Spyware

Résolu
mopnop -  
Bonjour, je suis infecté de spyware et plein de fenètre pop up s'ouvre sur mon bureau
aidez moi SVP.

PS: je suis nul en informatique alors répondez moi en conséquence merci
Configuration: Windows XP
Internet Explorer 7.0

28 réponses

Résumé de la discussion

Des symptômes de spyware et d'abondantes fenêtres contextuelles apparaissent sur Windows XP avec Internet Explorer 7, nécessitant une éradication et une vérification approfondie des programmes et des extensions installés. Plusieurs recommandations s'articulent autour d'un nettoyage en profondeur, notamment lancer Malwarebytes pour un scan complet, désinstaller Avast et AVG et installer un outil fiable, puis exploiter CCleaner pour supprimer les traces et corriger les erreurs. L'analyse des rapports générés par HijackThis et Malwarebytes aide à distinguer les éléments légitimes des détections malveillantes et évite les suppressions involontaires de composants critiques.

Bobot (l’IA à votre service)
  1. mopnop Auteur
    Bonjour,pour te donner des nouvelles de mon pc ça a l'air de fonctionner comme avant une seconde jeunesse. J'ai fait un scan minutieux avec avast qui m'a trouvé un cheval de troie que j'ai suprimer. Par contre je sais pas si c'est normal mais AVG antivirus me trouve des tracking cookies mais rien d'inquiétant si je les supprime. En tout cas je voulais te remercier de ton aide j serai jamais arriver tout seul mais aussi de ton dévoumment au forum car j'ai pu observer que ce n'est pas la première fois que tu résoult ce genre de problème. Merci a toi et bonne continuation ( enfin je dis ça mais je sais pas si la conversation est fini)
    1. mopnop Auteur
      Voila le rapport
      ->- Recherche:

      C:\HijackThis.exe: trouvé !
      C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: trouvé !
      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: trouvé !
      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: trouvé !
      C:\Documents and Settings\POMPON\Mes documents\ComboFix.exe: trouvé !
      C:\Program Files\Navilog1: trouvé !
      C:\Program Files\Navilog1\Navilog1.bat: trouvé !

      ---------------------------------
      -->- Suppression:

      C:\HijackThis.exe: supprimé !
      C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: supprimé !
      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: supprimé !
      C:\Documents and Settings\POMPON\Mes documents\ComboFix.exe: supprimé !
      C:\Program Files\Navilog1\Navilog1.bat: supprimé !
      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: supprimé !
      C:\Program Files\Navilog1: supprimé !
      Bonne nuit a toi
      1. gil le fantom
        c n'est pas pc cleaner que je t'ai demandé mais ccleaner
        http://www.commentcamarche.net/telecharger/telecharger 168 ccleaner
        tu peut garder avast pro si tu veux c qu"un consiel pour les gratuit

        pour supprimer les outils de desinfection tu Télécharge ToolsCleaner de A.Roshtein sur ton Bureau.(sur un des 2 liens)
        http://pagesperso-orange.fr/AceRothstein/ToolsCleaner2.exe
        http://a-rothstein.changelog.fr/TC/ToolsCleaner2.exe
        · Clique sur Recherche et laisse le scan se terminer.
        · Clique, sur Suppression pour finaliser.
        · Tu peux, si tu le souhaites, te servir des Options facultatives.
        · Clique sur Quitter, pour que le rapport puisse se créer.
        · Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).

        bonne nuit

        a+
        1. mopnop Auteur
          ça y est le scan de pc cleaner a été réaliser mais il me demande de détruire plusieurs fichier dont combofix. Est ce que cela ne sera pas mauvais pour mon pc??? Avast antivirus mon père l'a acheté 40 euros c'est le 4.8 professional donc faut il absolument que je le change???
          2. mopnop Auteur
            Dsl j'ai fais une erreur. Voila le rapport:
            ogfile of Trend Micro HijackThis v2.0.2
            Scan saved at 22:03:23, on 10/04/2008
            Platform: Windows XP SP2 (WinNT 5.01.2600)
            MSIE: Internet Explorer v7.00 (7.00.6000.16512)
            Boot mode: Normal

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
            C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            C:\Program Files\Alwil Software\Avast4\ashServ.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
            C:\Acer\Empowering Technology\admServ.exe
            C:\WINDOWS\RTHDCPL.EXE
            C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
            C:\Program Files\Acer\Acer Arcade\PCMService.exe
            C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
            C:\WINDOWS\system32\igfxtray.exe
            C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
            C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
            C:\WINDOWS\system32\hkcmd.exe
            C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
            C:\WINDOWS\system32\igfxpers.exe
            C:\Acer\Empowering Technology\eRecovery\Monitor.exe
            C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
            C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
            C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
            C:\Program Files\QuickTime\qttask.exe
            C:\Program Files\iTunes\iTunesHelper.exe
            C:\WINDOWS\system32\HPZipm12.exe
            C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
            C:\Program Files\Creative\Shared Files\CamTray.exe
            C:\Program Files\CyberLink\Shared Files\RichVideo.exe
            C:\Program Files\Skype\Phone\Skype.exe
            C:\WINDOWS\system32\svchost.exe
            C:\Program Files\Messenger\msmsgs.exe
            C:\WINDOWS\system32\ctfmon.exe
            C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
            C:\Program Files\Google\Google Updater\GoogleUpdater.exe
            C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
            C:\Program Files\iPod\bin\iPodService.exe
            C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
            C:\Program Files\MSN Messenger\msnmsgr.exe
            C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
            C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
            C:\WINDOWS\explorer.exe
            C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
            C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
            C:\Program Files\Internet Explorer\IEXPLORE.EXE
            C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
            C:\HijackThis.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
            R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
            R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
            O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
            O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
            O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
            O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
            O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
            O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
            O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
            O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
            O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
            O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
            O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
            O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
            O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
            O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
            O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
            O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
            O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
            O4 - HKLM\..\Run: [eRecoveryService] "C:\Acer\Empowering Technology\eRecovery\Monitor.exe"
            O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
            O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
            O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
            O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
            O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
            O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe"
            O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
            O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
            O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
            O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
            O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
            O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
            O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
            O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
            O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
            O4 - Global Startup: Noblesse VoIP.lnk = ?
            O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
            O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
            O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
            O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
            O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
            O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
            O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
            O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
            O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
            O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
            O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
            O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
            O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
            O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
            O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
            O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
            O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
            O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
            O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
            1. mopnop Auteur
              il me semble pas l'avoir oublier. Je réessaye et je recolle le rapport
              2. gil le fantom
                as tu bien fixe cette ligne
                O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

                ou as tu oublié
                1. mopnop Auteur
                  voila le rapport:
                  ogfile of Trend Micro HijackThis v2.0.2
                  Scan saved at 21:40:05, on 10/04/2008
                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                  MSIE: Internet Explorer v7.00 (7.00.6000.16512)
                  Boot mode: Normal

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                  C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                  C:\Program Files\Alwil Software\Avast4\ashServ.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                  C:\Acer\Empowering Technology\admServ.exe
                  C:\WINDOWS\RTHDCPL.EXE
                  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                  C:\Program Files\Acer\Acer Arcade\PCMService.exe
                  C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
                  C:\WINDOWS\system32\igfxtray.exe
                  C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
                  C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
                  C:\WINDOWS\system32\hkcmd.exe
                  C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                  C:\WINDOWS\system32\igfxpers.exe
                  C:\Acer\Empowering Technology\eRecovery\Monitor.exe
                  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                  C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                  C:\Program Files\QuickTime\qttask.exe
                  C:\Program Files\iTunes\iTunesHelper.exe
                  C:\WINDOWS\system32\HPZipm12.exe
                  C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                  C:\Program Files\Creative\Shared Files\CamTray.exe
                  C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                  C:\Program Files\Skype\Phone\Skype.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\Program Files\Messenger\msmsgs.exe
                  C:\WINDOWS\system32\ctfmon.exe
                  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                  C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                  C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
                  C:\Program Files\iPod\bin\iPodService.exe
                  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
                  C:\Program Files\MSN Messenger\msnmsgr.exe
                  C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
                  C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                  C:\WINDOWS\explorer.exe
                  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                  C:\Program Files\Internet Explorer\IEXPLORE.EXE
                  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                  C:\HijackThis.exe

                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                  O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
                  O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
                  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                  O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                  O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                  O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
                  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                  O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
                  O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
                  O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
                  O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
                  O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
                  O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
                  O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
                  O4 - HKLM\..\Run: [eRecoveryService] "C:\Acer\Empowering Technology\eRecovery\Monitor.exe"
                  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                  O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
                  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                  O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                  O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe"
                  O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
                  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                  O4 - Global Startup: Noblesse VoIP.lnk = ?
                  O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                  O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                  O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                  O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                  O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                  O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
                  O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
                  O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
                  O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
                  O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                  O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                  O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                  O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
                  O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                  1. gil le fantom
                    relance hijackthis
                    selectionne do a system scan only
                    et coches les lignes suivantes:

                    R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
                    O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
                    O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
                    O4 - HKLM\..\Run: [ZSScheduler] rundll32.exe "C:\Program Files\FBM Software\ZeroSpyware\zsscheduler.dll", runScheduler C:\Program Files\FBM Software\ZeroSpyware\
                    O4 - HKCU\..\Run: [oaebrkqi] C:\WINDOWS\system32\mpshojcx.exe

                    puis clic sur le bouton "Fix Checked"
                    puis tu me repost un rapport hijackthis.
                    1. mopnop Auteur
                      Concernant le pc la connexion internet est beaucoup plus rapide et les fenètres logiciel m'indiquant la présence de spyware ont totalement disparu. Merci beaucoup. Faudra peut ètre que je dise a mon frère de faire une défragmentation. PS: dsl pour les fautes d'orthographes
                      Voila le rapport:
                      Logfile of Trend Micro HijackThis v2.0.2
                      Scan saved at 20:47:03, on 10/04/2008
                      Platform: Windows XP SP2 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v7.00 (7.00.6000.16512)
                      Boot mode: Normal

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                      C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                      C:\Program Files\Alwil Software\Avast4\ashServ.exe
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                      C:\Acer\Empowering Technology\admServ.exe
                      C:\WINDOWS\RTHDCPL.EXE
                      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                      C:\Program Files\Acer\Acer Arcade\PCMService.exe
                      C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
                      C:\WINDOWS\system32\igfxtray.exe
                      C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
                      C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
                      C:\WINDOWS\system32\hkcmd.exe
                      C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                      C:\WINDOWS\system32\igfxpers.exe
                      C:\Acer\Empowering Technology\eRecovery\Monitor.exe
                      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                      C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                      C:\Program Files\QuickTime\qttask.exe
                      C:\Program Files\iTunes\iTunesHelper.exe
                      C:\WINDOWS\system32\HPZipm12.exe
                      C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                      C:\Program Files\Creative\Shared Files\CamTray.exe
                      C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                      C:\Program Files\Skype\Phone\Skype.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\Program Files\Messenger\msmsgs.exe
                      C:\WINDOWS\system32\ctfmon.exe
                      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                      C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                      C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
                      C:\Program Files\iPod\bin\iPodService.exe
                      C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
                      C:\Program Files\MSN Messenger\msnmsgr.exe
                      C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
                      C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                      C:\WINDOWS\explorer.exe
                      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                      C:\Program Files\Internet Explorer\IEXPLORE.EXE
                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                      C:\Program Files\Windows Live Toolbar\msn_sl.exe
                      C:\HijackThis.exe

                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
                      O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
                      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                      O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
                      O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                      O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
                      O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                      O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                      O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
                      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                      O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
                      O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                      O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
                      O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
                      O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
                      O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
                      O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
                      O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
                      O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
                      O4 - HKLM\..\Run: [eRecoveryService] "C:\Acer\Empowering Technology\eRecovery\Monitor.exe"
                      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                      O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
                      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                      O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                      O4 - HKLM\..\Run: [ZSScheduler] rundll32.exe "C:\Program Files\FBM Software\ZeroSpyware\zsscheduler.dll", runScheduler C:\Program Files\FBM Software\ZeroSpyware\
                      O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe"
                      O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
                      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                      O4 - HKCU\..\Run: [oaebrkqi] C:\WINDOWS\system32\mpshojcx.exe
                      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                      O4 - Global Startup: Noblesse VoIP.lnk = ?
                      O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                      O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                      O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                      O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                      O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
                      O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
                      O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
                      O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
                      O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                      O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                      O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                      O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                      O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
                      O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                      1. gil le fantom
                        bon travail
                        poste un nouveau rapport hijackthis stp

                        et dis moi comment va ton pc ?
                        1. mopnop Auteur
                          Voila le rapport:
                          omboFix 08-04-09.9 - POMPON 2008-04-10 20:31:16.1 - [color=red][b]FAT32[/b][/color]x86
                          Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.509 [GMT 2:00]
                          Endroit: C:\Documents and Settings\POMPON\Bureau\ComboFix.exe
                          * Création d'un nouveau point de restauration

                          [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
                          .

                          (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                          .

                          C:\Documents and Settings\POMPON\Bureaublackbird.jpg
                          C:\Documents and Settings\POMPON\BureauEditorFKWP1.5.exe
                          C:\Documents and Settings\POMPON\BureauEditorFKWP2.0.exe
                          C:\Documents and Settings\POMPON\Bureaufilemanagerclient.exe
                          C:\Documents and Settings\POMPON\Bureaufkwp1.5.exe
                          C:\Documents and Settings\POMPON\Bureaufkwp2.0.exe
                          C:\Documents and Settings\POMPON\Bureaufwebd.exe
                          C:\Documents and Settings\POMPON\BureauFWebdEditor.exe
                          C:\Documents and Settings\POMPON\BureauTrojan.Win32.BlackBird.exe
                          C:\Documents and Settings\POMPON\Bureauvirii
                          C:\WINDOWS\a.bat
                          C:\WINDOWS\system32\drivers\down
                          C:\WINDOWS\system32\packet.dll
                          C:\WINDOWS\system32\pthreadVC.dll
                          C:\WINDOWS\system32\WanPacket.dll
                          C:\WINDOWS\system32\wpcap.dll
                          C:\WINDOWS\system32akttzn.exe
                          C:\WINDOWS\system32anticipator.dll
                          C:\WINDOWS\system32awtoolb.dll
                          C:\WINDOWS\system32bdn.com
                          C:\WINDOWS\system32bsva-egihsg52.exe
                          C:\WINDOWS\system32dpcproxy.exe
                          C:\WINDOWS\system32emesx.dll
                          C:\WINDOWS\system32h@tkeysh@@k.dll
                          C:\WINDOWS\system32hoproxy.dll
                          C:\WINDOWS\system32hxiwlgpm.dat
                          C:\WINDOWS\system32hxiwlgpm.exe
                          C:\WINDOWS\system32medup012.dll
                          C:\WINDOWS\system32medup020.dll
                          C:\WINDOWS\system32msgp.exe
                          C:\WINDOWS\system32msnbho.dll
                          C:\WINDOWS\system32mssecu.exe
                          C:\WINDOWS\system32msvchost.exe
                          C:\WINDOWS\system32mtr2.exe
                          C:\WINDOWS\system32mwin32.exe
                          C:\WINDOWS\system32netode.exe
                          C:\WINDOWS\system32newsd32.exe
                          C:\WINDOWS\system32ps1.exe
                          C:\WINDOWS\system32psof1.exe
                          C:\WINDOWS\system32psoft1.exe
                          C:\WINDOWS\system32regc64.dll
                          C:\WINDOWS\system32regm64.dll
                          C:\WINDOWS\system32Rundl1.exe
                          C:\WINDOWS\system32sncntr.exe
                          C:\WINDOWS\system32ssurf022.dll
                          C:\WINDOWS\system32ssvchost.com
                          C:\WINDOWS\system32ssvchost.exe
                          C:\WINDOWS\system32sysreq.exe
                          C:\WINDOWS\system32taack.dat
                          C:\WINDOWS\system32taack.exe
                          C:\WINDOWS\system32temp#01.exe
                          C:\WINDOWS\system32thun.dll
                          C:\WINDOWS\system32thun32.dll
                          C:\WINDOWS\system32VBIEWER.OCX
                          C:\WINDOWS\system32vbsys2.dll
                          C:\WINDOWS\system32vcatchpi.dll
                          C:\WINDOWS\system32winlogonpc.exe
                          C:\WINDOWS\system32winsystem.exe
                          C:\WINDOWS\system32WINWGPX.EXE

                          .
                          ((((((((((((((((((((((((((((( Fichiers créés 2008-03-10 to 2008-04-10 ))))))))))))))))))))))))))))))))))))
                          .

                          2008-04-10 20:11 . 2008-04-10 20:11 <REP> d-------- C:\ComboFix[1]
                          2008-04-09 21:48 . 2008-04-09 21:48 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                          2008-04-09 21:48 . 2008-04-09 21:48 <REP> d-------- C:\Documents and Settings\POMPON\Application Data\Malwarebytes
                          2008-04-09 21:48 . 2008-04-09 21:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                          2008-04-09 21:23 . 2008-04-09 21:23 <REP> d-------- C:\Program Files\Navilog1
                          2008-04-09 19:12 . 2008-04-09 19:12 396,288 --a------ C:\HijackThis.exe
                          2008-04-04 13:02 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys
                          2008-04-04 13:02 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys
                          2008-04-02 18:09 . 2008-04-02 18:09 3,120 --a------ C:\WINDOWS\system32\118290.54
                          2008-04-02 18:09 . 2008-04-02 18:09 3,120 --a------ C:\WINDOWS\118294.78
                          2008-04-02 18:06 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\system32\Machnm1.exe
                          2008-04-02 18:06 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\system32\Machnm64.sys
                          2008-04-02 18:06 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\system32\Machnm32.sys
                          2008-04-02 08:26 . 2008-04-02 08:26 <REP> d--hs---- C:\FOUND.023
                          2008-03-31 11:18 . 2008-03-31 11:18 <REP> d--hs---- C:\FOUND.022
                          2008-03-29 11:23 . 2008-03-29 12:52 131,072 --a------ C:\WINDOWS\system32\datestamp.dll
                          2008-03-28 22:28 . 2008-03-28 22:28 <REP> d--hs---- C:\FOUND.021
                          2008-03-28 19:49 . 2008-03-28 19:49 <REP> d-------- C:\WINDOWS\system32\autorun
                          2008-03-28 17:48 . 2008-03-28 17:48 <REP> d-------- C:\Program Files\Fichiers communs\Symantec Shared
                          2008-03-28 17:48 . 2008-03-28 17:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Symantec
                          2008-03-28 17:45 . 2008-03-29 09:18 6 --a------ C:\ISACER.ID
                          2008-03-27 22:59 . 2008-03-27 22:59 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
                          2008-03-27 22:05 . 2008-03-27 22:05 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Arovax
                          2008-03-27 22:04 . 2008-03-27 22:04 <REP> d-------- C:\Documents and Settings\POMPON\Application Data\GetRightToGo
                          2008-03-27 21:16 . 2008-03-27 21:16 <REP> d-------- C:\Program Files\Lavasoft
                          2008-03-27 21:06 . 2008-03-27 21:06 <REP> d-------- C:\Program Files\AskSBar
                          2008-03-27 20:40 . 2008-03-27 20:40 164 --a------ C:\install.dat
                          2008-03-27 20:29 . 2008-03-27 20:29 <REP> d-------- C:\WINDOWS\My Hidden Folders
                          2008-03-27 20:29 . 2008-03-27 20:29 <REP> d-------- C:\Program Files\My Hidden Folders
                          2008-03-27 20:29 . 2008-03-27 20:29 22,304 --a------ C:\WINDOWS\system32\drivers\HMFAxCore0ad0c39557b13aeb3585f857b85005af.sys
                          2008-03-27 20:29 . 2008-03-27 20:32 187 --a------ C:\WINDOWS\hlistHMFAxCore0ad0c39557b13aeb3585f857b85005af
                          2008-03-27 20:29 . 2008-03-27 20:29 0 --a------ C:\WINDOWS\wlistHMFAxCore0ad0c39557b13aeb3585f857b85005af
                          2008-03-27 20:28 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
                          2008-03-27 14:00 . 2008-03-27 14:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
                          2008-03-26 17:40 . 2008-03-26 17:40 <REP> d-------- C:\Documents and Settings\POMPON\Application Data\Grisoft
                          2008-03-26 17:39 . 2008-03-26 17:39 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
                          2008-03-26 17:39 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
                          2008-03-26 16:36 . 2008-03-26 16:36 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
                          2008-03-25 14:35 . 2008-03-25 14:35 <REP> d-------- C:\Documents and Settings\All Users\Application Data\qhedsfyn
                          2008-03-22 09:58 . 2008-03-22 09:58 <REP> d--hs---- C:\FOUND.020

                          .
                          (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                          .
                          2008-03-29 17:45 1,146,232 ----a-w C:\WINDOWS\system32\aswBoot.exe
                          2008-03-29 17:35 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
                          2008-03-29 17:29 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
                          2008-03-29 17:27 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
                          2008-03-29 17:26 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
                          2008-03-29 17:23 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
                          2008-03-09 16:42 --------- d-----w C:\Documents and Settings\POMPON\Application Data\dvdcss
                          2007-01-13 11:56 9,453,630 ----a-w C:\Program Files\vlc-0.8.6a-win32.exe
                          2006-07-26 13:34 0 ----a-w C:\Documents and Settings\POMPON\Application Data\wklnhst.dat
                          .

                          ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                          .
                          .
                          REGEDIT4
                          *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

                          [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
                          2008-03-27 21:06 66912 --a------ C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

                          [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
                          2008-03-27 21:06 267592 --a------ C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL

                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
                          "{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= "C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL" [2008-03-27 21:06 267592]

                          [HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

                          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
                          "{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL [2008-03-27 21:06 267592]

                          [HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

                          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                          "Creative WebCam Tray"="C:\Program Files\Creative\Shared Files\CamTray.exe" [2005-10-27 20:00 299008]
                          "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-07-06 18:53 20034600]
                          "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
                          "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 05:00 15360]
                          "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2006-07-04 10:02 659456]
                          "oaebrkqi"="C:\WINDOWS\system32\mpshojcx.exe" [ ]

                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                          "RTHDCPL"="RTHDCPL.EXE" [2005-12-19 14:52 15797248 C:\WINDOWS\RTHDCPL.exe]
                          "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-07-20 15:05 729177]
                          "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 05:00 208952]
                          "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 05:00 59392]
                          "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 05:00 455168]
                          "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 05:00 455168]
                          "PCMService"="C:\Program Files\Acer\Acer Arcade\PCMService.exe" [2005-12-13 21:31 151552]
                          "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-11-28 13:55 98304]
                          "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-11-28 13:52 77824]
                          "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-11-28 13:55 118784]
                          "eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\Monitor.exe" [2006-01-24 18:00 397312]
                          "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
                          "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152]
                          "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41 282624]
                          "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51 257088]
                          "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
                          "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
                          "ZSScheduler"="C:\Program Files\FBM Software\ZeroSpyware\zsscheduler.dll" [ ]

                          [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                          "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 05:00 15360]

                          C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                          HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26 282624]
                          Noblesse VoIP.lnk - C:\WINDOWS\Installer\{869982E6-334F-41E7-8D3F-0A8D99B213E8}\_644366bb.exe [2007-08-07 14:09:15 24542]
                          Outil de mise … jour Google.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-09-02 10:36:16 126136]

                          [HKEY_LOCAL_MACHINE\software\microsoft\security center]
                          "AntiVirusDisableNotify"=dword:00000001

                          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                          "%windir%\\system32\\sessmgr.exe"=
                          "C:\\Program Files\\Acer\\Acer Arcade\\PCMService.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
                          "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
                          "C:\\Program Files\\Messenger\\MSMSGS.EXE"=
                          "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                          "C:\\Program Files\\VideoLAN\\VLC\\VLC.EXE"=
                          "C:\\Program Files\\eMule\\emule.exe"=
                          "C:\\Program Files\\iTunes\\iTunes.exe"=
                          "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
                          "C:\\Program Files\\MSN Messenger\\livecall.exe"=
                          "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

                          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                          "2460:UDP"= 2460:UDP:Windows Media Format SDK (iexplore.exe)
                          "2461:UDP"= 2461:UDP:Windows Media Format SDK (iexplore.exe)

                          R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
                          R1 HMFAxCore0ad0c39557b13aeb3585f857b85005af;HMFAxCore0ad0c39557b13aeb3585f857b85005af;C:\WINDOWS\system32\drivers\HMFAxCore0ad0c39557b13aeb3585f857b85005af.sys [2008-03-27 20:29]
                          R1 OsaFsLoc;OsaFsLoc;C:\WINDOWS\system32\drivers\OsaFsLoc.sys [2005-10-15 18:20]
                          R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
                          R2 EpmPsd;Acer EPM Power Scheme Driver;C:\WINDOWS\system32\drivers\epm-psd.sys [2005-04-22 16:57]
                          R2 EpmShd;Acer EPM System Hardware Driver;C:\WINDOWS\system32\drivers\epm-shd.sys [2005-04-22 16:57]
                          R2 int15.sys;int15.sys;C:\Acer\Empowering Technology\eRecovery\int15.sys [2005-01-13 14:46]
                          R2 osaio;osaio;C:\WINDOWS\system32\drivers\osaio.sys [2005-06-30 16:58]
                          R2 osanbm;osanbm;C:\WINDOWS\system32\drivers\osanbm.sys [2005-01-14 15:57]
                          R3 BulkUsb;VoIPUSBDriver.sys;C:\WINDOWS\system32\Drivers\VoIPUSBDriver.sys [2005-09-16 16:14]
                          R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
                          S3 NdisFilt;OSA NdisFilter Protocol;C:\WINDOWS\system32\Drivers\NdisFilt.sys [2005-09-13 15:34]
                          S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-05 05:00]

                          *Newly Created Service* - INT15.SYS
                          .
                          **************************************************************************

                          catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                          Rootkit scan 2008-04-10 20:32:59
                          Windows 5.1.2600 Service Pack 2 FAT NTAPI

                          Balayage processus cachés ...

                          Balayage caché autostart entries ...

                          Balayage des fichiers cachés ...

                          Scan terminé avec succès
                          Les fichiers cachés: 0

                          **************************************************************************
                          .
                          Temps d'accomplissement: 2008-04-10 20:33:19
                          ComboFix-quarantined-files.txt 2008-04-10 18:33:16
                          Pre-Run: 17,454,170,112 octets libres
                          Post-Run: 17,590,583,296 octets libres
                          .
                          2007-08-15 18:25:58 --- E O F ---
                          1. gil le fantom
                            non
                            tu desactive avast et avg antispyware(si tu es à un bouclier résident)
                            1. mopnop Auteur
                              Excuse moi pour ma nullité en informatique mais désactiver la protection réelle cela veut dire désactiver les mises a jour auto et les placer en manuelle????
                              2. mopnop Auteur
                                j'ai un problème spyware doctor (version limité) bloque le téléchargement du fichier il le considère comme un trojan bancos faut il supprimmer spyware doctor ?????
                                1. gil le fantom
                                  bonjour

                                  tu télécharge ComboFix :

                                  http://download.bleepingcomputer.com/sUBs/ComboFix.exe

                                  Tuto : https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic

                                  tu enregistre le sur le bureau.

                                  Avant d'utiliser ComboFix :

                                  tu déconnecte internet et referme les fenêtres de tous les programmes en cours.

                                  tu désactive provisoirement la protection en temps réel de ton Antivirus et de tes Antispywares.


                                  sur ton bureau tu double-clic sur Combofix.exe.

                                  tu répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

                                  Pendant la durée de cette étape,tu ne te sert pas du pc et n'ouvre aucun programmes.

                                  - En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

                                  - Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

                                  tu réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

                                  tu reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt .
                                  1. mopnop Auteur
                                    Quand vous parlez de nettoyer c'est supprimer ou mettre en quarantaine????
                                    voila le rapport hijakthis en sachant que j'ai mis ce qu'a découvert Malwarebytes en quarantaine:
                                    ogfile of Trend Micro HijackThis v2.0.2
                                    Scan saved at 00:11:51, on 10/04/2008
                                    Platform: Windows XP SP2 (WinNT 5.01.2600)
                                    MSIE: Internet Explorer v7.00 (7.00.6000.16512)
                                    Boot mode: Normal

                                    Running processes:
                                    C:\WINDOWS\System32\smss.exe
                                    C:\WINDOWS\system32\csrss.exe
                                    C:\WINDOWS\system32\winlogon.exe
                                    C:\WINDOWS\system32\services.exe
                                    C:\WINDOWS\system32\lsass.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\WINDOWS\System32\svchost.exe
                                    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                                    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                                    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                    C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                    C:\WINDOWS\Explorer.EXE
                                    C:\WINDOWS\system32\spoolsv.exe
                                    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                                    C:\Acer\Empowering Technology\admServ.exe
                                    C:\WINDOWS\RTHDCPL.EXE
                                    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                                    C:\Program Files\Acer\Acer Arcade\PCMService.exe
                                    C:\WINDOWS\system32\igfxtray.exe
                                    C:\WINDOWS\system32\hkcmd.exe
                                    C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
                                    C:\WINDOWS\system32\igfxpers.exe
                                    C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
                                    C:\Acer\Empowering Technology\eRecovery\Monitor.exe
                                    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                    C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
                                    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                                    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                    C:\Program Files\QuickTime\qttask.exe
                                    C:\Program Files\iTunes\iTunesHelper.exe
                                    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
                                    C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                                    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                                    C:\Program Files\Spyware Doctor\pctsTray.exe
                                    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                                    C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                                    C:\Program Files\Spyware Doctor\pctsAuxs.exe
                                    C:\Program Files\Creative\Shared Files\CamTray.exe
                                    C:\Program Files\Spyware Doctor\pctsSvc.exe
                                    C:\Program Files\Skype\Phone\Skype.exe
                                    C:\Program Files\Messenger\msmsgs.exe
                                    C:\WINDOWS\system32\ctfmon.exe
                                    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
                                    C:\Program Files\TE Group\Noblesse VoIP\Noblesse VOIP 2.0.exe
                                    C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                                    C:\WINDOWS\system32\wbem\wmiprvse.exe
                                    C:\DOCUME~1\POMPON\LOCALS~1\Temp\RtkBtMnt.exe
                                    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
                                    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                    C:\Program Files\iPod\bin\iPodService.exe
                                    C:\WINDOWS\System32\alg.exe
                                    C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
                                    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
                                    C:\HijackThis.exe

                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                                    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                    R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
                                    O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
                                    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                                    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                                    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
                                    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                                    O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
                                    O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                                    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                                    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                                    O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
                                    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                                    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
                                    O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
                                    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                                    O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
                                    O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
                                    O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
                                    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
                                    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
                                    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
                                    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
                                    O4 - HKLM\..\Run: [eRecoveryService] "C:\Acer\Empowering Technology\eRecovery\Monitor.exe"
                                    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
                                    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                                    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                                    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                                    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                                    O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
                                    O4 - HKLM\..\Run: [ZSScheduler] rundll32.exe "C:\Program Files\FBM Software\ZeroSpyware\zsscheduler.dll", runScheduler C:\Program Files\FBM Software\ZeroSpyware\
                                    O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe"
                                    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
                                    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                                    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                                    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                                    O4 - HKCU\..\Run: [oaebrkqi] C:\WINDOWS\system32\mpshojcx.exe
                                    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                                    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                                    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                                    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                                    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                    O4 - Global Startup: Noblesse VoIP.lnk = ?
                                    O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                                    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                                    O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                                    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                                    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                                    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                                    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                                    O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
                                    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
                                    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
                                    O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
                                    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                                    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                    O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                                    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                                    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                                    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                                    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
                                    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                                    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
                                    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
                                    1. gil le fantom
                                      tu nettoie tout c qu'a trouvé malwarebytes
                                      et tu me post un nouveau rapport hijackthis

                                      a demain

                                      bonne nuit
                                      • 1
                                      • 2