomMemoryStream@Read$qqrpvi, @Classes@TCustomMemoryStream@SetPointer$qqrpvi, @Classes@TFileStream@$bctr$qqrx17System@AnsiStringus, @Classes@THandleStream@$bctr$qqri, @Classes@TStream@CopyFrom$qqrp15Classes@TStreamj, @Classes@TStream@ReadBuffer$qqrpvi, @Classes@TStream@Seek$qqrxj19Classes@TSeekOrigin, @Classes@TStream@SetSize$qqrxj, @Classes@TStream@SetSize64$qqrxj, @Classes@TStream@GetSize$qqrv, @Classes@TStream@SetPosition$qqrxj, @Classes@TStream@GetPosition$qqrv, @Classes@TStringList@SetSorted$qqro, @Classes@TPersistent@AssignTo$qqrp19Classes@TPersistent, @Classes@TPersistent@Assign$qqrp19Classes@TPersistent, @Classes@TList@Notify$qqrpv25Classes@TListNotification, @Classes@TList@Sort$qqrpqqrpvt1$i, @Classes@TList@IndexOf$qqrpv, @Classes@TList@Grow$qqrv, @Classes@TList@Get$qqri, @Classes@TList@Error$qqrp17System@TMetaClassx17System@AnsiStringi, @Classes@TList@Delete$qqri, @Classes@TList@Clear$qqrv, @Classes@TList@Add$qqrpv, @Classes@TList@$bdtr$qqrv, @Classes@Rect$qqriiii, @$xp$18Classes@TComponent, @Classes@TComponent@, @Classes@TThread@, @Classes@TMemoryStream@, @Classes@TFileStream@, @Classes@THandleStream@, @Classes@TStringList@, @Classes@TList@, @Classes@EReadError@, @$xp$20Classes@TNotifyEvent<BR>> rtl70.bpl: @Activex@initialization$qqrv, @Activex@Finalization$qqrv<BR>> rtl70.bpl: @Typinfo@initialization$qqrv, @Typinfo@Finalization$qqrv, @Typinfo@SetMethodProp$qqrp14System@TObjectp17Typinfo@TPropInforx14System@TMethod, @Typinfo@GetMethodProp$qqrp14System@TObjectp17Typinfo@TPropInfo, @Typinfo@GetStrProp$qqrp14System@TObjectp17Typinfo@TPropInfo, @Typinfo@GetPropInfo$qqrp17Typinfo@TTypeInfox17System@AnsiString, @Typinfo@GetEnumName$qqrp17Typinfo@TTypeInfoi<BR>> rtl70.bpl: @Variants@initialization$qqrv, @Variants@Finalization$qqrv<BR>> rtl70.bpl: @Varutils@initialization$qqrv, @Varutils@Finalization$qqrv<BR>> rtl70.bpl: @Rtlconsts@initialization$qqrv, @Rtlconsts@Finalization$qqrv<BR>> shell32.dll: Shell_NotifyIconA, ShellExecuteA<BR>> wsock32.dll: WSACleanup, WSAStartup, WSAGetLastError, WSAAsyncSelect, gethostname, gethostbyname, socket, send, recv, ioctlsocket, htons, connect, closesocket<BR>> gdi32.dll: TranslateCharsetInfo<BR>> comctl32.dll: ImageList_Destroy, ImageList_Add, ImageList_Create<BR>> vcl70.bpl: @Forms@initialization$qqrv, @Forms@Finalization$qqrv, @Forms@TApplication@GetExeName$qqrv, @Forms@TApplication@Terminate$qqrv, @Forms@TApplication@Run$qqrv, @Forms@TApplication@CreateForm$qqrp17System@TMetaClasspv, @Forms@TApplication@Initialize$qqrv, @Forms@TApplication@UnhookMainWindow$qqrynpqqrr17Messages@TMessage$o, @Forms@TApplication@HookMainWindow$qqrynpqqrr17Messages@TMessage$o, @Forms@TApplication@ProcessMessages$qqrv, @Forms@TCustomForm@QueryInterface$qqsrx5_GUIDpv, @Forms@TCustomForm@UpdateActions$qqrv, @Forms@TCustomForm@ShowModal$qqrv, @Forms@TCustomForm@SetFocus$qqrv, @Forms@TCustomForm@CloseQuery$qqrv, @Forms@TCustomForm@Resizing$qqr18Forms@TWindowState, @Forms@TCustomForm@PaintWindow$qqrui, @Forms@TCustomForm@SetFocusedControl$qqrp20Controls@TWinControl, @Forms@TCustomForm@DefaultHandler$qqrpv, @Forms@TCustomForm@DestroyWindowHandle$qqrv, @Forms@TCustomForm@CreateWindowHandle$qqrrx22Controls@TCreateParams, @Forms@TCustomForm@CreateWnd$qqrv, @Forms@TCustomForm@CreateParams$qqrr22Controls@TCreateParams, @Forms@TCustomForm@AlignControls$qqrp17Controls@TControlr11Types@TRect, @Forms@TCustomForm@WndProc$qqrr17Messages@TMessage, @Forms@TCustomForm@ValidateRename$qqrp18Classes@TComponentx17System@AnsiStringt2, @Forms@TCustomForm@SetParent$qqrp20Controls@TWinControl, @Forms@TCustomForm@WantChildKey$qqrp17Controls@TControlr17Messages@TMessage, @Forms@TCustomForm@SetVisible$qqro, @Forms@TCustomForm@SetParentBiDiMode$qqro, @Forms@TCustomForm@GetFloating$qqrv, @Forms@TCustomForm@GetClientRect$qqrv, @Forms@TCustomForm@DefineProperties$qqrp14Classes@TFiler, @Forms@TCustomForm@ReadState$qqrp15Classes@TReader, @Forms@TCustomForm@Notification$qqrp18Classes@TComponent18Classes@TOperation, @Forms@TCustomForm@Loaded$qqrv, @Forms@TCustomForm@DoDestroy$qqrv, @Forms@TCustomForm@DoCreate$qqrv, @Forms@TCustomForm@$bdtr$qqrv, @Forms@TCustomForm@BeforeDestruction$qqrv, @Forms@TCustomForm@$bctr$qqrp18Classes@TComponenti, @Forms@TCustomForm@AfterConstruction$qqrv, @Forms@TCustomForm@$bctr$qqrp18Classes@TComponent, @Forms@TScrollingWinControl@AdjustClientRect$qqrr11Types@TRect, @Forms@TScrollingWinControl@AutoScrollInView$qqrp17Controls@TControl, @Forms@TScrollingWinControl@AutoScrollEnabled$qqrv, @Forms@Application, @$xp$11Forms@TForm, @Forms@TForm@<BR>> rtl70.bpl: @Helpintfs@initialization$qqrv, @Helpintfs@Finalization$qqrv<BR>> rtl70.bpl: @Contnrs@initialization$qqrv, @Contnrs@Finalization$qqrv<BR>> rtl70.bpl: @Math@initialization$qqrv, @Math@Finalization$qqrv<BR>> rtl70.bpl: @Multimon@initialization$qqrv, @Multimon@Finalization$qqrv<BR>> vcl70.bpl: @Actnlist@initialization$qqrv, @Actnlist@Finalization$qqrv<BR>> vcl70.bpl: @Imglist@initialization$qqrv, @Imglist@Finalization$qqrv, @Imglist@TCustomImageList@GetCount$qqrv, @Imglist@TCustomImageList@GetIcon$qqrip14Graphics@TIcon, @$xp$24Imglist@TCustomImageList<BR>> vcl70.bpl: @Graphics@initialization$qqrv, @Graphics@Finalization$qqrv, @Graphics@TIcon@SetHandle$qqrui, @Graphics@TIcon@GetHandle$qqrv, @Graphics@TIcon@$bctr$qqrv, @$xp$14Graphics@TIcon, @Graphics@TIcon@<BR>> vcl70.bpl: @Consts@initialization$qqrv, @Consts@Finalization$qqrv<BR>> vcl70.bpl: @Controls@initialization$qqrv, @Controls@Finalization$qqrv, @Controls@TWinControl@SetParentBackground$qqro, @Controls@TWinControl@CanAutoSize$qqrrit1, @Controls@TWinControl@AssignTo$qqrp19Classes@TPersistent, @Controls@TWinControl@ConstrainedResize$qqrrit1t1t1, @Controls@TWinControl@CanResize$qqrrit1, @Controls@TWinControl@GetClientOrigin$qqrv, @Controls@TWinControl@GetControlExtents$qqrv, @Controls@TWinControl@GetHandle$qqrv, @Controls@TWinControl@Repaint$qqrv, @Controls@TWinControl@Update$qqrv, @Controls@TWinControl@Invalidate$qqrv, @Controls@TWinControl@GetDeviceContext$qqrrui, @Controls@TWinControl@ShowControl$qqrp17Controls@TControl, @Controls@TWinControl@SetBounds$qqriiii, @Controls@TWinControl@CustomAlignPosition$qqrp17Controls@TControlrit2t2t2r11Types@TRectrx19Controls@TAlignInfo, @Controls@TWinControl@CustomAlignInsertBefore$qqrp17Controls@TControlt1, @Controls@TWinControl@CreateHandle$qqrv, @Controls@TWinControl@DestroyWnd$qqrv, @Controls@TControl@InitiateAction$qqrv, @Controls@TControl@GetFloatingDockSiteClass$qqrv, @Controls@TControl@SetBiDiMode$qqr17Classes@TBiDiMode, @Controls@TControl@SetEnabled$qqro, @Controls@TControl@SetName$qqrx17System@AnsiString, @Controls@TControl@SetAutoSize$qqro, @Controls@TControl@SetHeight$qqri, @Controls@TControl@SetWidth$qqri, @Controls@TControl@SetTop$qqri, @Controls@TControl@SetLeft$qqri, @Controls@TControl@SetDragMode$qqr18Controls@TDragMode, @Controls@TControl@GetAction$qqrv, @Controls@TControl@GetEnabled$qqrv, @Controls@TControl@GetDragImages$qqrv, @Controls@TImageList@, @Controls@TWinControl@, @$xp$24Controls@TMouseMoveEvent, @$xp$20Controls@TMouseEvent<BR>> vcl70.bpl: @Menus@initialization$qqrv, @Menus@Finalization$qqrv, @Menus@TMenuItem@GetItem$qqri, @Menus@TMenuItem@GetCount$qqrv, @$xp$16Menus@TPopupMenu<BR>> vcl70.bpl: @Themes@initialization$qqrv, @Themes@Finalization$qqrv<BR>> rtl70.bpl: @Uxtheme@initialization$qqrv, @Uxtheme@Finalization$qqrv<BR>> rtl70.bpl: @Syncobjs@initialization$qqrv, @Syncobjs@Finalization$qqrv<BR>> vcl70.bpl: @Comctrls@initialization$qqrv, @Comctrls@Finalization$qqrv, @Comctrls@GetComCtlVersion$qqrv<BR>> vcl70.bpl: @Listactns@initialization$qqrv, @Listactns@Finalization$qqrv<BR>> vcl70.bpl: @Extctrls@initialization$qqrv, @Extctrls@Finalization$qqrv, @Extctrls@TTimer@SetEnabled$qqro, @Extctrls@TTimer@<BR>> vcl70.bpl: @Stdctrls@initialization$qqrv, @Stdctrls@Finalization$qqrv<BR>> vcl70.bpl: @Winhelpviewer@initialization$qqrv, @Winhelpviewer@Finalization$qqrv<BR>> vcl70.bpl: @Stdactns@initialization$qqrv, @Stdactns@Finalization$qqrv<BR>> vcl70.bpl: @Dialogs@initialization$qqrv, @Dialogs@Finalization$qqrv, @Dialogs@ShowMessage$qqrx17System@AnsiString<BR>> vcl70.bpl: @Printers@initialization$qqrv, @Printers@Finalization$qqrv<BR>> rtl70.bpl: @Strutils@initialization$qqrv, @Strutils@Finalization$qqrv<BR>> vcl70.bpl: @Clipbrd@initialization$qqrv, @Clipbrd@Finalization$qqrv<BR>> rtl70.bpl: @Flatsb@initialization$qqrv, @Flatsb@Finalization$qqrv<BR>> vcl70.bpl: @Toolwin@initialization$qqrv, @Toolwin@Finalization$qqrv<BR>> vcl70.bpl: @Extactns@initialization$qqrv, @Extactns@Finalization$qqrv<BR>> rtl70.bpl: @Registry@initialization$qqrv, @Registry@Finalization$qqrv, @Registry@TRegistry@KeyExists$qqrx17System@AnsiString, @Registry@TRegistry@ValueExists$qqrx17System@AnsiString, @Registry@TRegistry@ReadBool$qqrx17System@AnsiString, @Registry@TRegistry@WriteBool$qqrx17System@AnsiStringo, @Registry@TRegistry@ReadInteger$qqrx17System@AnsiString, @Registry@TRegistry@ReadString$qqrx17System@AnsiString, @Registry@TRegistry@WriteString$qqrx17System@AnsiStringt1, @Registry@TRegistry@OpenKey$qqrx17System@AnsiStringo, @Registry@TRegistry@CreateKey$qqrx17System@AnsiString, @Registry@TRegistry@SetRootKey$qqrui, @Registry@TRegistry@CloseKey$qqrv, @Registry@TRegistry@$bctr$qqrv, @Registry@TRegistry@<BR>> rtl70.bpl: @Inifiles@initialization$qqrv, @Inifiles@Finalization$qqrv<BR>> vcl70.bpl: @Extdlgs@initialization$qqrv, @Extdlgs@Finalization$qqrv<BR>> vcl70.bpl: @Buttons@initialization$qqrv, @Buttons@Finalization$qqrv<BR>> rtl70.bpl: @Mapi@initialization$qqrv, @Mapi@Finalization$qqrv<BR>> vcl70.bpl: @Comstrs@initialization$qqrv, @Comstrs@Finalization$qqrv<BR>> dsPluginSystemD7.bpl: @Dspluginmanager@initialization$qqrv, @Dspluginmanager@Finalization$qqrv, @Dspluginmanager@TdsPluginManager@PluginLoaded$qqr17System@AnsiString, @Dspluginmanager@TdsPluginManager@UnLoadPlugins$qqrv, @Dspluginmanager@TdsPluginParameters@GetItems$qqri, @Dspluginmanager@TdsPluginParameter@SetAsString$qqrx17System@AnsiString, @Dspluginmanager@TdsPluginParameter@SetAsBoolean$qqrxo, @Dspluginmanager@TdsPluginParameter@GetAsBoolean$qqrv, @Dspluginmanager@TdsPluginCommand@Execute$qqrv, @Dspluginmanager@TdsPluginManager@<BR>> dsPluginSystemD7.bpl: @Dspluginconst@initialization$qqrv, @Dspluginconst@Finalization$qqrv<BR>> dsPluginSystemD7.bpl: @Dspluginmanagerintf@initialization$qqrv, @Dspluginmanagerintf@Finalization$qqrv<BR>> dsPluginSystemD7.bpl: @Dspluginmanagertype@initialization$qqrv, @Dspluginmanagertype@Finalization$qqrv<BR>> rtl70.bpl: @Comobj@initialization$qqrv, @Comobj@Finalization$qqrv<BR>> rtl70.bpl: @Comconst@initialization$qqrv, @Comconst@Finalization$qqrv<BR>> DMCompo.bpl: @Dmgraphicsettings@initialization$qqrv, @Dmgraphicsettings@Finalization$qqrv, @Dmgraphicsettings@TDMLData@GetText$qqrus, @Dmgraphicsettings@TDMGraphicSettings@<BR>> te_d7.bpl: @Te_controls@initialization$qqrv, @Te_controls@Finalization$qqrv<BR>> te_d7.bpl: @Te_utils@initialization$qqrv, @Te_utils@Finalization$qqrv<BR>> te_d7.bpl: @Te_winapi@initialization$qqrv, @Te_winapi@Finalization$qqrv<BR>> te_d7.bpl: @Te_bitmap@initialization$qqrv, @Te_bitmap@Finalization$qqrv<BR>> te_d7.bpl: @Te_theme@initialization$qqrv, @Te_theme@Finalization$qqrv<BR>> vcl70.bpl: @Grids@initialization$qqrv, @Grids@Finalization$qqrv<BR>> vcl70.bpl: @Mask@initialization$qqrv, @Mask@Finalization$qqrv<BR>> rtl70.bpl: @Maskutils@initialization$qqrv, @Maskutils@Finalization$qqrv<BR>> te_d7.bpl: @Te_effect@initialization$qqrv, @Te_effect@Finalization$qqrv<BR>> te_d7.bpl: @Te_common@initialization$qqrv, @Te_common@Finalization$qqrv<BR>> te_d7.bpl: @Te_const@initialization$qqrv, @Te_const@Finalization$qqrv<BR>> te_d7.bpl: @Te_engine@initialization$qqrv, @Te_engine@Finalization$qqrv<BR>> te_d7.bpl: @Te_version@initialization$qqrv, @Te_version@Finalization$qqrv<BR>> te_d7.bpl: @Te_themecontrols@initialization$qqrv, @Te_themecontrols@Finalization$qqrv<BR>> te_d7.bpl: @Theme_officexp@initialization$qqrv, @Theme_officexp@Finalization$qqrv<BR>> te_d7.bpl: @Theme_flat@initialization$qqrv, @Theme_flat@Finalization$qqrv<BR>> te_d7.bpl: @Theme_msux@initialization$qqrv, @Theme_msux@Finalization$qqrv<BR>> te_d7.bpl: @Theme_msuxtypes@initialization$qqrv, @Theme_msuxtypes@Finalization$qqrv<BR>> te_d7.bpl: @Te_wave@initialization$qqrv, @Te_wave@Finalization$qqrv<BR>> te_d7.bpl: @Theme_msuxobjects@initialization$qqrv, @Theme_msuxobjects@Finalization$qqrv<BR>> te_d7.bpl: @Te_compress@initialization$qqrv, @Te_compress@Finalization$qqrv<BR>> te_d7.bpl: @Theme_se3@initialization$qqrv, @Theme_se3@Finalization$qqrv<BR>> te_d7.bpl: @Theme_se3objects@initialization$qqrv, @Theme_se3objects@Finalization$qqrv<BR>> TECompo.bpl: @Ezcrypt@initialization$qqrv, @Ezcrypt@Finalization$qqrv, @Ezcrypt@TextDecrypt$qqrx17System@AnsiStringpxus, @Ezcrypt@TextEncrypt$qqrx17System@AnsiStringpxus<BR>> TECompo.bpl: @Dmcommon@initialization$qqrv, @Dmcommon@Finalization$qqrv, @Dmcommon@SendString$qqrui17System@AnsiString, @Dmcommon@IntegrityCheck$qqr17System@AnsiStringt1, @Dmcommon@AddFDebug$qqr17System@AnsiString, @Dmcommon@connectionidhttp<BR>> indy70.bpl: @Idhttp@initialization$qqrv, @Idhttp@Finalization$qqrv<BR>> indy70.bpl: @Idcomponent@initialization$qqrv, @Idcomponent@Finalization$qqrv<BR>> indy70.bpl: @Idresourcestrings@initialization$qqrv, @Idresourcestrings@Finalization$qqrv<BR>> indy70.bpl: @Idstack@initialization$qqrv, @Idstack@Finalization$qqrv<BR>> indy70.bpl: @Idglobal@initialization$qqrv, @Idglobal@Finalization$qqrv<BR>> indy70.bpl: @Idexception@initialization$qqrv, @Idexception@Finalization$qqrv<BR>> indy70.bpl: @Iduri@initialization$qqrv, @Iduri@Finalization$qqrv<BR>> indy70.bpl: @Idstackconsts@initialization$qqrv, @Idstackconsts@Finalization$qqrv<BR>> indy70.bpl: @Idwinsock2@initialization$qqrv, @Idwinsock2@Finalization$qqrv<BR>> indy70.bpl: @Idstackwindows@initialization$qqrv, @Idstackwindows@Finalization$qqrv<BR>> indy70.bpl: @Idbasecomponent@initialization$qqrv, @Idbasecomponent@Finalization$qqrv<BR>> indy70.bpl: @Idantifreezebase@initialization$qqrv, @Idantifreezebase@Finalization$qqrv<BR>> indy70.bpl: @Idtcpconnection@initialization$qqrv, @Idtcpconnection@Finalization$qqrv<BR>> indy70.bpl: @Idiohandlersocket@initialization$qqrv, @Idiohandlersocket@Finalization$qqrv<BR>> indy70.bpl: @Idiohandler@initialization$qqrv, @Idiohandler@Finalization$qqrv<BR>> indy70.bpl: @Idsockethandle@initialization$qqrv, @Idsockethandle@Finalization$qqrv<BR>> indy70.bpl: @Idsocks@initialization$qqrv, @Idsocks@Finalization$qqrv<BR>> indy70.bpl: @Idassignednumbers@initialization$qqrv, @Idassignednumbers@Finalization$qqrv<BR>> indy70.bpl: @Idrfcreply@initialization$qqrv, @Idrfcreply@Finalization$qqrv<BR>> indy70.bpl: @Idintercept@initialization$qqrv, @Idintercept@Finalization$qqrv<BR>> indy70.bpl: @Idstream@initialization$qqrv, @Idstream@Finalization$qqrv<BR>> indy70.bpl: @Idtcpstream@initialization$qqrv, @Idtcpstream@Finalization$qqrv<BR>> indy70.bpl: @Idmultipartformdata@initialization$qqrv, @Idmultipartformdata@Finalization$qqrv<BR>> indy70.bpl: @Idauthenticationmanager@initialization$qqrv, @Idauthenticationmanager@Finalization$qqrv<BR>> indy70.bpl: @Idauthentication@initialization$qqrv, @Idauthentication@Finalization$qqrv<BR>> indy70.bpl: @Idheaderlist@initialization$qqrv, @Idheaderlist@Finalization$qqrv<BR>> indy70.bpl: @Idcoder@initialization$qqrv, @Idcoder@Finalization$qqrv<BR>> indy70.bpl: @Idcodermime@initialization$qqrv, @Idcodermime@Finalization$qqrv<BR>> indy70.bpl: @Idcoder3to4@initialization$qqrv, @Idcoder3to4@Finalization$qqrv<BR>> indy70.bpl: @Idcookiemanager@initialization$qqrv, @Idcookiemanager@Finalization$qqrv<BR>> indy70.bpl: @Idcookie@initialization$qqrv, @Idcookie@Finalization$qqrv<BR>> indy70.bpl: @Idtcpclient@initialization$qqrv, @Idtcpclient@Finalization$qqrv<BR>> indy70.bpl: @Idsslopenssl@initialization$qqrv, @Idsslopenssl@Finalization$qqrv<BR>> indy70.bpl: @Idserveriohandler@initialization$qqrv, @Idserveriohandler@Finalization$qqrv<BR>> indy70.bpl: @Idthread@initialization$qqrv, @Idthread@Finalization$qqrv<BR>> indy70.bpl: @Idtcpserver@initialization$qqrv, @Idtcpserver@Finalization$qqrv<BR>> indy70.bpl: @Idserveriohandlersocket@initialization$qqrv, @Idserveriohandlersocket@Finalization$qqrv<BR>> indy70.bpl: @Idthreadmgrdefault@initialization$qqrv, @Idthreadmgrdefault@Finalization$qqrv<BR>> indy70.bpl: @Idthreadmgr@initialization$qqrv, @Idthreadmgr@Finalization$qqrv<BR>> indy70.bpl: @Idthreadsafe@initialization$qqrv, @Idthreadsafe@Finalization$qqrv<BR>> indy70.bpl: @Idstrings@initialization$qqrv, @Idstrings@Finalization$qqrv<BR>> indy70.bpl: @Idsslopensslheaders@initialization$qqrv, @Idsslopensslheaders@Finalization$qqrv<BR>> indy70.bpl: @Idhttpheaderinfo@initialization$qqrv, @Idhttpheaderinfo@Finalization$qqrv<BR>> TECompo.bpl: @Crcunit@initialization$qqrv, @Crcunit@Finalization$qqrv, @Crcunit@GetCRC32$qqr17System@AnsiString<BR>> TECompo.bpl: @Md5@initialization$qqrv, @Md5@Finalization$qqrv, @Md5@MD5Print$qqrpxuc, @Md5@MD5File$qqr17System@AnsiString<BR>> TECompo.bpl: @Mocmess@initialization$qqrv, @Mocmess@Finalization$qqrv, @Mocmess@ShowMocMess$qqrp11Forms@TForm17System@AnsiString<BR><BR>( 2 exports ) <BR>EurekaLog_PasswordRequestEvent, ExceptionManager<BR>

J'ai téléchargé et installé SDFix.

Maintenant,le problème est le même que ce matin en mode sans échec,j'atterris devant un compte administrateur et un compte HP propriétaire(écran en 600 pixels).
Je prends administrateur,là j'ai un écran noir avec quelques raccourcis,pas de barre des tâches et l'icône de SDFix fait partie de ceux qui ne sont pas présents à l'écran.
J'essaie de modifier la taille de l'écran en faisant un click droit,mais il reste sur 600 pixels.
Le seul choix qu'il me reste est de faire un arrêt forcé.
Cette fois-ci,il n'y a pas eu de problème,le PC a démarré correctement du premier coup.

J'attends vos nouveaux ordres T_T.

mets sdfix dans mes documents et essaye de recommencer et lancer sdfix

car parfois en administrateur si mis sur le bureau on ne le trouve pas