Autorun.inf et ln9.exe ?

Bonjour,

petit pb que j'avais signalé sur un autre topic : http://www.commentcamarche.net/forum/affich 9671961 autorun inf ln9 exe amvo
mais je le place ici pour plus de lisibilité, selon vos conseils.

voici mon logfile et le rapport usbfix... je fais quoi maintenant ? merci par avance de votre aide.

====
LOGFILE

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:21:21, on 06.12.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\lxctcoms.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Utimaco\SafeGuard PrivateDisk\pdservice.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Lexmark 5400 Series\lxctmon.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Lexmark 5400 Series\ezprint.exe
C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\invite\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fimg%2ffr%2ffr-fr%2fdivertissement%2fcelebrites%2fgalery%2fwentworth02.jpg%3f
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no

file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat

7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} -

C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
O4 - HKLM\..\Run: [PDService.exe] C:\Program Files\Utimaco\SafeGuard PrivateDisk\pdservice.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [lxctmon.exe] "C:\Program Files\Lexmark 5400 Series\lxctmon.exe"
O4 - HKLM\..\Run: [Lexmark 5400 Series Fax Server] "C:\Program Files\Lexmark 5400 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 5400 Series\ezprint.exe"
O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [VAIO Update 4] "C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe" /Stationary
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Transfert par Image Converter 2 - C:\Program Files\Sony\Image Converter 2\menu.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/fr/
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil

Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program

Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google

Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers

communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program

Files\Sony\Image Converter 2\IcVzMon.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxct_device - - C:\WINDOWS\system32\lxctcoms.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program

Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program

Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony

Shared\AVLib\SsBeSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony

Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony

Shared\AVLib\SSScsiSV.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Fichiers

communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\VAIO

Entertainment\VzTaskScheduler.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Fichiers

communs\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation -

C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation -

C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation -

C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program

Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Cooporated Initialisation (VCI) - Sony Corporation - C:\Program Files\Sony\VAIO Cooperated

Initialisation\VCI_SVC.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Fichiers

communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Fichiers

communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Fichiers

communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
End of file - 11758 bytes

==================
USBFIX

-------------- UsbFix V2.413.3 ---------------

* User : invite - SQUAW69
* Outils mis a jours le 05/12/2008 par Chiquitine29 et Chimay8
* Recherche effectuée à 16:37:40 le 06.12.2008
* Windows Xp - Internet Explorer 7.0.5730.11

--------------- [ Processus actifs ] ----------------

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\userinit.exe
C:\DOCUME~1\invite\LOCALS~1\Temp\1.tmp\b2e.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

--------------- [ Informations lecteurs ] ----------------

C: - Lecteur fixe

D: - Lecteur fixe

H: - Lecteur amovible

+- Contenu de l'autorun : C:\autorun.inf

;sL43r2dDwa0Ao2aAKajKsla255l99iCra3mapD71
[AutoRun]
;55Osi2q4l9seak2K22qLrAdiqL0wKw33d5roCe4cj7sLJiKqj4sw0D2daidA9nD2KlLkDwdai6fp9o13aAa8a474k0UiSDr3kriKcKwiZkkpf
open=iqosrtk.bat
;
shell\open\Command=iqosrtk.bat
;kmfJL9r24AKAkd533DXsDLKwiifCwa1w6AALJKi45rqfdi5Kipw1sd8
shell\open\Default=1
;iaDsS0imd7S2wikr1p0s2923r1qdCi43al483oA24SokD
shell\explore\Command=iqosrtk.bat
;CwHKqdw5sUD39kil0JfLak4jsJKq8rwDso2o6ll00isasJai83f1Z

+- Contenu de l'autorun : D:\autorun.inf

;sL43r2dDwa0Ao2aAKajKsla255l99iCra3mapD71
[AutoRun]
;55Osi2q4l9seak2K22qLrAdiqL0wKw33d5roCe4cj7sLJiKqj4sw0D2daidA9nD2KlLkDwdai6fp9o13aAa8a474k0UiSDr3kriKcKwiZkkpf
open=iqosrtk.bat
;
shell\open\Command=iqosrtk.bat
;kmfJL9r24AKAkd533DXsDLKwiifCwa1w6AALJKi45rqfdi5Kipw1sd8
shell\open\Default=1
;iaDsS0imd7S2wikr1p0s2923r1qdCi43al483oA24SokD
shell\explore\Command=iqosrtk.bat
;CwHKqdw5sUD39kil0JfLak4jsJKq8rwDso2o6ll00isasJai83f1Z

+- Contenu de l'autorun : H:\autorun.inf

;sL43r2dDwa0Ao2aAKajKsla255l99iCra3mapD71
[AutoRun]
;55Osi2q4l9seak2K22qLrAdiqL0wKw33d5roCe4cj7sLJiKqj4sw0D2daidA9nD2KlLkDwdai6fp9o13aAa8a474k0UiSDr3kriKcKwiZkkpf
open=iqosrtk.bat
;
shell\open\Command=iqosrtk.bat
;kmfJL9r24AKAkd533DXsDLKwiifCwa1w6AALJKi45rqfdi5Kipw1sd8
shell\open\Default=1
;iaDsS0imd7S2wikr1p0s2923r1qdCi43al483oA24SokD
shell\explore\Command=iqosrtk.bat
;CwHKqdw5sUD39kil0JfLak4jsJKq8rwDso2o6ll00isasJai83f1Z

--------------- [ Lecteur C ] ----------------

C: - Lecteur fixe

+- Listing des fichiers présents :

[13.07.2005 11:04][--a------] C:\AUTOEXEC.BAT
[13.07.2005 11:04][--a------] C:\eb.bat
[13.07.2005 11:04][--a------] C:\iqosrtk.bat
[05.08.2004 13:00][-rahs----] C:\NTDETECT.COM
[03.12.2008 08:08][-r-hs----] C:\0oyl662q.cmd
[24.11.2008 18:18][-r-hs----] C:\ln9.exe
[02.06.2006 07:51][-rahs----] C:\boot.ini
[02.06.2006 07:51][-rahs----] C:\winamp.ini
[06.12.2008 16:35][-r-hs----] C:\autorun.inf
[06.12.2008 16:41][--a------] C:\UsbFix.txt
[13.07.2005 11:04][--a------] C:\CONFIG.SYS
[13.07.2005 11:04][--a------] C:\hiberfil.sys
[13.07.2005 11:04][--a------] C:\IO.SYS
[13.07.2005 11:04][--a------] C:\MSDOS.SYS
[13.07.2005 11:04][--a------] C:\pagefile.sys

--------------- [ Lecteur D ] ----------------

D: - Lecteur fixe

+- Listing des fichiers présents :

[02.12.2008 21:50][-r-hs----] D:\eb.bat
[02.12.2008 21:50][-r-hs----] D:\iqosrtk.bat
[03.12.2008 08:08][-r-hs----] D:\0oyl662q.cmd
[24.11.2008 18:18][-r-hs----] D:\ln9.exe
[11.07.2006 19:12][--ahs----] D:\Copie de desktop.ini
[06.12.2008 16:35][-r-hs----] D:\autorun.inf

--------------- [ Lecteur H ] ----------------

H: - Lecteur amovible

+- Listing des fichiers présents :

[05.12.2008 19:41][-r-hs----] H:\iqosrtk.bat
[03.12.2008 08:08][-r-hs----] H:\0oyl662q.cmd
[24.11.2008 18:18][-r-hs----] H:\ln9.exe
[06.12.2008 16:33][-r-hs----] H:\autorun.inf
[20.11.2008 17:08][--a------] H:\Gefuehle_Adjektive.txt

--------------- [ Registre / Startup ] ----------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"=""
"Start Page"=""

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
Apoint=C:\Program Files\Apoint\Apoint.exe
NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
RTHDCPL=RTHDCPL.EXE
Alcmtr=ALCMTR.EXE
AzMixerSel=C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
Mouse Suite 98 Daemon=ICO.EXE
Persistence=C:\WINDOWS\system32\igfxpers.exe
SonyPowerCfg=C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
ISBMgr.exe=C:\Program Files\Sony\ISB Utility\ISBMgr.exe
PDService.exe=C:\Program Files\Utimaco\SafeGuard PrivateDisk\pdservice.exe
IgfxTray=C:\WINDOWS\system32\igfxtray.exe
HotKeysCmds=C:\WINDOWS\system32\hkcmd.exe
avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
SunJavaUpdateSched="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
lxctmon.exe="C:\Program Files\Lexmark 5400 Series\lxctmon.exe"
Lexmark 5400 Series Fax Server="C:\Program Files\Lexmark 5400 Series\fm3032.exe" /s
EzPrint="C:\Program Files\Lexmark 5400 Series\ezprint.exe"
LXCTCATS=rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16
VAIO Update 4="C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe" /Stationary

--------------- [ Registre / Mountpoint2 ] ----------------

Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3abadf40-f203-11da-8d0b-806d6172696f}\Shell\AutoRun\command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3abadf40-f203-11da-8d0b-806d6172696f}\Shell\explore\Command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3abadf40-f203-11da-8d0b-806d6172696f}\Shell\open\Command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3abadf41-f203-11da-8d0b-806d6172696f}\Shell\AutoRun\command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3abadf41-f203-11da-8d0b-806d6172696f}\Shell\explore\Command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3abadf41-f203-11da-8d0b-806d6172696f}\Shell\open\Command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a2d1ca9-988d-11dd-8f2f-0013ce758448}\Shell\AutoRun\command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a2d1ca9-988d-11dd-8f2f-0013ce758448}\Shell\explore\Command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a2d1ca9-988d-11dd-8f2f-0013ce758448}\Shell\open\Command

--------------- [ Nettoyage des disques ] ----------------

Supprimé ! - [05.12.2008 19:41][-r-hs----] C:\WINDOWS\system32\amvo.exe
C:\autorun.inf ~> fichier appelé : "C:\iqosrtk.bat" ( présent ! )
Supprimé ! - C:\iqosrtk.bat
D:\autorun.inf ~> fichier appelé : "D:\iqosrtk.bat" ( présent ! )
Supprimé ! - D:\iqosrtk.bat
H:\autorun.inf ~> fichier appelé : "H:\iqosrtk.bat" ( présent ! )
Supprimé ! - H:\iqosrtk.bat
Supprimé ! - [06.12.2008 16:35][-r-hs----] C:\autorun.inf
Supprimé ! - [24.11.2008 18:18][-r-hs----] C:\ln9.exe
Supprimé ! - [06.12.2008 16:35][-r-hs----] D:\autorun.inf
Supprimé ! - [24.11.2008 18:18][-r-hs----] D:\ln9.exe
Supprimé ! - [06.12.2008 16:33][-r-hs----] H:\autorun.inf
Supprimé ! - [24.11.2008 18:18][-r-hs----] H:\ln9.exe

--------------- [ Resumé ] ----------------

-> /!\ Le resultat doit etre par un spécialiste /!\

[13.07.2005 11:04][--a------] C:\AUTOEXEC.BAT
[13.07.2005 11:04][--a------] C:\eb.bat
[05.08.2004 13:00][-rahs----] C:\NTDETECT.COM
[03.12.2008 08:08][-r-hs----] C:\0oyl662q.cmd
[02.06.2006 07:51][-rahs----] C:\boot.ini
[02.06.2006 07:51][-rahs----] C:\winamp.ini
[02.12.2008 21:50][-r-hs----] D:\eb.bat
[03.12.2008 08:08][-r-hs----] D:\0oyl662q.cmd
[11.07.2006 19:12][--ahs----] D:\Copie de desktop.ini
[03.12.2008 08:08][-r-hs----] H:\0oyl662q.cmd

--------------- ! Fin du rapport ! ----------------
Configuration: Windows XP
Firefox 3.0.4

9 réponses

  1. bonjour,

    tu a bien branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptibles d'avoir été infectées sans les ouvrir avant de lancer l'analyse?
    0
    1. Bonjour, j'imagine que oui, mais dans le doute je recommence toute l'opération...
      Après le redémarrage du PC, j'ai un message d'erreur de type "pas de disque" qui ralentit apparemment le nettoyage avec usbfix (et il y a bien évidemment un disque dans le lecteur) !
      Est-ce que c'est propre cette fois-ci, ou bien je dois faire une autre opération ?
      Merci de vos éclaircissements.

      RAPPORT HIJACKTHIS
      =============
      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 07:36:38, on 11.12.2008
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16735)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
      C:\Program Files\Bonjour\mDNSResponder.exe
      C:\WINDOWS\system32\lxctcoms.exe
      C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
      C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
      C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
      C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
      C:\Program Files\Apoint\Apoint.exe
      C:\WINDOWS\RTHDCPL.EXE
      C:\WINDOWS\system32\ICO.EXE
      C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
      C:\Program Files\Sony\ISB Utility\ISBMgr.exe
      C:\Program Files\Utimaco\SafeGuard PrivateDisk\pdservice.exe
      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
      C:\Program Files\Apoint\Apntex.exe
      C:\Program Files\Lexmark 5400 Series\lxctmon.exe
      C:\Program Files\Lexmark 5400 Series\ezprint.exe
      C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
      C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\Documents and Settings\invite\Bureau\HiJackThis.exe

      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
      O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
      O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
      O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
      O4 - HKLM\..\Run: [SonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
      O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
      O4 - HKLM\..\Run: [PDService.exe] C:\Program Files\Utimaco\SafeGuard PrivateDisk\pdservice.exe
      O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
      O4 - HKLM\..\Run: [lxctmon.exe] "C:\Program Files\Lexmark 5400 Series\lxctmon.exe"
      O4 - HKLM\..\Run: [Lexmark 5400 Series Fax Server] "C:\Program Files\Lexmark 5400 Series\fm3032.exe" /s
      O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 5400 Series\ezprint.exe"
      O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16
      O4 - HKLM\..\Run: [VAIO Update 4] "C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe" /Stationary
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
      O8 - Extra context menu item: Transfert par Image Converter 2 - C:\Program Files\Sony\Image Converter 2\menu.htm
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/fr/
      O15 - Trusted Zone: *.sony-europe.com
      O15 - Trusted Zone: *.sonystyle-europe.com
      O15 - Trusted Zone: *.vaio-link.com
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
      O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
      O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
      O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
      O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: lxct_device - - C:\WINDOWS\system32\lxctcoms.exe
      O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
      O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
      O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
      O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SsBeSvc.exe
      O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
      O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
      O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
      O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\VAIO Entertainment\VzTaskScheduler.exe
      O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
      O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
      O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
      O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
      O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
      O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
      O23 - Service: VAIO Cooporated Initialisation (VCI) - Sony Corporation - C:\Program Files\Sony\VAIO Cooperated Initialisation\VCI_SVC.exe
      O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
      O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
      O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
      0
      1. Télécharge OTMoveIt3 de OldTimer
        http://oldtimer.geekstogo.com/OTMoveIt3.exe

        * Enregistre-le sur ton bureau
        * Double-clique sur OTMoveIt3.exe pour le lancer (l'extension peut ne pas apparaître)
        * Copie-colle l'entièreté de ceci ci dessous dans la partie "Paste Instructions for Items to be Moved" (en-dessous de la barre jaune) :

        :processes
        explorer.exe 
        
        :files
        C:\eb.bat
        C:\0oyl662q.cmd
        D:\eb.bat
        D:\0oyl662q.cmd
        D:\Copie de desktop.ini
        H:\0oyl662q.cmd
        H:\Gefuehle_Adjektive.txt
          
        :commands
        [emptytemp]
        [Reboot]
        


        * Clique sur le bouton rouge Moveit! pour lancer le nettoyage
        * Copie-colle dans ta prochaine réponse tout ce qui se trouve dans la fenêtre Results (en vert à droite)
        --> Un rapport sera généré dans le dossier C:\ _OTMoveIt\MovedFiles avec la date et l'heure du passage de l'outil (mmddyyyy_hhmmss.log)
        * Ferme OTMoveIt3 (en cliquant sur Exit)

        Note : Si un fichier ou un dossier ne sait être supprimé directement, l'outil peut demander un redémarrage pour terminer le processus. Clique alors sur "Yes" pour accepter...
        0
        1. Bonsoir,
          voici donc le dernier rapport, après le passage de OTMoveIt3. Pensez-vous que tous les fichiers infectés sont effacés ? merci d'avance.

          ========== PROCESSES ==========
          Process explorer.exe killed successfully.
          ========== FILES ==========
          C:\eb.bat moved successfully.
          C:\0oyl662q.cmd moved successfully.
          D:\eb.bat moved successfully.
          D:\0oyl662q.cmd moved successfully.
          D:\Copie de desktop.ini moved successfully.
          H:\0oyl662q.cmd moved successfully.
          H:\Gefuehle_Adjektive.txt moved successfully.
          ========== COMMANDS ==========
          File delete failed. C:\DOCUME~1\invite\LOCALS~1\Temp\etilqs_3trOqjVHdqmJxHCWSQGg scheduled to be deleted on reboot.
          User's Temp folder emptied.
          User's Temporary Internet Files folder emptied.
          User's Internet Explorer cache folder emptied.
          Local Service Temp folder emptied.
          File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
          Local Service Temporary Internet Files folder emptied.
          File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
          File delete failed. C:\WINDOWS\temp\JETFC03.tmp scheduled to be deleted on reboot.
          File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_678.dat scheduled to be deleted on reboot.
          File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_78c.dat scheduled to be deleted on reboot.
          Windows Temp folder emptied.
          Java cache emptied.
          File delete failed. C:\Documents and Settings\invite\Local Settings\Application Data\Mozilla\Firefox\Profiles\urqeudvx.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
          File delete failed. C:\Documents and Settings\invite\Local Settings\Application Data\Mozilla\Firefox\Profiles\urqeudvx.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
          File delete failed. C:\Documents and Settings\invite\Local Settings\Application Data\Mozilla\Firefox\Profiles\urqeudvx.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
          File delete failed. C:\Documents and Settings\invite\Local Settings\Application Data\Mozilla\Firefox\Profiles\urqeudvx.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
          File delete failed. C:\Documents and Settings\invite\Local Settings\Application Data\Mozilla\Firefox\Profiles\urqeudvx.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
          File delete failed. C:\Documents and Settings\invite\Local Settings\Application Data\Mozilla\Firefox\Profiles\urqeudvx.default\XUL.mfl scheduled to be deleted on reboot.
          FireFox cache emptied.
          Temp folders emptied.

          OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12112008_211247

          Files moved on Reboot...
          File C:\DOCUME~1\invite\LOCALS~1\Temp\etilqs_3trOqjVHdqmJxHCWSQGg not found!
          File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
          File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
          File C:\WINDOWS\temp\JETFC03.tmp not found!
          File C:\WINDOWS\temp\Perflib_Perfdata_678.dat not found!
          C:\WINDOWS\temp\Perflib_Perfdata_78c.dat moved successfully.
          C:\Documents and Settings\invite\Local Settings\Application Data\Mozilla\Firefox\Profiles\urqeudvx.default\Cache\_CACHE_001_ moved successfully.
          C:\Documents and Settings\invite\Local Settings\Application Data\Mozilla\Firefox\Profiles\urqeudvx.default\Cache\_CACHE_002_ moved successfully.
          C:\Documents and Settings\invite\Local Settings\Application Data\Mozilla\Firefox\Profiles\urqeudvx.default\Cache\_CACHE_003_ moved successfully.
          C:\Documents and Settings\invite\Local Settings\Application Data\Mozilla\Firefox\Profiles\urqeudvx.default\Cache\_CACHE_MAP_ moved successfully.
          C:\Documents and Settings\invite\Local Settings\Application Data\Mozilla\Firefox\Profiles\urqeudvx.default\urlclassifier3.sqlite moved successfully.
          C:\Documents and Settings\invite\Local Settings\Application Data\Mozilla\Firefox\Profiles\urqeudvx.default\XUL.mfl moved successfully.
          0
          1. Lance Malwarebyte's https://download.cnet.com/Malwarebytes/3000-8022_4-10804572.html

            Fais un scan dit "complet" ( sélectionnes bien tous tes disks avant le scan ! ).

            --> Laisses le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
            --> à la fin tu cliques sur "résultat" .
            --> Vérifies que tous les objets infectés soient validés, puis cliques sur " suppression " .

            Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !

            Postes le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

            http://site-naheulbeuk.com/
            0
            1. et voici donc le dernier rapport - celui de malwarebytes... (car c'est bien le dernier n'est-ce pas ?
              merci pour le guidage et les outils pour nettoyer en tous cas.

              Malwarebytes' Anti-Malware 1.31
              Version de la base de données: 1456
              Windows 5.1.2600 Service Pack 3

              11.12.2008 23:24:13
              mbam-log-2008-12-11 (23-24-13).txt

              Type de recherche: Examen complet (C:\|D:\|E:\|F:\|H:\|)
              Eléments examinés: 109472
              Temps écoulé: 36 minute(s), 56 second(s)

              Processus mémoire infecté(s): 0
              Module(s) mémoire infecté(s): 0
              Clé(s) du Registre infectée(s): 0
              Valeur(s) du Registre infectée(s): 0
              Elément(s) de données du Registre infecté(s): 0
              Dossier(s) infecté(s): 0
              Fichier(s) infecté(s): 0

              Processus mémoire infecté(s):
              (Aucun élément nuisible détecté)

              Module(s) mémoire infecté(s):
              (Aucun élément nuisible détecté)

              Clé(s) du Registre infectée(s):
              (Aucun élément nuisible détecté)

              Valeur(s) du Registre infectée(s):
              (Aucun élément nuisible détecté)

              Elément(s) de données du Registre infecté(s):
              (Aucun élément nuisible détecté)

              Dossier(s) infecté(s):
              (Aucun élément nuisible détecté)

              Fichier(s) infecté(s):
              (Aucun élément nuisible détecté)
              0
              1. bonjour je pense que c'est bon

                repost un hijackthis

                0
                1. Bonsoir, j'ai utilisé Toolscleaner pour supprimer les fix :
                  http://www.commentcamarche.net/faq/sujet 8341 toolscleaner suppression des fix de force brute

                  puis j'ai lancé ccleaner, et pour finir le scan en ligne d'ESET - Nod32 - https://www.eset.com/
                  voici le rapport correspondant

                  # version=4
                  # OnlineScanner.ocx=1.0.0.635
                  # OnlineScannerDLLA.dll=1, 0, 0, 79
                  # OnlineScannerDLLW.dll=1, 0, 0, 78
                  # OnlineScannerUninstaller.exe=1, 0, 0, 49
                  # vers_standard_module=3696 (20081216)
                  # vers_arch_module=1.064 (20080214)
                  # vers_adv_heur_module=1.064 (20070717)
                  # EOSSerial=e15f85e37213c94fad8cb72914daf977
                  # end=finished
                  # remove_checked=true
                  # unwanted_checked=true
                  # utc_time=2008-12-16 10:24:49
                  # local_time=2008-12-16 11:24:49 (+0100, Paris, Madrid)
                  # country="Austria"
                  # osver=5.1.2600 NT Service Pack 3
                  # scanned=337887
                  # found=3
                  # scan_time=2750
                  C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinAgentfrl1.zip Win32/Bagle.gen.zip worm (unable to clean - deleted) 00000000000000000000000000000000
                  C:\WINDOWS\system32\kav320.dll Win32/PSW.OnLineGames.NMP trojan (unable to clean - deleted) 00000000000000000000000000000000
                  C:\WINDOWS\system32\kav321.dll Win32/PSW.OnLineGames.NMP trojan (unable to clean - deleted) 00000000000000000000000000000000

                  merci de me dire si tout est OK.
                  0
              2. et voici un nouveau rapport Hijackthis :

                Logfile of Trend Micro HijackThis v2.0.2
                Scan saved at 08:43:48, on 17.12.2008
                Platform: Windows XP SP3 (WinNT 5.01.2600)
                MSIE: Internet Explorer v7.00 (7.00.6000.16762)
                Boot mode: Normal

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                C:\WINDOWS\Explorer.EXE
                C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                C:\Program Files\Alwil Software\Avast4\ashServ.exe
                C:\WINDOWS\system32\spoolsv.exe
                C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                C:\Program Files\Bonjour\mDNSResponder.exe
                C:\WINDOWS\system32\lxctcoms.exe
                C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
                C:\WINDOWS\system32\nvsvc32.exe
                C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                C:\WINDOWS\system32\svchost.exe
                C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
                C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
                C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
                C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
                C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
                C:\Program Files\Apoint\Apoint.exe
                C:\WINDOWS\RTHDCPL.EXE
                C:\WINDOWS\system32\ICO.EXE
                C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
                C:\Program Files\Sony\ISB Utility\ISBMgr.exe
                C:\Program Files\Utimaco\SafeGuard PrivateDisk\pdservice.exe
                C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
                C:\Program Files\Lexmark 5400 Series\lxctmon.exe
                C:\Program Files\Lexmark 5400 Series\ezprint.exe
                C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe
                C:\WINDOWS\system32\ctfmon.exe
                C:\Program Files\Apoint\Apntex.exe
                C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
                C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
                C:\Program Files\Mozilla Firefox\firefox.exe
                C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

                https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
                R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no

                file)
                O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat

                7.0\ActiveX\AcroIEHelper.dll
                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} -

                C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
                O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
                O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
                O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
                O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
                O4 - HKLM\..\Run: [SonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
                O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
                O4 - HKLM\..\Run: [PDService.exe] C:\Program Files\Utimaco\SafeGuard PrivateDisk\pdservice.exe
                O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
                O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
                O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                O4 - HKLM\..\Run: [lxctmon.exe] "C:\Program Files\Lexmark 5400 Series\lxctmon.exe"
                O4 - HKLM\..\Run: [Lexmark 5400 Series Fax Server] "C:\Program Files\Lexmark 5400 Series\fm3032.exe" /s
                O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 5400 Series\ezprint.exe"
                O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16
                O4 - HKLM\..\Run: [VAIO Update 4] "C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe" /Stationary
                O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
                O8 - Extra context menu item: Transfert par Image Converter 2 - C:\Program Files\Sony\Image Converter 2\menu.htm
                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

                Files\Java\jre1.6.0_07\bin\ssv.dll
                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

                Files\Java\jre1.6.0_07\bin\ssv.dll
                O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

                Diagnostic\xpnetdiag.exe
                O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

                Files\Messenger\msmsgs.exe
                O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/fr/
                O15 - Trusted Zone: *.sony-europe.com
                O15 - Trusted Zone: *.sonystyle-europe.com
                O15 - Trusted Zone: *.vaio-link.com
                O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) -

                https://www.eset.com/
                O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

                http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device

                Support\bin\AppleMobileDeviceService.exe
                O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil

                Software\Avast4\aswUpdSv.exe
                O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program

                Files\Intel\Wireless\Bin\EvtEng.exe
                O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google

                Updater\GoogleUpdaterService.exe
                O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers

                communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
                O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program

                Files\Sony\Image Converter 2\IcVzMon.exe
                O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                O23 - Service: lxct_device - - C:\WINDOWS\system32\lxctcoms.exe
                O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
                O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
                O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program

                Files\Intel\Wireless\Bin\RegSrvc.exe
                O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program

                Files\Intel\Wireless\Bin\S24EvMon.exe
                O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony

                Shared\AVLib\SsBeSvc.exe
                O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony

                Shared\AVLib\SPTISRV.exe
                O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony

                Shared\AVLib\SSScsiSV.exe
                O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Fichiers

                communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
                O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\VAIO

                Entertainment\VzTaskScheduler.exe
                O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Fichiers

                communs\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
                O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
                O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation -

                C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
                O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation -

                C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
                O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation -

                C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
                O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program

                Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
                O23 - Service: VAIO Cooporated Initialisation (VCI) - Sony Corporation - C:\Program Files\Sony\VAIO Cooperated

                Initialisation\VCI_SVC.exe
                O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Fichiers

                communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
                O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Fichiers

                communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
                O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Fichiers

                communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
                0
                1. desinfecter la restauration

                  Clic droit sur poste de travail/propriétés/restauration du système et tu coches "désactiver la restauration du système". Normalement tous tes point de restauration devraient être effacés, y compris le dernier. Décoche ensuite la case pour réactiver la restauration.
                  0