Drole d'infection hijacktis

Bonjour destrio
je te remercie de t'occuper de mon problème


!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Mathé"

Mise à jour le 22.08.2008 à 17h30 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.13
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***

Favorit

*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Mathé\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Mathé\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Mathé\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\menudm~1\progra~1" ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Mathé\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *



*** Recherche fichiers ***



*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\Mathé\locals~1\applic~1" :

cmaoqak.dat trouvé !
cmaoqak_nav.dat trouvé !
cmaoqak_navps.dat trouvé !

* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" :


3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 26/08/2008 à 11:02:48,79 ***

Par contre je ne vois pas l'analyse sur d
merci de ta réponse

Bonsoir
Je te remercie
je te joins la copie
pourrais-tu me dire si tout cela correspon à du piratage, ce qu'est cmaoqak et un contrôleur de communication simplifiée qui veut s'installer
Clean Navipromo version 3.6.5 commencé le 26/08/2008 à 18:01:19,68

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Mathé"

Mise à jour le 22.08.2008 à 17h30 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.13
Système de fichiers : NTFS

Mode suppression automatique
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur


*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)


*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\WINDOWS\System32" *


* Suppression dans "C:\Documents and Settings\Mathé\locals~1\applic~1" *


* Suppression dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *


*** Suppression dossiers dans "C:\WINDOWS" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Mathé\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Mathé\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Mathé\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\menudm~1\progra~1" ***



*** Suppression fichiers ***


*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Math‚\locals~1\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\WINDOWS\system32" *


* Dans "C:\Documents and Settings\Mathé\locals~1\applic~1" *


cmaoqak.dat trouvé !
Copie cmaoqak.dat réalisée avec succès !
cmaoqak.dat supprimé !

cmaoqak_nav.dat trouvé !
Copie cmaoqak_nav.dat réalisée avec succès !
cmaoqak_nav.dat supprimé !

cmaoqak_navps.dat trouvé !
Copie cmaoqak_navps.dat réalisée avec succès !
cmaoqak_navps.dat supprimé !


* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !

*** Clés RUN orphelines Navipromo ***
!! Résultats temporairement non pris en charge !!
!! Les clés trouvées ne sont pas forcément infectées !!

Clés trouvés :

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"okugsye"="c:\\documents and settings\\math‚\\local settings\\application data\\okugsye.exe okugsye"


*** Nettoyage terminé le 26/08/2008 à 18:04:36,45 ***

26.08.2008 20:17:04 - Installation Directory: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
26.08.2008 20:17:04 - Backup Directory: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\BACKUP\
26.08.2008 20:17:04 - Temp Directory: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_48b448a0\
26.08.2008 20:17:05 - Start the Update GUI... Displaymode: 0

26.08.2008 20:17:04 - Installation Directory: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
26.08.2008 20:17:04 - Backup Directory: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\BACKUP\
26.08.2008 20:17:04 - Temp Directory: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_48b448a0\
26.08.2008 20:17:05 - Start the Update GUI... Displaymode: 0

26.08.2008 20:17:06 - Keyfile: Key expired [DEMO Mode]

26.08.2008 20:17:06 - Registry entry created successfully: Software\Avira\AntiVir PersonalEdition Classic |UpdateInProgress

26.08.2008 20:17:06 - Critical error: No valid license file available.

je ne comprends plus rien j'ai installé antivir mais pas français au secours !!!

1. TR/Spy.Banker.fef Trojan 22 Aug 2008 see here
2. TR/Spy.ZBot.DFO Trojan 21 Aug 2008 20 Aug 2008
3. TR/Dldr.Exchanger.OQ Trojan 19 Aug 2008 18 Aug 2008
4. TR/Dldr.Small.but Trojan 19 Aug 2008 05 Aug 2008
5. TR/Kavimondas.B Trojan 15 Aug 2008 17 Jun 2008
6. TR/Dldr.Agent.73728 Trojan 15 Aug 2008 28 Jun 2006
7. JS/Dldr.Iframe.BY Malware 14 Aug 2008 16 Jul 2008
8. TR/Dldr.Exchanger.MO Trojan 14 Aug 2008 13 Aug 2008
9. TR/Dldr.Exchanger.DW Trojan 13 Aug 2008 12 Aug 2008
10. HTML/Dldr.Iframe.ED Malware 12 Aug 2008 17 Jun 2008
11. TR/Spy.ZBot.DPI Trojan 12 Aug 2008 12 Aug 2008
12. TR/Dldr.Small.aafh Trojan 11 Aug 2008 06 Aug 2008
13. DR/Zapchast.AI Dropper 11 Aug 2008 04 Aug 2008
14. TR/Sorri.O.17 Trojan 11 Aug 2008 08 Aug 2008
15. TR/Dldr.Agent.jbb Trojan 11 Aug 2008 06 Aug 2008
16. DR/Cinmus.dol Dropper 08 Aug 2008 25 Jul 2008
17. Worm/IrcBot.19968.20 Worm 07 Aug 2008 08 May 2008
18. JS/Dldr.Agent.ccy Malware 07 Aug 2008 07 Aug 2008
19. TR/Autorun.S Trojan 06 Aug 2008 21 Aug 2007
20. Worm/Autorun.czg Worm 06 Aug 2008 16 Mar 2008
21. Worm/Otwycal.g Worm 06 Aug 2008 24 Apr 2008
22. TR/Spy.Agent.gct Trojan 06 Aug 2008 17 Jun 2008
23. Worm/Autorun.dhl Worm 06 Aug 2008 10 Apr 2008
24. TR/Spy.ZBot.DPF Trojan 05 Aug 2008 05 Aug 2008
25. TR/BHO.czo Trojan 05 Aug 2008 24 Jul 2008
26. TR/Dldr.Small.zou Trojan 05 Aug 2008 see here
27. TR/Spy.Zbot.DPE Trojan 05 Aug 2008 see here
28. TR/Dldr.Small.yko Trojan 01 Aug 2008 21 Jul 2008
29. DR/Monder.320653 Dropper 01 Aug 2008 14 Jul 2008
30. TR/Agent.137216.2.A Trojan 01 Aug 2008 31 Jul 2008
31. TR/Dldr.Small.zmu Trojan 01 Aug 2008 31 Jul 2008
32. TR/Dldr.Agent.yhp Trojan 01 Aug 2008 31 Jul 2008
33. TR/Spy.ZBot.dnv Trojan 31 Jul 2008 31 Jul 2008
34. JS/Dldr.Agent.PR Malware 31 Jul 2008 21 Jul 2008
35. JS/Dldr.Agent.bxi Malware 31 Jul 2008 30 Jul 2008
36. TR/Dldr.Bagle.NK Trojan 31 Jul 2008 15 Apr 2008
37. JS/Dldr.Agent.PP Malware 31 Jul 2008 see here
38. Lloyds TSB 28 Phishing 30 Jul 2008
39. Worm/VB.BV.4 Worm 30 Jul 2008 12 Mar 2007
40. Worm/Kolabc.WN Worm 30 Jul 2008 23 Apr 2008

voici ce que je trouve en lancant antivir

<?xml version="1.0" encoding="utf-8" ?>
- <rss version="2.0">
- <channel>
<title>Avira - Latest Threats Descriptions</title>
<link>http://www.avira.com/en/threats/index.html</link>
<description>Use Avira's Latest Threats RSS to keep track of the newest multi-language malware descriptions posted on our website automatically. For details, plese visit our website: www.avira.com.</description>
<language>en</language>
<pubDate>Fri, 22 Aug 2008 13:30:20 +0200</pubDate>
<lastBuildDate>Fri, 22 Aug 2008 13:30:20 +0200</lastBuildDate>
<webMaster>webmaster@avira.com</webMaster>
- <image>
<url>http://www.avira.com/images/common/rssthreats.gif</url>
<title>Avira - Latest Threats Descriptions</title>
<link>http://www.avira.com/en/threats/index.html</link>
<description>Latest Threats Descriptions.</description>
<width>100</width>
<height>100</height>
</image>
- <item>
<title>TR/Spy.Banker.fef</title>
<link>http://www.avira.com/en/threats/section/details/id_vir/4284/tr_spy_banker_fef.html</link>
<description>Danger Level: Low Threat<br>VDF version: 7.00.06.37<br>Published date: Fri, 22 Aug 2008 10:53 +0200<br>Complete description for this threat can be found <a href="http://www.avira.com/en/threats/section/fulldetails/id_vir/4284/tr_spy_banker_fef.html" target="blank">here</a>.<br></description>
<pubDate>Fri, 22 Aug 2008 10:53 +0200</pubDate>
<guid isPermaLink="false">TR_Spy.Banker.fef</guid>
</item>
- <item>
<title>TR/Spy.ZBot.DFO</title>
<link>http://www.avira.com/en/threats/section/details/id_vir/4283/tr_spy_zbot_dfo.html</link>
<description>Danger Level: Medium Threat<br>VDF version: 7.00.06.45<br>Published date: Thu, 21 Aug 2008 14:50 +0200<br>Complete description for this threat can be found <a href="http://www.avira.com/en/threats/section/fulldetails/id_vir/4283/tr_spy_zbot_dfo.html" target="blank">here</a>.<br></description>
<pubDate>Thu, 21 Aug 2008 14:50 +0200</pubDate>
<guid isPermaLink="false">TR_Spy.ZBot.DFO</guid>
</item>
- <item>
<title>TR/Dldr.Exchanger.OQ</title>
<link>http://www.avira.com/en/threats/section/details/id_vir/4278/tr_dldr_exchanger_oq.html</link>
<description>Danger Level: Medium Threat<br>VDF version: 7.00.06.28<br>Published date: Tue, 19 Aug 2008 14:04 +0200<br>Complete description for this threat can be found <a href="http://www.avira.com/en/threats/section/fulldetails/id_vir/4278/tr_dldr_exchanger_oq.html" target="blank">here</a>.<br></description>
<pubDate>Tue, 19 Aug 2008 14:04 +0200</pubDate>
<guid isPermaLink="false">TR_Dldr.Exchanger.OQ</guid>
</item>
- <item>
<title>TR/Dldr.Small.but</title>
<link>http://www.avira.com/en/threats/section/details/id_vir/4279/tr_dldr_small_but.html</link>
<description>Danger Level: Low to Medium Threat<br>VDF version: 7.00.05.214<br>Published date: Tue, 19 Aug 2008 12:04 +0200<br>Complete description for this threat can be found <a href="http://www.avira.com/en/threats/section/fulldetails/id_vir/4279/tr_dldr_small_but.html" target="blank">here</a>.<br></description>
<pubDate>Tue, 19 Aug 2008 12:04 +0200</pubDate>
<guid isPermaLink="false">TR_Dldr.Small.but</guid>
</item>
- <item>
<title>TR/Kavimondas.B</title>
<link>http://www.avira.com/en/threats/section/details/id_vir/4277/tr_kavimondas_b.html</link>
<description>Danger Level: Medium Threat<br>VDF version: 7.00.04.210<br>Published date: Fri, 15 Aug 2008 13:44 +0200<br>Complete description for this threat can be found <a href="http://www.avira.com/en/threats/section/fulldetails/id_vir/4277/tr_kavimondas_b.html" target="blank">here</a>.<br></description>
<pubDate>Fri, 15 Aug 2008 13:44 +0200</pubDate>
<guid isPermaLink="false">TR_Kavimondas.B</guid>
</item>
</channel>
</rss>

a la fin du scan

j'ai scanné avec antivir mais pas français je suis piratée !!!!

pour mbam il faut le télécharger ?

excuses-moi mais ce n'eest pas moi qui t'ai envoyé le dernier message oui

oui mais c'est payant ?

Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1088
Windows 5.1.2600 Service Pack 2

21:43:03 26/08/2008
mbam-log-08-26-2008 (21-43-03).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 71743
Temps écoulé: 16 minute(s), 3 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7c4bcd17-bdba-4078-9d8c-8ca8b7eabe77} (Rogue.Multiple) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winspywareprotect (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

alors c'est quoi tout ça merci

je souhaiterai savoir à quoi correspond tout ce que l'on a du supprimer et ce qui était noté sur les rapports de sont des virus importés de fichiers ou quelqu'un qui a essayé de s'immisser suis-je tranquiille maintenant
merci destrio

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:31:33, on 27/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Orange\systray\systrayapp.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\browser\browser.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Documents and Settings\Mathé\Local Settings\Temporary Internet Files\Content.IE5\A92LAPIQ\HiJackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.6972\swg.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [okugsye] c:\documents and settings\mathé\local settings\application data\okugsye.exe okugsye
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/5.0.15.0/ImageUploader5.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

j'ai un dossier backup avec plein de petits dossiers mais si je clique dessus il me demande de choisir un logiciel pour les ouvrir
et puis périphérique à problèmes controleur pci de communication avec un numéro : ce périphérique n'est pas configuré correctement, j'ai trouvé ceci dans les informations systèmes

excuses-moi mais tu ne me dis toujours pas à quoi correspond tous mes problèmes et le dernier hijackthis problème encore ? merci

juste en dessous de la corbeille quand je prends l'explorateur windows en plus je souhaitais t"en copier un mais pas moyen dans n'importe quel sens

Malwarebytes' Anti-Malware
© Malwarebytes Corporation. All rights reserved.
https://www.malwarebytes.com/

Version 1.25 (August 17th, 2008)

1. (FIXED) Problem with ignore list.
2. (FIXED) Problem repairing certain registry keys.
3. (FIXED) Overflow error during removal.
4. (FIXED) Improved detection of multiple components.
5. (FIXED) Drastically improved scan speed.
6. (ADDED) Advanced technology to delete files on reboot.
7. (ADDED) Ability to run a truly silent install.
8. (ADDED) Support for Chinese Simplified, Chinese Traditional and Polish languages.

Version 1.24 (July 30th, 2008)

1. (FIXED) Problem with GUI closing after program update.
2. (FIXED) False positives with Zlob and Vundo heuristics.
3. (FIXED) Improved detection of random named BHOs.
4. (ADDED) Support for Turkish language.

Version 1.23 (July 23rd, 2008)

1. (FIXED) Minor problems with Protection Module.
2. (ADDED) New BHO heuristics.
3. (ADDED) Better heuristics for rootkit detection.
4. (ADDED) New shell extension that supports multiple file scanning.

Version 1.22 (July 20th, 2008)

1. (FIXED) Error 721 (0, 93).
2. (FIXED) Random freezing during scan.
3. (FIXED) Minor problems repairing LSA registry values.
4. (ADDED) New command line parameters: /fullscan and /fullscanterminate.

Version 1.21 (July 18th, 2008)

1. (FIXED) Problem with update hanging up application on first run.
2. (FIXED) Problem quarantining large files.
3. (FIXED) Greatly improved memory scan speed.
4. (FIXED) Updated zib.dll to latest version.
5. (ADDED) Scheduled scanning now creates log files.
6. (ADDED) Advanced heuristic detections for multiple trojans.
7. (ADDED) Direct Disk Access for enumerating folder contents.
8. (ADDED) Direct Disk Access for breaking file headers.

Version 1.20 (July 7th, 2008)

1. (FIXED) Improved overall quality of code.
2. (FIXED) Improved detection of certain malicious components.
3. (FIXED) Minor GUI inconsistencies.
4. (FIXED) Improved error handling.
5. (FIXED) Problem fixing LSP entries.
6. (FIXED) Potential for memory leaks in Protection Module.
7. (ADDED) Support for Russian language.

Version 1.19 (June 28th, 2008)

1. (FIXED) Various problems with update.
2. (FIXED) Improved Protection Module stability and speed.
3. (ADDED) Advanced detection schemes for Trojan.Vundo.
4. (ADDED) Windows version number to log file.
5. (ADDED) Support for Czech language.

Version 1.18 (June 19th, 2008)

1. (FIXED) Created new scheduling interface.
2. (FIXED) Minor glitches with Protection Module.
3. (FIXED) Problem opening help file.
4. (FIXED) System crashes during full scan.
5. (ADDED) Support for Portuguese language.

Version 1.17 (June 10th, 2008)

1. (FIXED) Problem saving certain settings.
2. (FIXED) Optimized removal functions.
3. (FIXED) Problems with scheduler.

Version 1.16 (June 9th, 2008)

1. (FIXED) Errors during scanning.
2. (FIXED) Minor problems during reboot removal.
3. (FIXED) Problems with ignore list buttons.
4. (FIXED) Errors during program unload.
5. (ADDED) Direct disk access to open and read locked files.
6. (ADDED) Ignore button to make ignoring items quicker.

Version 1.15 (June 5th, 2008)

1. (FIXED) Time delay when clicking the scan button.
2. (FIXED) Completely removed COMCTL32.OCX dependency.
3. (FIXED) Minor bug that produced rare false positives.
4. (FIXED) Quarantining files now retains their attributes.
5. (ADDED) Advanced detection of directories, registry entries and rootkits.

Version 1.14 (May 30th, 2008)

1. (FIXED) Major problem with detections.
2. (ADDED) Change log to application directory.

Version 1.13 (May 29th, 2008)

1. (FIXED) Problems with progress bar flickering on Vista.
2. (FIXED) Minor bugs when trying to update multiple times.
3. (FIXED) Problems registering product on Unicode systems.
4. (FIXED) Highly optimized GUID scanning.
5. (ADDED) Support for Slovak and Norwegian languages.
6. (ADDED) Log file name and save date to log file.
7. (ADDED) Better detection for Vundo leftovers.
8. (ADDED) Better rootkit detection with heuristics.
9. (ADDED) New command line parameter: /register. See help file.

Version 1.12 (May 5th, 2008)

1. (FIXED) Improved detection of new malware.
2. (FIXED) Minor changes to help file.
3. (FIXED) Dramatically improved Protection Module loading speed.
4. (FIXED) Minor improvements to scanning speed.
5. (FIXED) Moved drivers to proper locations.
6. (ADDED) Support for Danish language.
7. (ADDED) Registry permission fixing code.

Version 1.11 (April 7th, 2008)

1. (FIXED) Problem restoring items from quarantine.
2. (FIXED) Problem with detecting autorun entries.
3. (FIXED) Problem removing certain registry values.
4. (FIXED) Full scan selects only fixed drives as default.
5. (FIXED) Redesigned about form.

Version 1.10 (April 1st, 2008)

1. (FIXED) Installer missing Romanian translation.
2. (FIXED) Minor problem during memory scan.
3. (FIXED) Improved service scanning techniques.
4. (FIXED) Problems removing certain registry values.
5. (FIXED) Dramatically improved Protection Module speed.
6. (FIXED) Scheduler problems with Protection Module.
7. (ADDED) Advanced file scanning methods.
8. (ADDED) DNS checking and fixing.

Version 1.09 (March 19th, 2008)

1. (FIXED) CD-ROM and Network drives not checked by default.
2. (FIXED) Minor optimizations in Protection Module.
3. (ADDED) Jump to Location option to results list right click menu.
4. (ADDED) Support for Romanian language.
5. (ADDED) New main application icon.
6. (REMOVED) Splash form on program start.

Version 1.08 (March 9th, 2008)

1. (FIXED) Problem creating quick launch icon.
2. (FIXED) Program not closing properly.
3. (FIXED) Errors 708/730 on Unicode systems after update.
4. (FIXED) Problems with Protection Module recognizing updates.
5. (ADDED) Support for Finnish language.
6. (ADDED) Database update after program update.

Version 1.07 (March 5th, 2008)

1. (FIXED) Items in Swedish translation.
2. (FIXED) Minor problems with scanner.

Version 1.06 (March 4th, 2008)

1. (FIXED) Improved certain trojan detections.
2. (FIXED) Problems with Internet Explorer termination.
3. (FIXED) Problems with 0kb files. See CatchMe addition below.
4. (FIXED) Problems loading certain settings.
5. (FIXED) Problems starting scanner from Protection Module.
6. (FIXED) Problems with registration information with limited users.
7. (ADDED) Support for Catalan and Bulgarian languages.
8. (ADDED) Direct disk access using CatchMe.
9. (ADDED) Start with Windows setting to Protection tab.

Version 1.05 (February 21st, 2008)

1. (FIXED) Faster response to scan abort.
2. (FIXED) Minor bug detecting registry values.
3. (FIXED) Better uninstall support.
4. (FIXED) Better abort scan cleanup.
5. (ADDED) Improved Zlob detection.

Version 1.04 (February 18th, 2008)

1. (FIXED) Minor bug in Winsock LSP repair.
2. (FIXED) Improved autostart detection.
3. (FIXED) Flicker of desktop during update.
4. (FIXED) Quarantine problem with restoring files with no folder.
5. (ADDED) CatchMe driver for better file deletion.
6. (ADDED) Delete on reboot for registry items.
7. (ADDED) Support for Swedish language.

Version 1.03 (February 10th, 2008)

1. (FIXED) Bug loading heuristics defintions.
2. (FIXED) Minor update problems.
3. (FIXED) Quarantine items being detected in scan.
4. (FIXED) Error 708 after updating.
5. (FIXED) Problems with ignore list not working on regisry.
6. (ADDED) Folder and file alternate data stream detection.
7. (ADDED) New command line parameter: /updateshowdialog.
8. (ADDED) Advanced detection for certain infections.

Version 1.02 (February 3rd, 2008)

1. (FIXED) Problems with Protection Module.
2. (FIXED) Language resetting to English on reinstall.
3. (FIXED) New log naming conventions.
4. (FIXED) New locations of certain files and registry entries.
5. (ADDED) New mirror to update tab.
6. (ADDED) Help button in about tab.
7. (ADDED) Latest news now gets saved and loaded on start.
8. (ADDED) Support for Albanian and Hungarian languages.

Version 1.01 (January 26th, 2008)

1. (FIXED) FileASSASSIN noticing no file was selected.
2. (FIXED) Problem with registration failing on certain licenses.
3. (FIXED) Minor issues with Protection Module.
4. (ADDED) File selected by FileASSASSIN now displayed.
5. (ADDED) New command line parameter: /minimized.
6. (ADDED) Ability to start scheduled tasks minimized.
7. (ADDED) Update mirrors in update tab.
8. (ADDED) Logs tab to view and delete log files.
9. (ADDED) Support for German language.

j'ai cela en lancant file assassin de malwaere dossier changes qui est un dossier word ce sont des fichiers verrouillés , il y en a plus que ça

plus précise mais je souhaitais savoir à quoi correspondait tout ce qui était inscrit dans le rapport hijacktis si on pouvait voir ce que voulait dire les problèmes : infection, piratage et pourquoi je me retrouve avec des dossiers ex back up comme cela

C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.6972\swg.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

ok mais tu dois quand même voir si c'est de la piraterie, une mauvaise utilisation de ma part...
merci en tout cas à toi ceci avait beaucoup d'incidende sur mon surf ?

ok merci pour ta réponse
mais je suis toujours dans le vague nous sommes plusieurs sur cet ordi et n'ai pas peur de me dire les problèmes
bonne soirée