Probleme infection diver

Bonjour,

1) Désinstalles PROPREMENT Avast, c'est important, et installes soit Antivir ( si tu reste en gratuit), soit Nod32 (payant) ou encore Kaspersky (payant).

Tu peux le constater de toi-même :

http://forum.malekal.com/ftopic3528.php

Si tu décides d'installer Antivir, fais ceci :

2) Télécharges Avira antivir PersonalEdition Classic a partir de ce lien : https://www.avira.com/ sur ton Bureau.
3) Télécharges le désinstalleur d'Avast sur ton Bureau : https://www.avast.com/fr-fr/uninstall-utility
4) Mets toi hors connexion, puis désinstalle avast, avec le désinstalleur!
5) Redémarre ton PC comme demandé et supprime le dossier C:\Program Files\Alwils Software
6) Double-cliques sur l'installeur d'Antivir.
7) Une fois celui-ci installé, reconnectes-toi afin d’effectuer sa mise à jour, et le paramétrer.
8) Ferme le scan qui s'est lancé de manière automatique.

Paramètres-le comme :

ici : http://speedweb1.free.fr/frames2.php?page=tuto5
ou là : https://www.malekal.com/avira-free-security-antivirus-gratuit/

9) Redémarres en mode sans échec

- Au redémarrage de l'ordinateur, une fois le chargement du BIOS terminé, il y a un écran noir qui apparaît, tapotes la touche F8 (ou F5 sur certains PC) jusqu'à l'affichage du menu des options avancées de Windows.
- Sélectionne "Mode sans échec" et appuyer sur la touche Enter.
- Choisis ta session habituelle, pas le compte "Administrateur".

Tutoriel ci-besoin :

https://forum.pcastuces.com/sujet.asp?f=25&s=3902

10) Lances Avira antivir.
11) Cliques sur Local protection (colonne à gauche), puis sur « Scanner », puis vérifies à RootKit search et Manuelle détection (en développant avec la petite croix devant chacun d'eux), que tous tes disques durs soient bien cochés, puis cliques sur la loupe (en dessous de statut).
12) Une fenêtre va s’ouvrir « Luke Filewalker » .. le scan va démarrer.
13) Mets tout ce qu il trouve en "Quarantine".
14) Une fois le scan achevé, fermes les deux fenêtres d'Antivir et sauvegardes le rapport.
15) Redémarres en mode normal puis postes le rapport d'Antivir.

Tuto http://www.malekal.com/tutorial_antivir.html et/ou http://www.libellules.ch/tuto_antivir.php

16) Télécharges Malwarebyte's à l'adresse ci-dessous, puis redémarres en mode sans échec. Pour cela, tapotes F8 au démarrage, avant que le logo de windows n'apparaisse. Fais un scan complet, et supprimes tout ce qu'il te trouve. Ensuite sauvegardes le résultat (à la fin du scan, l'option "afficher le résultat", apparait).

https://www.generation-nt.com/malwarebytes-anti-malware-protection-agents-malveillants-securite-anti-malwares-telecharger-telechargement-47800.html

17) Lorsque tu as fini ça, refais un log hijackthis et post-le à la suite du résultat de Malwarebyte's.

Re bonjour

tout d'abord merci pour ta réponse très très rapide. je fais tous sa demain es je te reposte sa sans faute.

en tout cas encore merci est a demain

loïc

salut

Voila comme tu m as demander le rapport Antivir.

Je te poste le reste des que c est terminé.

Merci encore pour ton aide

Avira AntiVir Personal
Report file date: lundi 8 septembre 2008 12:49

Scanning for 1602338 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 3) [5.1.2600]
Boot mode: Save mode
Username: Administrateur
Computer name: LOLO-3D39BE6FD6

Version information:
BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00
AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 08:57:53
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:54:15
ANTIVIR2.VDF : 7.0.6.94 2998784 Bytes 31/08/2008 10:30:14
ANTIVIR3.VDF : 7.0.6.128 230400 Bytes 08/09/2008 10:30:15
Engineversion : 8.1.1.28
AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21
AESCRIPT.DLL : 8.1.0.70 319866 Bytes 08/09/2008 10:30:23
AESCN.DLL : 8.1.0.23 119156 Bytes 10/07/2008 12:44:49
AERDL.DLL : 8.1.1.1 397683 Bytes 08/09/2008 10:30:22
AEPACK.DLL : 8.1.2.1 364917 Bytes 15/07/2008 12:58:35
AEOFFICE.DLL : 8.1.0.23 196987 Bytes 08/09/2008 10:30:21
AEHEUR.DLL : 8.1.0.51 1397111 Bytes 08/09/2008 10:30:20
AEHELP.DLL : 8.1.0.15 115063 Bytes 10/07/2008 12:44:48
AEGEN.DLL : 8.1.0.36 315764 Bytes 08/09/2008 10:30:18
AEEMU.DLL : 8.1.0.7 430452 Bytes 31/07/2008 08:33:21
AECORE.DLL : 8.1.1.11 172406 Bytes 08/09/2008 10:30:17
AEBB.DLL : 8.1.0.1 53617 Bytes 10/07/2008 12:44:48
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 08/09/2008 10:30:16
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37

Configuration settings for the scan:
Jobname..........................: Manual Selection
Configuration file...............: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\folder.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:, E:, F:, G:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,
Macro heuristic..................: on
File heuristic...................: medium
Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: lundi 8 septembre 2008 12:49

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
11 processes with 11 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!
Boot sector 'E:\'
[INFO] No virus was found!
Boot sector 'F:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '65' files ).

Starting the file scan:

Begin scan in 'C:\'
C:\delnis.bat
[DETECTION] Contains recognition pattern of the BAT/Delfiles.Q batch virus
[NOTE] The file was moved to '493103b9.qua'!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\lel@p!n\Local Settings\Temporary Internet Files\Content.IE5\AYIL9SEH\Uninstaller[1].exe
[0] Archive type: ZIP SFX (self extracting)
--> 7.exe
[DETECTION] Is the TR/Dldr.Agent.aflr Trojan
--> 1.exe
[DETECTION] Contains recognition pattern of the PHISH/FraudTool.Agent.CB phishing file/email
--> 2.exe
[DETECTION] Contains recognition pattern of the PHISH/FraudTool.Agent.CC phishing file/email
--> 3.exe
[DETECTION] Is the TR/FakeAntispy.WD Trojan
--> 4.exe
[DETECTION] Is the TR/Agent.acqs Trojan
--> 5.exe
[DETECTION] Contains recognition pattern of the DR/FraudTool.MSAntivirus.X dropper
--> 5.exe
[1] Archive type: ZIP SFX (self extracting)
--> MSA.cpl
[DETECTION] Contains recognition pattern of the PHISH/FraudTool.MSAntivirus.X phishing file/email
--> MSA.exe
[DETECTION] Is the TR/Fake.UltimaAV.bh Trojan
[DETECTION] Contains recognition pattern of the DR/Dldr.Agent.aflr.1 dropper
[NOTE] The file was moved to '492e0435.qua'!
C:\Documents and Settings\lel@p!n\Local Settings\Temporary Internet Files\Content.IE5\ON356290\Setup_ver1.1567.0[1].exe
[DETECTION] Is the TR/Dldr.Zlob.Gen Trojan
[NOTE] The file was moved to '49390458.qua'!
C:\WINDOWS\system32\pskill.exe
[DETECTION] Contains recognition pattern of the SPR/Tool.PsKill.1101 program
[NOTE] The file was moved to '4930098d.qua'!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\' <Divers>
Begin scan in 'E:\' <Jeux Pc>
Begin scan in 'F:\' <Divers>
F:\262858898f9a013fd47be3ac3b8d75\advpack.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\browseui.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\corpol.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\custsat.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\dxtmsft.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\dxtrans.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\extmgr.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\hmmapi.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\icardie.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\ie4uinit.exe
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\ieakeng.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\ieaksie.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\ieakui.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\ieapfltr.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\iedkcs32.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\iedw.exe
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\ieencode.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\ieframe.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\iepeers.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\ieproxy.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\iernonce.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\iertutil.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\iesetup.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\ieudinit.exe
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\ieui.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\iexplore.exe
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\imgutil.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\inseng.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\jscript.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\jsproxy.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\licmgr10.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\msfeeds.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\msfeedsbs.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\msfeedssync.exe
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\mshta.exe
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\mshtml.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\mshtmled.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\mshtmler.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\msls31.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\msrating.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\mstime.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\occache.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\pngfilt.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\shdocvw.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\shlwapi.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\spmsg.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\spuninst.exe
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\spupdsvc.exe
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\url.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\urlmon.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\vbscript.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\vgx.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\webcheck.dll
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\winfxdocobj.exe
[WARNING] The file could not be opened!
F:\262858898f9a013fd47be3ac3b8d75\wininet.dll
[WARNING] The file could not be opened!
F:\Dossier emule\Temp\001.part
[0] Archive type: ZIP
--> Race driver grid - Setup.exe
[DETECTION] Is the TR/Spy.Gampass.A Trojan
[NOTE] The file was moved to '48f64298.qua'!
F:\Logiciels\Adobe Photoshop CS3 Extended+patch FR+kegen.HwC\Keygen\Keygen FINAL for Adobe suite CS3 - (Photoshop, Dreamweaver, Fireworks, Indesign, Illustrator, other).rar
[0] Archive type: RAR
--> Keygen all CS3 products.exe
[1] Archive type: ZIP SFX (self extracting)
--> AutoPlay/Docs/Keygen_1.exe
[DETECTION] Is the TR/Proxy.Horst.aae.12 Trojan
--> AutoPlay/Docs/Keygen_2.exe
[DETECTION] Is the TR/Proxy.Horst.aae.14 Trojan
--> AutoPlay/Docs/Keygen_3.exe
[DETECTION] Is the TR/Proxy.Horst.aae.8 Trojan
--> AutoPlay/Docs/Keygen_5.exe
[DETECTION] Contains a recognition pattern of the (harmful) BDS/Pcclient.581 back-door program
--> AutoPlay/Docs/Keygen_6.exe
[DETECTION] Contains a recognition pattern of the (harmful) BDS/Pcclient.578 back-door program
[NOTE] The file was moved to '493e5a5d.qua'!
F:\torrent\Keygen.PhotoshopCs3\Keygen.PhotoshopCs3.rar
[0] Archive type: RAR
--> Keygen.PhotoshopCs3\Keygen.PhotoshopCS3.exe
[DETECTION] Contains a recognition pattern of the (harmful) BDS/Poisonivy.j back-door program
[NOTE] The file was moved to '493e5dbc.qua'!
Begin scan in 'G:\'
Search path G:\ could not be opened!
System error [21]: Le périphérique n'est pas prêt.

End of the scan: lundi 8 septembre 2008 19:21
Used time: 6:31:19 Hour(s)

The scan has been done completely.

8232 Scanning directories
376508 Files were scanned
19 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
7 files were moved to quarantine
0 files were renamed
57 Files cannot be scanned
376432 Files not concerned
5071 Archives were scanned
57 Warnings
7 Notes

Manque plus que les deux autres.

Salut

Voila l'analyse Malwarebytes comme tu me l'as demandé.
Il ne me reste plus qu'1 je te le fais de suite es te le post.

Malwarebytes' Anti-Malware 1.26
Database version: 1125
Windows 5.1.2600 Service Pack 3

09/09/2008 10:56:57
Malwarebytes-log-2008-09-09 (10-56-17).txt

Scan type: Full Scan (C:\|D:\|E:\|F:\|)
Objects scanned: 148688
Time elapsed: 3 hour(s), 14 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

No action taken. --> tu es sûr de l'avoir fait en mode sans échec ?

Oui je l ai bien fais en Mode Sans Echec pourquoi?
Dis moi si tu veux j en t en refait un met sa prend un peut de temps :-(

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:24:06, on 09/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Razer\DeathAdder\razerhid.exe
C:\Program Files\Analog Devices\SoundMAX\smax4.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Razer\DeathAdder\razertra.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\winss.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://runonce.msn.com/runonce3.aspx
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: gksraemq - {89F51B26-A3FB-487C-B4E8-334CC35795A1} - C:\WINDOWS\gksraemq.dll (file missing)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [x64setup] cmd.exe /Q /c If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" REG ADD HKCU\Software\GNU\ffdshow\default /v isSubtitles /t REG_DWORD /d 1 /f (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [x64setup2] cmd.exe /Q /c If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" regsvr32.exe /S "%programfiles%\VistaCodecPack\filters\MatroskaSplitter.ax" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [x64setup3] cmd.exe /Q /c If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" REG DELETE "HKCR\Media Type\Extensions\.dts" /f (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [x64setup4] cmd.exe /Q /c If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" REG DELETE "HKCR\Media Type\Extensions\.ac3" /f (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [x64setup1] cmd.exe /Q /c If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" REG ADD HKCU\Software\GNU\ffdshow_audio /v ac3 /t REG_DWORD /d 15 /f (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: wfizzl.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: Windows service sysklog - Dreamy - C:\WINDOWS\System32\winss.exe
O24 - Desktop Component 0: Privacy Protection - (no file)

"no action taken" --> aucune décision prise/aucune action effectuée. Donc soit tu as posté le log AVANT de faire la suppression, soit tu l'as fait en mode normal. Mais si tu l'as fait comme je t'avais dit alors c'est chiant mais on règlera ça.

Confirme moi que tu as bien fait la suppression avant que tu ne post le log et pendant ce temps-là, je continue l'analyse.

Je te confirme que j ai bien fais en mode sans echec par compte j ai un doute sur la suppression avant le rapport Malwarebytes' Anti-Malware.

Veux tu que je t en refasse un?

Merci pour le temps que tu passe a m'aider. ;-)

En fait, malheureusement tu dois être sûr d'avoir supprimer. :-(

sorry, mais bon c'est ça l'informatique.

je comprend tout a fais es je suis desole de te faire perdre ton temps. Je le relance de suite supprime ce qui faux es te reposte le rapport.

C bon?
(des que tu m aura repondu je relance lme scan)

merci

Loïc

"je comprend tout a fais es je suis desole de te faire perdre ton temps." --> Tu ne me le fais pas perdre. Ici c'est du bénévolat, on adore ça. Donc, pour ce qui est du temps passé sur un problème, là n'est pas le souci. :-)

Oki très bien.

Alors je te relance sa de suite, des que ses bon je te le repost.

Un grand merci a tout les bénévole qui sont la pour nous aider ^^

re bonjour

Voila le rapport du scan après suppression des 3 truc qu'il avais trouvé.
Veux tu un autre scan HijackThis ?

Malwarebytes' Anti-Malware 1.27
Database version: 1131
Windows 5.1.2600 Service Pack 3

09/09/2008 16:52:55
mbam-log-2008-09-09 (16-52-55).txt

Scan type: Full Scan (C:\|D:\|E:\|F:\|)
Objects scanned: 149278
Time elapsed: 3 hour(s), 14 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CLASSES_ROOT\scrfile\shell\open\command\ (Broken.OpenCommand) -> Bad: ("%1" %*) Good: ("%1" /S) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\1.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\2.ico (Malware.Trace) -> Quarantined and deleted successfully.

Ok maintenant tu peux faire un log hijackthis.

Et voila.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:26:50, on 09/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Razer\DeathAdder\razerhid.exe
C:\Program Files\Analog Devices\SoundMAX\smax4.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Razer\DeathAdder\razertra.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\winss.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Adobe\Adobe Photoshop CS3\Photoshop.exe
C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://runonce.msn.com/runonce3.aspx
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: gksraemq - {89F51B26-A3FB-487C-B4E8-334CC35795A1} - C:\WINDOWS\gksraemq.dll (file missing)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [x64setup] cmd.exe /Q /c If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" REG ADD HKCU\Software\GNU\ffdshow\default /v isSubtitles /t REG_DWORD /d 1 /f (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [x64setup2] cmd.exe /Q /c If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" regsvr32.exe /S "%programfiles%\VistaCodecPack\filters\MatroskaSplitter.ax" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [x64setup3] cmd.exe /Q /c If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" REG DELETE "HKCR\Media Type\Extensions\.dts" /f (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [x64setup4] cmd.exe /Q /c If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" REG DELETE "HKCR\Media Type\Extensions\.ac3" /f (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [x64setup1] cmd.exe /Q /c If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" REG ADD HKCU\Software\GNU\ffdshow_audio /v ac3 /t REG_DWORD /d 15 /f (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: wfizzl.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: Windows service sysklog - Dreamy - C:\WINDOWS\System32\winss.exe
O24 - Desktop Component 0: Privacy Protection - (no file)

Fixes les lignes (lance hijacthis, coches les lignes, fais "fix checked", en bas à gauche) :

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

Ensuite, on va un peu nettoyer.

Télécharges Easy Cleaner :

https://www.01net.com/404/­/fiches/8351.html

Tu le lances et tu fais ceci :

1) Cliques sur registre, tu fais "trouver", tu supprimes tout.
2) Tu reviens au menu en appuyant sur "fermer"
3) Cliques sur "vider cookies"
4) Cliques sur "vider historique"
5) Cliques sur "document" (peut prendre du temps parfois)
6) Cliques sur "vides des fichiers"
7) Cliques sur "démarrage", tu sélectionnes les clé Jaune et/ou Rouge et tu les supprimes
8) Tu reviens au menu en appuyant sur "fermer"
9) Cliques sur inutiles, choisis les lecteurs, coches toutes les petites case, tu fais "trouver", tu attends puis tu supprimes tout. ATENTION : lors de la suppression tu dois attendre qu'il te dise une erreur, (c'est normal car certains fichiers sont utilisés), pour revenir au menu, et fermer.
10) Ensuite, vides ta corbeille si tu le dois.

Télécharges AusLogics Disk Defrag et AusLogics Registry Defrag :

https://www.auslogics.com/fr/software/

1) Lances AusLogics Disk Defrag et défragmentes (tu choisis ton lecteur puis tu fais Next et tu attends)
2) Quand tu as fini tout les lecteurs, tu peux le fermer.
3) Lances AusLogics Registry Defrag et fais next, il y aura un avertissement mais c'est pour te prévenir que tu devras probablement redémarrer.

Ensuite refais un log hijackthis.

oki je m occupe de sa tout de suite.

merci

1 erreur pour vider les fichiers: "tout les fichier n'ont pu etre supprimer!"

je continu le reste

Apres avoir fais tout ce que tu m as dis
voila le hijacthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:18:47, on 09/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Razer\DeathAdder\razerhid.exe
C:\Program Files\Analog Devices\SoundMAX\smax4.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Razer\DeathAdder\razertra.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\winss.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: gksraemq - {89F51B26-A3FB-487C-B4E8-334CC35795A1} - (no file)
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [x64setup] cmd.exe /Q /c If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" REG ADD HKCU\Software\GNU\ffdshow\default /v isSubtitles /t REG_DWORD /d 1 /f (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [x64setup2] cmd.exe /Q /c If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" regsvr32.exe /S "%programfiles%\VistaCodecPack\filters\MatroskaSplitter.ax" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [x64setup3] cmd.exe /Q /c If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" REG DELETE "HKCR\Media Type\Extensions\.dts" /f (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [x64setup4] cmd.exe /Q /c If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" REG DELETE "HKCR\Media Type\Extensions\.ac3" /f (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [x64setup1] cmd.exe /Q /c If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" REG ADD HKCU\Software\GNU\ffdshow_audio /v ac3 /t REG_DWORD /d 15 /f (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: wfizzl.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: Windows service sysklog - Dreamy - C:\WINDOWS\System32\winss.exe
O24 - Desktop Component 0: Privacy Protection - (no file)