Analyse log hijackthis

ComboFix n'a rien trouvé.

Voici le log produit par comboFix:

ComboFix 07-12-21.4 -test 2007-12-27 12:18:35.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.65 [GMT 1:00]
Running from: C:\Documents and Settings\test\Bureau\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((( Fichiers créés 2007-11-27 to 2007-12-27 ))))))))))))))))))))))))))))))))))))
.

2007-12-27 10:49 . 2007-12-17 16:06 124,341 -r-hs---- C:\WINDOWS\system32\amvo.exe
2007-12-27 10:46 . 2007-12-27 10:46 <REP> d-------- C:\Documents and Settings\test\Contacts
2007-12-27 09:48 . 2007-12-27 09:48 <REP> d-------- C:\Documents and Settings\test\Application Data\COWON
2007-12-27 08:57 . 2007-12-27 08:57 <REP> d-------- C:\Program Files\Trend Micro
2007-12-26 18:29 . 2007-12-26 18:29 <REP> d-------- C:\Documents and Settings\test\Application Data\DivX
2007-12-21 19:31 . 2007-12-17 16:06 124,341 -r-hs---- C:\n1deiect.com
2007-12-21 19:31 . 2007-12-27 10:49 43,678 -r-hs---- C:\WINDOWS\system32\amvo0.dll
2007-12-21 19:31 . 2007-12-27 12:18 260 -r-hs---- C:\autorun.inf
2007-12-21 08:57 . 2007-12-21 08:58 <REP> d-------- C:\Program Files\JetAudio
2007-12-21 08:57 . 2007-12-21 08:58 <REP> d-------- C:\Program Files\Fichiers communs\COWON
2007-12-21 08:47 . 2007-12-21 08:47 <REP> d-------- C:\Program Files\DivX
2007-12-19 11:10 . 2007-12-19 11:10 72 --a------ C:\test.csv
2007-12-13 18:33 . 2007-12-13 18:33 <REP> d-------- C:\Documents and Settings\test\.ssh
2007-12-11 23:35 . 2007-12-11 23:35 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe
2007-12-11 23:35 . 2007-12-11 23:35 9,878 --a------ C:\WINDOWS\system32\dsm_fr.qm
2007-12-11 23:35 . 2007-12-11 23:35 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb
2007-12-11 23:34 . 2007-12-11 23:34 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-12-11 23:34 . 2007-12-11 23:34 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-12-11 23:34 . 2007-12-11 23:34 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-12-11 23:32 . 2007-12-11 23:32 352,401 --a------ C:\WINDOWS\system32\DivXMedia.ax
2007-12-11 23:32 . 2007-12-11 23:32 156,992 --a------ C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-12-11 23:32 . 2007-12-11 23:32 12,288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
2007-12-11 23:32 . 2007-12-11 23:32 8,835 --a------ C:\WINDOWS\system32\dpufr.qm
2007-12-11 23:32 . 2007-12-11 23:32 3,162 --a------ C:\WINDOWS\system32\dtu_fr.qm
2007-12-05 15:40 . 2007-12-05 15:41 <REP> d-------- C:\Documents and Settings\test\.gnucash
2007-12-05 15:40 . 2007-12-05 15:40 <REP> d-------- C:\Documents and Settings\test\.gnome2_private
2007-12-05 15:40 . 2007-12-05 15:40 <REP> d-------- C:\Documents and Settings\test\.gnome2
2007-12-05 15:40 . 2007-12-06 10:28 <REP> d-------- C:\Documents and Settings\test\.gconfd
2007-12-05 15:40 . 2007-12-06 10:25 <REP> d-------- C:\Documents and Settings\test\.gconf
2007-12-05 15:38 . 2007-12-05 15:39 <REP> d-------- C:\Program Files\gnucash
2007-11-27 15:52 . 2007-11-27 15:54 <REP> d-------- C:\Program Files\wamp
2007-11-27 09:41 . 2007-11-27 09:41 <REP> d-------- C:\Program Files\apache-tomcat-6.0.10
2007-11-27 08:51 . 2007-11-27 08:52 <REP> d-------- C:\Documents and Settings\test\Application Data\FileZilla
2007-11-27 08:24 . 2007-11-27 08:24 <REP> d-------- C:\Program Files\FileZilla Client

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-27 09:46 --------- d-----w C:\Program Files\Symantec AntiVirus
2007-12-21 07:57 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-18 15:52 --------- d-----w C:\Documents and Settings\test\Application Data\MySQL
2007-12-11 22:34 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-12-11 22:34 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-12-11 22:34 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-12-11 22:34 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2007-12-11 22:34 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2007-12-11 22:34 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2007-12-11 22:33 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-12-11 22:33 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-12-11 22:33 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-12-11 22:33 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-12-11 22:33 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2007-12-11 22:33 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-12-11 22:33 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-12-11 22:33 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-12-11 22:33 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-12-11 22:33 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-12-11 22:33 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-12-11 22:33 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-11-29 14:25 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-11-28 14:54 --------- d-----w C:\Documents and Settings\test\Application Data\AdobeUM
2007-11-23 11:37 --------- d-----w C:\Program Files\Quest Software
2007-11-22 18:56 --------- d-----w C:\Program Files\VP Suite 2.2
2007-11-21 10:03 --------- d-----w C:\Program Files\Google
2007-11-20 18:08 --------- d-----w C:\Program Files\BORG Calendar
2007-11-20 07:25 --------- d-----w C:\Program Files\QuickTime
2007-11-20 07:24 --------- d-----w C:\Program Files\Apple Software Update
2007-11-20 07:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-11-20 07:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-08 11:16 --------- d-----w C:\Documents and Settings\test\Application Data\vlc
2007-11-07 14:28 --------- d-----w C:\Program Files\VideoLAN
2007-11-06 07:53 --------- d-----w C:\Program Files\MySQL
2007-11-06 07:52 --------- d-----w C:\Program Files\EasyPHP1-8
2007-11-01 16:55 --------- d-----w C:\Documents and Settings\test\Application Data\Media Player Classic
2007-10-30 07:55 --------- d-----w C:\Documents and Settings\test\Application Data\Feedreader
2007-10-29 22:43 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-29 19:41 --------- d-----w C:\Program Files\JGoodies
2007-10-29 19:39 --------- d-----w C:\Program Files\SuperCopier2
2007-10-29 19:36 --------- d-----w C:\Documents and Settings\test\Application Data\MSN6
2007-10-29 19:35 --------- d-----w C:\Program Files\ccm-2.0.7
2007-10-29 19:18 --------- d-----w C:\Program Files\FeedReader30
2007-10-29 19:03 --------- d-----w C:\Program Files\Yahoo!
2007-10-29 12:27 --------- d-----w C:\Documents and Settings\test\Application Data\Talkback
2007-10-29 09:30 --------- d-----w C:\Documents and Settings\example\Application Data\Talkback
2007-04-21 15:57 10,260,480 ---ha-w C:\Program Files\apache-tomcat-6.0.10.tar
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54]
"feedreader.exe"="C:\Program Files\FeedReader30\feedreader.exe" [2007-03-16 13:55]
"SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2005-03-14 00:37]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43]
"amva"="C:\WINDOWS\system32\amvo.exe" [2007-12-17 16:06]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-19 16:10 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2005-12-10 03:06 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-19 16:10 C:\WINDOWS\system32\rundll32.exe]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2004-02-29 16:44]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2004-03-12 15:18]
"IDManLoader"="C:\Documents and Settings\wenpa\Bureau\Internet Download Manager\IDMan crack\idm v4.xx & v5.xx universal loader.exe" []
"RTHDCPL"="RTHDCPL.EXE" [2006-06-01 15:48 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 17:04 C:\WINDOWS\SkyTel.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"EasyPHP"="C:\Program Files\EasyPHP1-8\EasyPHP.exe" [2005-02-28 12:50]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-776561741-682003330-10681\Scripts\Logon\[u]0[/u]\[u]0[/u]]
"Script"=OCMSS.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-776561741-682003330-10682\Scripts\Logon\[u]0[/u]\[u]0[/u]]
"Script"=OCMSS.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-776561741-682003330-1251\Scripts\Logon\[u]0[/u]\[u]0[/u]]
"Script"=Users_Pst.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-776561741-682003330-1251\Scripts\Logon\1\[u]0[/u]]
"Script"=OCMSS.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-776561741-682003330-1511\Scripts\Logon\[u]0[/u]\[u]0[/u]]
"Script"=OCMSS.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-776561741-682003330-1511\Scripts\Logon\[u]0[/u]\1]
"Script"=inventaire.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-776561741-682003330-15821\Scripts\Logon\[u]0[/u]\[u]0[/u]]
"Script"=OCMSS.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-776561741-682003330-17322\Scripts\Logon\[u]0[/u]\[u]0[/u]]
"Script"=OCMSS.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-776561741-682003330-17323\Scripts\Logon\[u]0[/u]\[u]0[/u]]
"Script"=OCMSS.bat

R2 OracleOraHome92Agent;OracleOraHome92Agent;E:\oracle\ora92\bin\agntsrvc.exe [2002-04-26 17:29]
R2 OracleServiceORCL;OracleServiceORCL;e:\oracle\ora92\bin\ORACLE.EXE ORCL []
S3 OracleOraHome92ClientCache;OracleOraHome92ClientCache;E:\oracle\ora92\BIN\ONRSD.EXE [2002-04-26 19:34]
S3 OracleOraHome92ManagementServer;OracleOraHome92ManagementServer;E:\oracle\ora92\bin\OMSNTsrv.exe [2002-08-20 22:57]
S3 OracleOraHome92SNMPPeerEncapsulator;OracleOraHome92SNMPPeerEncapsulator;E:\oracle\ora92\BIN\ENCSVC.EXE [2002-02-13 08:23]
S3 OracleOraHome92SNMPPeerMasterAgent;OracleOraHome92SNMPPeerMasterAgent;E:\oracle\ora92\BIN\AGNTSVC.EXE [2002-02-13 08:23]
S3 wampapache;wampapache;"C:\Program Files\wamp\apache2\bin\httpd.exe" -k runservice []
S3 wampmysqld;wampmysqld;"C:\Program Files\wamp\mysql\bin\mysqld-nt.exe" "--defaults-file=C:\Program Files\wamp\mysql\my.ini" wampmysqld []
S4 OracleOraHome92HTTPServer;OracleOraHome92HTTPServer;"E:\oracle\ora92\Apache\Apache\apache.exe" --ntservice []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{12429d9b-8608-11dc-b3fe-0019db40ee4c}]
\Shell\AutoRun\command - F:\n1deiect.com
\Shell\explore\Command - F:\n1deiect.com
\Shell\open\Command - F:\n1deiect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7a8ca2a1-55f8-11dc-b3e9-0019db40ee4c}]
\Shell\AutoRun\command - ntdelect.com
\Shell\explore\Command - utdetect.com
\Shell\open\Command - utdetect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c459c73b-9355-11dc-b400-0019db40ee4c}]
\Shell\AutoRun\command - F:\ntde1ect.com
\Shell\explore\Command - F:\ntde1ect.com
\Shell\open\Command - F:\ntde1ect.com

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-12-26 21:26:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
"2007-12-27 10:49:07 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-27 12:23:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-27 12:25:07
.
2007-12-13 11:30:26 --- E O F ---


Merci.

sans les retour chariot ce serait bcp plus pratique !

Bizarre, la ligne:

O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe

est revenue !?

Poste le rapport Combofix stp si tu l'a fait tourner.

Dommage! La méthode simple ne fonctionne pas. En fouillant un peu plus sur comment çà marche, j'ai trouvé le lien suivant:

http://www.commentcamarche.net/forum/affich 4080122 afficher les fichiers caches ne s applik pas

qui indique le lien suivant comme solution au problème:

http://www.infos-du-net.com/forum/274779-11-virus-empeche-afficher-fichiers-caches

J'ai testé, et ...çà marche!Autrement dit, les fichiers cachés s'affichent et le double-clic sur un disque n'ouvre plus une nouvelle fenêtre.

Anyway, je ne sais pas si ma machine n'est plus infectée, donc voici le nouveau log hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:54, on 2007-12-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
e:\Program Files\OpenLDAP\slapd.exe
E:\oracle\ora92\bin\omtsreco.exe
E:\oracle\ora92\bin\agntsrvc.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\Explorer.EXE
E:\oracle\ora92\BIN\TNSLSNR.exe
E:\oracle\ora92\bin\dbsnmp.exe
e:\oracle\ora92\bin\ORACLE.EXE
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\EasyPHP1-8\EasyPHP.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\FeedReader30\feedreader.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\PROGRA~1\EASYPH~1\Apache\apache.exe
C:\PROGRA~1\EASYPH~1\MySql\bin\mysqld.exe
C:\PROGRA~1\EASYPH~1\Apache\apache.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://intranet
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intranet
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://intranet
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL =

http://intranet/proxyft.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program

Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program

Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program

Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program

Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE

C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [IDManLoader] "C:\Documents and Settings\wenpa\Bureau\Internet Download

Manager\IDMan crack\idm v4.xx & v5.xx universal loader.exe" Auto
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [EasyPHP] "C:\Program Files\EasyPHP1-8\EasyPHP.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [feedreader.exe] "C:\Program Files\FeedReader30\feedreader.exe"
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"

-quiet
O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE

LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE

RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live

Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: SYSTRAN: &Effacer le cache de traduction - C:\Program

Files\Systran\Premium\menuClearCache.html
O8 - Extra context menu item: SYSTRAN: &Options - C:\Program

Files\Systran\Premium\menuConfigure.html
O8 - Extra context menu item: SYSTRAN: &Traduire - C:\Program

Files\Systran\Premium\menuTranslate.html
O8 - Extra context menu item: SYSTRAN: En&registrement - C:\Program

Files\Systran\Premium\menuRegister.html
O8 - Extra context menu item: SYSTRAN: Rechercher les &mises à jour - C:\Program

Files\Systran\Premium\menuUpdate.html
O8 - Extra context menu item: SYSTRAN: Traduire les &cadres - C:\Program

Files\Systran\Premium\menuTranslateAll.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://intranet
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program

Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = example.local
O17 - HKLM\Software\..\Telephony: DomainName = example.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = example.local
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program

Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program

Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program

Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation -

C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers

communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -

C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: OpenLDAP Directory Service (OpenLDAP-slapd) - Unknown owner - e:\Program

Files\OpenLDAP\slapd.exe
O23 - Service: OracleMTSRecoveryService - Oracle Corporation -

E:\oracle\ora92\bin\omtsreco.exe
O23 - Service: OracleOraHome92Agent - Oracle Corporation - E:\oracle\ora92\bin\agntsrvc.exe
O23 - Service: OracleOraHome92ClientCache - Unknown owner - E:\oracle\ora92\BIN\ONRSD.EXE
O23 - Service: OracleOraHome92ManagementServer - Unknown owner -

E:\oracle\ora92\bin\OMSNTsrv.exe
O23 - Service: OracleOraHome92PagingServer - Unknown owner -

E:\oracle\ora92/bin/pagntsrv.exe
O23 - Service: OracleOraHome92SNMPPeerEncapsulator - Unknown owner -

E:\oracle\ora92\BIN\ENCSVC.EXE
O23 - Service: OracleOraHome92SNMPPeerMasterAgent - Unknown owner -

E:\oracle\ora92\BIN\AGNTSVC.EXE
O23 - Service: OracleOraHome92TNSListener - Unknown owner - E:\oracle\ora92\BIN\TNSLSNR.exe
O23 - Service: OracleServiceORCL - Oracle Corporation - e:\oracle\ora92\bin\ORACLE.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec

AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation -

C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec

AntiVirus\Rtvscan.exe
O23 - Service: wampapache - Apache Software Foundation - C:\Program

Files\wamp\apache2\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - C:\Program Files\wamp\mysql\bin\mysqld-nt.exe

Poste un nouveau rapport HiJackThis stp :o)

http://www.commentcamarche.net/faq/sujet 825 windows xp afficher les extensions et les fichiers caches

=> la méthode simple ne fonctionne pas ?

Merci Pi_Xi pour ta prompte réaction.
J'ai exécuté les instructions que vous avez suggéré et voici le rapport généré par OTMoveIT:

C:\WINDOWS\system32\amvo.exe moved successfully.

Created on 12/27/2007 10:42:38


Cependant,les problèmes existent toujours c-a-d impossibilité d'afficher les fichiers cachés et ouverture d'une nouvelle fenêtre lorsqu'on double-clique sur un disque. J'ai même redémarré le PC.

Y' a-t-il autre chose que je pourrais essayer?
Merci d'avance.

Bonjour,

tu peux fixer les lignes:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - e:\Program Files\Free Download Manager\FUM\fumiebtn.dll(file missing)

Télécharge OTMoveIt (de Old_Timer) sur ton Bureau: http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe
Double-clique sur OTMoveIt.exe pour le lancer.
Copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

C:\WINDOWS\system32\amvo.exe

Clique sur MoveIt! pour lancer la suppression.
Le résultat apparaitra dans le cadre Results.
Clique sur Exit pour fermer.
Poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

Il te sera peut-être demandé de redémarrer le pc pour achever la suppression.
Si c'est le cas accepte par Yes.