Ordi infecté => critical system error!

Résolu
moma3 -  
bonjour à tous, depuis hier j'ai un petit probleme, en fait dans la barre des taches il y a une petite croix jaune dans un cercle bleu et un point d'interrogation jaune qui clignottent. toutes les minutes, une bulle apparait avec un texte écrit en anglais me disant que mon ordi est infecté et qu'il faut que je le scann sinon il risque d'y avoir des problemes, c'est ce que j'ai fais, déja avec des antispyware (spybot, l'antispyware de secuitoo) et avec mon antivirus mais ça n'a pas résolu mon probleme.Donc je sais pas trop si c'est un spyware ou un virus mais pouvez-vous m'aider s'il-vous-plaît ???
merci d'avance

19 réponses

  1.  green day Modérateur
    Salut

    # Télécharge ceci: (merci a S!RI pour ce petit programme).

    http://siri.urz.free.fr/Fix/SmitfraudFix.zip

    Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1,
    voila a quoi cela ressemble : http://siri.urz.free.fr/Fix/SmitfraudFix.php
    il va générer un rapport : copie/colle le sur le poste stp.

    ++

    **La volonté trouve, la liberté choisit. Trouver et choisir, c'est penser ( V.Hugo) **
    0
    1. moma3 Auteur
      merci de m'avoir répondu, voila le rapport :
      SmitFraudFix v2.112

      Rapport fait à 18:39:09,73, 20/10/2006
      Executé à partir de C:\Documents and Settings\Christian_2\Mes documents\logiciels\SmitfraudFix
      OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
      Fix executé en mode normal

      »»»»»»»»»»»»»»»»»»»»»»»» C:\

      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

      C:\WINDOWS\system32\dpfwu.dll PRESENT !
      C:\WINDOWS\system32\1024\ PRESENT !

      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Christian_2

      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Christian_2\Application Data

      »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

      C:\DOCUME~1\ALLUSE~1\MENUDM~1\Online Security Guide.url PRESENT !
      C:\DOCUME~1\ALLUSE~1\MENUDM~1\Security Troubleshooting.url PRESENT !

      »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CHRIST~2\Favoris

      »»»»»»»»»»»»»»»»»»»»»»»» Bureau

      »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

      C:\Program Files\VideoCompressionCodec\ PRESENT !
      C:\Program Files\VirusBurster\ PRESENT !

      »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

      »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
      "Source"="About:Home"
      "SubscribedURL"="About:Home"
      0
      1. green day Modérateur
        ok,

        # Démarre en mode sans échec :
        Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
        Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
        Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
        (Si F8 ne marche pas utilise la touche F5).
        ----------------------------------------------------------------------------
        # Relance le programme Smitfraud :
        Cette fois choisit l’option 2, répond oui a tous ;
        Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forum

        ensuite :

        Télécharge ceci :

        Lien : hijackthis

        Démo : http://pageperso.aol.fr/balltrap34/demohijack.htm

        Choisir l'option "do a scan and a logfile", et faire un copier/coller du rapport ainsi générer sur le forum.

        ++

        0
        1. moma3 Auteur
          rapport de smitfraud:

          SmitFraudFix v2.112

          Rapport fait à 18:50:25,14, 20/10/2006
          Executé à partir de C:\Documents and Settings\Christian_2\Mes documents\logiciels\SmitfraudFix
          OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
          Fix executé en mode sans echec

          »»»»»»»»»»»»»»»»»»»»»»»» Avant SmitFraudFix
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          SrchSTS.exe by S!Ri
          Search SharedTaskScheduler's .dll

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
          "{dfa61db1-388e-4c87-8d56-540fa229bcb4}"="contrabandists"

          [HKEY_CLASSES_ROOT\CLSID\{dfa61db1-388e-4c87-8d56-540fa229bcb4}\InProcServer32]
          @="C:\WINDOWS\System32\dpfwu.dll"

          [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{dfa61db1-388e-4c87-8d56-540fa229bcb4}\InProcServer32]
          @="C:\WINDOWS\System32\dpfwu.dll"

          »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

          »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

          GenericRenosFix by S!Ri

          C:\WINDOWS\System32\dpfwu.dll -> Hoax.Win32.Renos.gen.d
          C:\WINDOWS\System32\dpfwu.dll -> Deleted

          »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

          C:\WINDOWS\system32\1024\ supprimé
          C:\DOCUME~1\ALLUSE~1\MENUDM~1\Online Security Guide.url supprimé
          C:\DOCUME~1\ALLUSE~1\MENUDM~1\Security Troubleshooting.url supprimé
          C:\Program Files\VideoCompressionCodec\ supprimé
          C:\Program Files\VirusBurster\ supprimé

          »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

          »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

          Nettoyage terminé.

          »»»»»»»»»»»»»»»»»»»»»»»» Après SmitFraudFix
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          SrchSTS.exe by S!Ri
          Search SharedTaskScheduler's .dll

          »»»»»»»»»»»»»»»»»»»»»»»» Fin

          rapport d'hijackthis:

          Logfile of HijackThis v1.99.1
          Scan saved at 19:03:39, on 20/10/2006
          Platform: Windows XP SP1 (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\System32\Ati2evxx.exe
          C:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXE
          C:\WINDOWS\System32\drivers\CDAC11BA.EXE
          C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
          C:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXE
          C:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exe
          C:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exe
          C:\Program Files\Securitoo\av_fw\backweb\1044199\Program\BackWeb-1044199.exe
          C:\WINDOWS\System32\FTRTSVC.exe
          C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
          C:\Program Files\Securitoo\av_fw\Common\FSMB32.EXE
          C:\Program Files\Securitoo\av_fw\Common\FCH32.EXE
          C:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXE
          C:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exe
          C:\WINDOWS\SOUNDMAN.EXE
          C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
          C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
          C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
          C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
          C:\PROGRA~1\MESSAG~1\StartMessager.exe
          C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
          C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE
          C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
          C:\Program Files\QuickTime Alternative\qttask.exe
          C:\Program Files\iTunes\iTunesHelper.exe
          C:\WINDOWS\System32\ctfmon.exe
          C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
          C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
          C:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exe
          C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
          C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
          C:\Program Files\WiFiConnector\NintendoWFCReg.exe
          C:\Program Files\iPod\bin\iPodService.exe
          C:\PROGRA~1\Wanadoo\ComComp.exe
          C:\PROGRA~1\Wanadoo\Toaster.exe
          C:\PROGRA~1\Wanadoo\Inactivity.exe
          C:\PROGRA~1\Wanadoo\PollingModule.exe
          C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
          C:\PROGRA~1\Wanadoo\Watch.exe
          C:\WINDOWS\System32\wuauclt.exe
          C:\WINDOWS\System32\wuauclt.exe
          C:\Program Files\Mozilla Firefox\firefox.exe
          C:\Documents and Settings\Christian_2\Mes documents\logiciels\HijackThis.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
          O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
          O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
          O2 - BHO: (no name) - {7b4d79df-9ef0-429d-a0e9-d9b138c6a53b} - C:\Program Files\VideoCompressionCodec\isaddon.dll (file missing)
          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
          O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
          O3 - Toolbar: Protection Bar - {8aed5df3-6e0b-4930-b1a5-f8aa8d757497} - C:\Program Files\VideoCompressionCodec\iesplugin.dll (file missing)
          O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
          O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
          O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
          O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
          O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
          O4 - HKLM\..\Run: [MessagerStarter Wanadoo] C:\PROGRA~1\MESSAG~1\StartMessager.exe Messager Wanadoo
          O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
          O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
          O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
          O4 - HKLM\..\Run: [FSASWREG] "C:\Program Files\Securitoo\Av_Fw\Anti-Spyware\fsaswreg.exe"
          O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splash
          O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL
          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
          O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
          O4 - HKLM\..\Run: [uwa6pcw] "C:\Program Files\WinAntiVirus Pro 2006\uwa6pcw.exe" -c
          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
          O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe GestionnaireInternet.exe
          O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
          O4 - Global Startup: Image Transfer.lnk = ?
          O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
          O4 - Global Startup: Lancer l'utilitaire d'enregistrement.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
          O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
          O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
          O8 - Extra context menu item: Save Flash by &GetFlash - C:\PROGRA~1\GetFlash\getflash.htm
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
          O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
          O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
          O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
          O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
          O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binFrameWork/v10/StagingUI.cab34120.cab
          O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
          O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
          O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
          O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
          O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/BinFrameWork/v10/ZBuddy.cab32846.cab
          O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
          O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/081e35c02e2a11fe0e19/netzip/RdxIE601_fr.cab
          O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binframework/v10/ZPAChat.cab32846.cab
          O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
          O16 - DPF: {71DA2A4E-ACB3-4065-9E41-8BC42EABE427} - http://scripts.dlv4.com/binaries/IA/svcia32_FR_XP.cab
          O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - a840.g.akamai.net
          O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
          O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
          O16 - DPF: {A13516A3-BE86-4517-813C-B5FF0C8ACDF3} (Toontown Installer ActiveX Control French) - http://idownload.french.toontown.com/sv1.5.8.16/ttinst-french.cab
          O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
          O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binFramework/v10/ZIntro.cab34246.cab
          O16 - DPF: {BCF9A64D-1440-4404-863C-F5DF2B99F798} (Catan Online Game) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/bingame/zpagames/zpa_catan.cab35906.cab
          O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
          O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binframework/v10/StProxy.cab35645.cab
          O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/zone/datafiles/heartbeat.cab
          O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
          O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
          O17 - HKLM\System\CCS\Services\Tcpip\..\{DF525BD0-4B2F-4D8E-8B39-247E5B4C54D1}: NameServer = 80.10.246.1 80.10.246.132
          O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
          O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
          O21 - SSODL: contrabandists - {dfa61db1-388e-4c87-8d56-540fa229bcb4} - C:\WINDOWS\System32\dpfwu.dll (file missing)
          O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
          O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
          O23 - Service: Securitoo AntiVirus Firewall (BackWeb Client - 1044199) - Unknown owner - C:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXE
          O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
          O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
          O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
          O23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\Securitoo\av_fw\Common\FSAA.EXE (file missing)
          O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exe
          O23 - Service: F-Secure Distributed Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exe
          O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
          O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\fswsclds.exe
          O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
          O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
          O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
          0
          2. green day Modérateur
            re

            Relance HijackThis : choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked" :

            O2 - BHO: (no name) - {7b4d79df-9ef0-429d-a0e9-d9b138c6a53b} - C:\Program Files\VideoCompressionCodec\isaddon.dll (file missing)

            O3 - Toolbar: Protection Bar - {8aed5df3-6e0b-4930-b1a5-f8aa8d757497} - C:\Program Files\VideoCompressionCodec\iesplugin.dll (file missing)

            O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
            O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
            O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
            O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
            O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
            O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
            O4 - HKLM\..\Run: [uwa6pcw] "C:\Program Files\WinAntiVirus Pro 2006\uwa6pcw.exe" -c
            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
            O4 - Global Startup: Image Transfer.lnk = ?
            O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
            O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

            ( toutes les 016 )
            O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
            O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binFrameWork/v10/StagingUI.cab34120.cab
            O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
            O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
            O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
            O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
            O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/BinFrameWork/v10/ZBuddy.cab32846.cab
            O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
            O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/081e35c02e2a11fe0e19/netzip/RdxIE601_fr.cab
            O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binframework/v10/ZPAChat.cab32846.cab
            O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
            O16 - DPF: {71DA2A4E-ACB3-4065-9E41-8BC42EABE427} - http://scripts.dlv4.com/binaries/IA/svcia32_FR_XP.cab
            O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - a840.g.akamai.net
            O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
            O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
            O16 - DPF: {A13516A3-BE86-4517-813C-B5FF0C8ACDF3} (Toontown Installer ActiveX Control French) - http://idownload.french.toontown.com/sv1.5.8.16/ttinst-french.cab
            O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
            O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binFramework/v10/ZIntro.cab34246.cab
            O16 - DPF: {BCF9A64D-1440-4404-863C-F5DF2B99F798} (Catan Online Game) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/bingame/zpagames/zpa_catan.cab35906.cab
            O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
            O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binframework/v10/StProxy.cab35645.cab
            O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/zone/datafiles/heartbeat.cab
            O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
            O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab

            O21 - SSODL: contrabandists - {dfa61db1-388e-4c87-8d56-540fa229bcb4} - C:\WINDOWS\System32\dpfwu.dll (file missing)

            O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

            ==> Cliques sur :

            demarrer < executer < tapes " services.msc"

            cherches dans la liste cette ligne et regles la sur "desactivé"

            France Telecom Routing Table Service

            # ensuite :

            cherche et supprime le dossier en gras :

            C:\Program Files\WinAntiVirus Pro 2006\uwa6pcw.exe

            => va dans ajout/supprimer un programme ( panneau de configuration ), et vire le programme su même nom

            # télécharge ceci et execute les :

            CleanUp40 (qui élimine les fichiers temporaires + cookies : gratuit )
            http://pageperso.aol.fr/Balltrap34/CleanUp40.exe

            tuto : (merci à Balltrap) http://pageperso.aol.fr/balltrap34/democleanup.htm

            mets tout à jour,lance les scans en mode sans echec : pour cela redemarre en appuillant sur le touche F8 ou F5

            # Ccleaner : Telecharge et installe ceci, dans la colonne de gauche clique sur "erreurs" coche toute les cases, puis clique en bas sur "chercher des erreurs" une fois finit, clique sur "reparer les erreurs" et tu aura un message pour sauvegarder ta base de registre tu dis "oui" puis tu recommences jusqu'a ce qu'il te trouve plus d'erreurs .

            *Relance Ccleaner ,vas dans l'onglet "nettoyeur" present sur la gauche, decoche la derniere case (Avancé si elle
            est cochée) puis clique sur "lancer le nettoyage"

            ccleaner

            tuto: https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php

            # et enfin :

            scan en ligne : colle rapport entier ( s’il y a quelque chose) :

            http://www.bitdefender.fr/bd/site/search.php#

            ++

            **La volonté trouve, la liberté choisit. Trouver et choisir, c'est penser ( V.Hugo) **
            0
            1. moma3 Auteur
              Voila c'est fait, j'ai fais tous les scans sauf bitdefender qui allait durer 8h00 !! mais sinon, il n'y a plus de problemes, je n'ai plus cette icone dans la barre des taches, donc tout va bien je te remercie de m'avoir aidé !
              Donc bonne soirée et encore merci !
              0
              1. green day Modérateur
                re

                8h ???

                lol non, pas autant, environ 3/4 heure, 1h tout au plus ...

                je te conseil vivement de de le faire !!! il est très bien !

                et ensuite de reposter un nouveau hijackthis pour verifier ...

                je t'invite aussi à lire ceci pour eviter dans le futur ce genre de problème :

                https://sebsauvage.net/safehex.html

                securite proteger un ordinateur contre les malwares d internet

                ++
                0
                1. moma3 Auteur
                  ok je vais refaire ça, mais qu'est-ce que c'est :
                  France Telecom Routing Table Service ??
                  parce que depuis que je l'ai désactivé, ça bug beaucoup moins quand je me connecte, ça venait de ça ?
                  0
                  1. green day Modérateur
                    re

                    c'est pas forcement à cause de cec service, je dirai que c'est un tout !

                    de plus tu avais une belle ptite infection !

                    ++
                    0
                    1. moma3 Auteur
                      bitdefender m'a trouvé ça:

                      C:\Documents and Settings\Christian_2\Application Data\winantiviruspro2006freeinstall_fr[1].exe
                      Infected with: Trojan.Downloader.Winfixer.O

                      C:\Documents and Settings\Christian_2\Application Data\winantiviruspro2006freeinstall_fr[1].exe
                      Disinfection failed

                      C:\Documents and Settings\Christian_2\Application Data\winantiviruspro2006freeinstall_fr[1].exe
                      Deleted

                      C:\Documents and Settings\Christian_2\Mes documents\logiciels\hijackthis\backups\backup-20061020-193448-469.dll
                      Infected with: Trojan.Downloader.Wintrim.DA

                      C:\Documents and Settings\Christian_2\Mes documents\logiciels\hijackthis\backups\backup-20061020-193448-469.dll
                      Disinfection failed

                      C:\Documents and Settings\Christian_2\Mes documents\logiciels\hijackthis\backups\backup-20061020-193448-469.dll
                      Deleted

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0171996.dll
                      Infected with: Trojan.Downloader.Zlob.AQK

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0171996.dll
                      Disinfection failed

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0171996.dll
                      Deleted

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0171998.exe
                      Infected with: Trojan.Downloader.Zlob.ABO

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0171998.exe
                      Disinfection failed

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0171998.exe
                      Deleted

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172003.exe=>(NSIS o)
                      Infected with: Trojan.Downloader.Zlob.ABT

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172003.exe=>(NSIS o)
                      Disinfection failed

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172003.exe=>(NSIS o)
                      Deleted

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172003.exe
                      Update failed

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172013.dll
                      Infected with: Trojan.Downloader.Zlob.AQK

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172013.dll
                      Disinfection failed

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172013.dll
                      Deleted

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172015.exe
                      Infected with: Trojan.Downloader.Zlob.ABO

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172015.exe
                      Disinfection failed

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172015.exe
                      Deleted

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172037.dll
                      Infected with: Trojan.Downloader.Zlob.AQK

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172037.dll
                      Disinfection failed

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172037.dll
                      Deleted

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172038.exe
                      Infected with: Trojan.Downloader.Zlob.ABO

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172038.exe
                      Disinfection failed

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172038.exe
                      Deleted

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172142.dll
                      Infected with: Trojan.Downloader.Zlob.AQK

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172142.dll
                      Disinfection failed

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172142.dll
                      Deleted

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172143.exe
                      Infected with: Trojan.Downloader.Zlob.ABO

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172143.exe
                      Disinfection failed

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172143.exe
                      Deleted

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172157.dll
                      Infected with: Trojan.Downloader.Zlob.AQK

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172157.dll
                      Disinfection failed

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172157.dll
                      Deleted

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172158.exe
                      Infected with: Trojan.Downloader.Zlob.ABO

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172158.exe
                      Disinfection failed

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172158.exe
                      Deleted

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172200.dll
                      Infected with: Trojan.FakeAlert.DJ

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172200.dll
                      Disinfection failed

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172200.dll
                      Deleted

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172202.exe
                      Infected with: Trojan.Downloader.Zlob.ACG

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172202.exe
                      Disinfection failed

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172202.exe
                      Deleted

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172203.dll
                      Infected with: Trojan.Downloader.Zlob.AQK

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172203.dll
                      Disinfection failed

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172203.dll
                      Deleted

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172204.exe
                      Infected with: Trojan.Downloader.Zlob.ABO

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172204.exe
                      Disinfection failed

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172204.exe
                      Deleted

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172205.exe
                      Infected with: Trojan.Downloader.Zlob.AQK

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172205.exe
                      Disinfection failed

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172205.exe
                      Deleted

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172206.exe
                      Infected with: Trojan.Downloader.Zlob.ACD

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172206.exe
                      Disinfection failed

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172206.exe
                      Deleted

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0173222.dll
                      Infected with: Trojan.Downloader.Wintrim.DA

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0173222.dll
                      Disinfection failed

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0173222.dll
                      Deleted

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP478\A0173807.exe
                      Infected with: Trojan.Downloader.Winfixer.O

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP478\A0173807.exe
                      Disinfection failed

                      C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP478\A0173807.exe
                      Deleted

                      C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\msi.dll
                      Clean

                      C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\msiexec.exe
                      Clean

                      C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\msihnd.dll
                      Clean

                      C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\msimsg.dll
                      Clean

                      C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\msisip.dll
                      Clean

                      C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\spmsg.dll
                      Clean

                      C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\spuninst.exe
                      Clean

                      C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\eula.txt
                      Clean

                      C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\kb893803v2_net.cat
                      Clean

                      C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\kb893803v2_w2k.cat
                      Clean

                      C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\kb893803v2_wxp.cat
                      Clean

                      C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\spcustom.dll
                      Clean

                      C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\update.exe
                      Clean

                      C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\update.ver
                      Clean

                      C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\updatebr.inf
                      Clean

                      C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\update_w2k3.inf
                      Clean

                      C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\update_win2k.inf
                      Clean

                      C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\update_wxp.inf
                      Clean

                      C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\updspapi.dll
                      Clean

                      C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\_downloadprogress_.state
                      Clean

                      C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\_unpacked_.state
                      Clean

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[1].0hm=>/1.htm
                      Infected with: Exploit.ADODBStream.G

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[1].0hm=>/1.htm
                      Disinfection failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[1].0hm=>/1.htm
                      Deleted

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[1].0hm
                      Update failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[1].0hm=>/on-line.exe
                      Infected with: Trojan.Small.BB

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[1].0hm=>/on-line.exe
                      Disinfection failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[1].0hm=>/on-line.exe
                      Deleted

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[1].0hm
                      Update failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[2].0hm=>/1.htm
                      Infected with: Exploit.ADODBStream.G

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[2].0hm=>/1.htm
                      Disinfection failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[2].0hm=>/1.htm
                      Deleted

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[2].0hm
                      Update failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[2].0hm=>/on-line.exe
                      Infected with: Trojan.Small.BB

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[2].0hm=>/on-line.exe
                      Disinfection failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[2].0hm=>/on-line.exe
                      Deleted

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[2].0hm
                      Update failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[3].0hm=>/1.htm
                      Infected with: Exploit.ADODBStream.G

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[3].0hm=>/1.htm
                      Disinfection failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[3].0hm=>/1.htm
                      Deleted

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[3].0hm
                      Update failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[3].0hm=>/on-line.exe
                      Infected with: Trojan.Small.BB

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[3].0hm=>/on-line.exe
                      Disinfection failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[3].0hm=>/on-line.exe
                      Deleted

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[3].0hm
                      Update failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[4].0hm=>/1.htm
                      Infected with: Exploit.ADODBStream.G

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[4].0hm=>/1.htm
                      Disinfection failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[4].0hm=>/1.htm
                      Deleted

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[4].0hm
                      Update failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[4].0hm=>/on-line.exe
                      Infected with: Trojan.Small.BB

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[4].0hm=>/on-line.exe
                      Disinfection failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[4].0hm=>/on-line.exe
                      Deleted

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[4].0hm
                      Update failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[1].0hm=>/x.htm
                      Infected with: Trojan.Exploit.Html.Codebaseexec.AR

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[1].0hm=>/x.htm
                      Disinfection failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[1].0hm=>/x.htm
                      Deleted

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[1].0hm
                      Update failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[1].0hm=>/load.exe
                      Infected with: Trojan.Downloader.Harnig.NAC

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[1].0hm=>/load.exe
                      Disinfection failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[1].0hm=>/load.exe
                      Deleted

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[1].0hm
                      Update failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[2].0hm=>/x.htm
                      Infected with: Trojan.Exploit.Html.Codebaseexec.AR

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[2].0hm=>/x.htm
                      Disinfection failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[2].0hm=>/x.htm
                      Deleted

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[2].0hm
                      Update failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[2].0hm=>/load.exe
                      Infected with: Trojan.Downloader.Harnig.NAC

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[2].0hm=>/load.exe
                      Disinfection failed

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[2].0hm=>/load.exe
                      Deleted

                      D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[2].0hm
                      Update failed

                      D:\sav cosnier\ied_s7m.0ab
                      Infected with: Trojan.Downloader.Mediket.D

                      D:\sav cosnier\ied_s7m.0ab
                      Deleted

                      et voila le rapport d'hijackthis:

                      Logfile of HijackThis v1.99.1
                      Scan saved at 17:03:47, on 21/10/2006
                      Platform: Windows XP SP1 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\WINDOWS\System32\Ati2evxx.exe
                      C:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXE
                      C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                      C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
                      C:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exe
                      C:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXE
                      C:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exe
                      C:\WINDOWS\System32\LckFldService.exe
                      C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
                      C:\Program Files\Securitoo\av_fw\Common\FSMB32.EXE
                      C:\Program Files\Securitoo\av_fw\Common\FCH32.EXE
                      C:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exe
                      C:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXE
                      C:\Program Files\iPod\bin\iPodService.exe
                      C:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                      C:\PROGRA~1\MESSAG~1\StartMessager.exe
                      C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
                      C:\WINDOWS\System32\wuauclt.exe
                      C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE
                      C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
                      C:\Program Files\QuickTime Alternative\qttask.exe
                      C:\Program Files\iTunes\iTunesHelper.exe
                      C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
                      C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
                      C:\Program Files\Securitoo\av_fw\backweb\1044199\Program\BackWeb-1044199.exe
                      C:\Program Files\WiFiConnector\NintendoWFCReg.exe
                      C:\PROGRA~1\Wanadoo\ComComp.exe
                      C:\PROGRA~1\Wanadoo\Toaster.exe
                      C:\PROGRA~1\Wanadoo\Inactivity.exe
                      C:\PROGRA~1\Wanadoo\PollingModule.exe
                      C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
                      C:\PROGRA~1\Wanadoo\Watch.exe
                      C:\WINDOWS\System32\ctfmon.exe
                      C:\Program Files\Mozilla Firefox\firefox.exe
                      C:\Program Files\MSN Messenger\msnmsgr.exe
                      C:\Documents and Settings\Christian_2\Mes documents\logiciels\hijackthis\HijackThis.exe

                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
                      O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                      O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
                      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
                      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                      O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                      O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                      O4 - HKLM\..\Run: [MessagerStarter Wanadoo] C:\PROGRA~1\MESSAG~1\StartMessager.exe Messager Wanadoo
                      O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
                      O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
                      O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
                      O4 - HKLM\..\Run: [FSASWREG] "C:\Program Files\Securitoo\Av_Fw\Anti-Spyware\fsaswreg.exe"
                      O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splash
                      O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL
                      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
                      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                      O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe GestionnaireInternet.exe
                      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
                      O4 - Global Startup: Lancer l'utilitaire d'enregistrement.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
                      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
                      O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
                      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
                      O8 - Extra context menu item: Save Flash by &GetFlash - C:\PROGRA~1\GetFlash\getflash.htm
                      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                      O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                      O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                      O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
                      O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
                      O17 - HKLM\System\CCS\Services\Tcpip\..\{DF525BD0-4B2F-4D8E-8B39-247E5B4C54D1}: NameServer = 80.10.246.130 80.10.246.3
                      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                      O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
                      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                      O23 - Service: Securitoo AntiVirus Firewall (BackWeb Client - 1044199) - Unknown owner - C:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXE
                      O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                      O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                      O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
                      O23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\Securitoo\av_fw\Common\FSAA.EXE (file missing)
                      O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exe
                      O23 - Service: F-Secure Distributed Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exe
                      O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
                      O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\fswsclds.exe
                      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                      O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
                      O23 - Service: LckFldService - Unknown owner - C:\WINDOWS\System32\LckFldService.exe
                      O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
                      0
                      1. green day Modérateur
                        ok, tu n'as pas fais le scan pour rien lol

                        Relance HijackThis : choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked" :

                        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
                        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

                        O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
                        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
                        O8 - Extra context menu item: Save Flash by &GetFlash - C:\PROGRA~1\GetFlash\getflash.htm

                        repasse un coup de cleaunup et ccleaner

                        où en sont tes soucis ???

                        ++
                        **La volonté trouve, la liberté choisit. Trouver et choisir, c'est penser ( V.Hugo) **
                        0
                        1. youval
                          voila jsui pas trs fort en informatik si qq1 pouvait m aider silvouplait

                          Logfile of HijackThis v1.99.1
                          Scan saved at 21:34:19, on 21/10/2006
                          Platform: Windows XP SP1 (WinNT 5.01.2600)
                          MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

                          Running processes:
                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
                          C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
                          C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
                          C:\WINDOWS\System32\nvsvc32.exe
                          C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                          C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
                          C:\WINDOWS\Explorer.EXE
                          C:\Program Files\VideoCompressionCodec\pmsngr.exe
                          C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
                          C:\WINDOWS\System32\ctfmon.exe
                          C:\Program Files\Microsoft ActiveSync\wcescomm.exe
                          E:\eMule\emule.exe
                          C:\PROGRA~1\MICROS~2\rapimgr.exe
                          C:\Program Files\MSN Messenger\msnmsgr.exe
                          C:\Program Files\Fichiers communs\Symantec Shared\Nmain.exe
                          C:\Program Files\Internet Explorer\iexplore.exe
                          C:\Program Files\Internet Explorer\iexplore.exe
                          D:\HijackThis.exe

                          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
                          O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
                          O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
                          O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
                          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                          O3 - Toolbar: Protection Bar - {8aed5df3-6e0b-4930-b1a5-f8aa8d757497} - C:\Program Files\VideoCompressionCodec\iesplugin.dll
                          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
                          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                          O4 - HKLM\..\Run: [SW20] C:\WINDOWS\System32\sw20.exe
                          O4 - HKLM\..\Run: [SW24] C:\WINDOWS\System32\sw24.exe
                          O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
                          O4 - HKLM\..\Run: [QuickTime Task] "D:\qttask.exe" -atboottime
                          O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
                          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
                          O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
                          O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
                          O4 - HKCU\..\Run: [eMuleAutoStart] E:\eMule\emule.exe -AutoStart
                          O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
                          O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
                          O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
                          O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
                          O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
                          O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
                          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                          O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
                          O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
                          O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
                          O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
                          O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
                          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
                          O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
                          O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
                          O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
                          O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                          O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab
                          O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - update.microsoft.com
                          O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
                          O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                          O21 - SSODL: contrabandists - {dfa61db1-388e-4c87-8d56-540fa229bcb4} - C:\WINDOWS\System32\dpfwu.dll
                          O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
                          O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
                          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                          O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
                          O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
                          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
                          O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
                          O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
                          O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                          O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
                          O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
                          0
                          1. youval
                            voila jsui pas trs fort en informatik si qq1 pouvait m aider silvouplait

                            Logfile of HijackThis v1.99.1
                            Scan saved at 21:34:19, on 21/10/2006
                            Platform: Windows XP SP1 (WinNT 5.01.2600)
                            MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

                            Running processes:
                            C:\WINDOWS\System32\smss.exe
                            C:\WINDOWS\system32\winlogon.exe
                            C:\WINDOWS\system32\services.exe
                            C:\WINDOWS\system32\lsass.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\system32\spoolsv.exe
                            C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
                            C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
                            C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
                            C:\WINDOWS\System32\nvsvc32.exe
                            C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                            C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
                            C:\WINDOWS\Explorer.EXE
                            C:\Program Files\VideoCompressionCodec\pmsngr.exe
                            C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
                            C:\WINDOWS\System32\ctfmon.exe
                            C:\Program Files\Microsoft ActiveSync\wcescomm.exe
                            E:\eMule\emule.exe
                            C:\PROGRA~1\MICROS~2\rapimgr.exe
                            C:\Program Files\MSN Messenger\msnmsgr.exe
                            C:\Program Files\Fichiers communs\Symantec Shared\Nmain.exe
                            C:\Program Files\Internet Explorer\iexplore.exe
                            C:\Program Files\Internet Explorer\iexplore.exe
                            D:\HijackThis.exe

                            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.fr/
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
                            O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
                            O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
                            O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
                            O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                            O3 - Toolbar: Protection Bar - {8aed5df3-6e0b-4930-b1a5-f8aa8d757497} - C:\Program Files\VideoCompressionCodec\iesplugin.dll
                            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
                            O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                            O4 - HKLM\..\Run: [SW20] C:\WINDOWS\System32\sw20.exe
                            O4 - HKLM\..\Run: [SW24] C:\WINDOWS\System32\sw24.exe
                            O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
                            O4 - HKLM\..\Run: [QuickTime Task] "D:\qttask.exe" -atboottime
                            O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
                            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
                            O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
                            O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
                            O4 - HKCU\..\Run: [eMuleAutoStart] E:\eMule\emule.exe -AutoStart
                            O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
                            O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
                            O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
                            O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
                            O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
                            O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
                            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                            O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
                            O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
                            O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
                            O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
                            O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
                            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
                            O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
                            O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
                            O14 - IERESET.INF: START_PAGE_URL=http://www.google.fr/
                            O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                            O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab
                            O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - update.microsoft.com
                            O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
                            O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                            O21 - SSODL: contrabandists - {dfa61db1-388e-4c87-8d56-540fa229bcb4} - C:\WINDOWS\System32\dpfwu.dll
                            O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
                            O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
                            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                            O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
                            O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
                            O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
                            O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
                            O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
                            O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                            O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
                            O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
                            0
                            1. green day Modérateur
                              youval : merci de créer ton propre poste !
                              0
                              1. moma3 Auteur
                                bonjour !
                                Bah aparament il n'y a plus rien, donc je vais refaire un scan avec bitdefender et s'il y a des problemes, je te dirais !
                                Voila, a+ et merci encore
                                0
                                2. zakTS
                                  salut,

                                  je suis zak, je veux savoir pourkoi vous pensez que vous resoudre des problems quand vous conseillez les autres de utiliser les antivirus , c'est de la publicité pour ces antivirus,
                                  vous avez des infections?
                                  votre registre est infecté?
                                  le plus grave par exemple!!! alors vous devez utiliser vos connaissance pour eliminer ces virus, parce que si le antiviur est vraiment capable de eliminer un virus pourkoi il l'as laisser de penetrer votre ordinateur?

                                  je vous conseille de installer les consoles de recuperation et creer des disquettees de reparation d'urgence, de sauvagarder l'etat de systeme,,,,,, se sont des solutions tres efficaces pour eliminer les fichiers endomages et les malwares...merci
                                  0
                                  1. ^^Marie^^
                                    Salut zakTS
                                    Je pense que depuis Octobre 2006, l'affaire est classée

                                    Merci quand mm

                                    A°
                                    0
                                3. zakTS
                                  salut
                                  pas compri, mais je pense que vous avez comprenez mon message marie
                                  0
                                  1. ^^Marie^^
                                    Re

                                    Regarde la date du posteur initial
                                    A+
                                    0
                                4. zakTS
                                  j'ai pas voulu resoudre un problem , j'ai voulu dire pourkoi vous consillez les autres d'utiliser des antivirus ? si vous ne pouvez resoudre ces problemes avec vos connaissances,
                                  0

                                  Discussions similaires

                                  Critical low batterie
                                  annemarie

                                  1 réponse
                                  Rétrodiffusion "Mail Delivery System"
                                  baissaoui

                                  0 réponse
                                  Plug ASUS : que signifie "check system power error" ?
                                  Shimrhod

                                  49 réponses
                                  PC acer critical low battery mais battery neuve
                                  Pento_57

                                  10 réponses
                                  Ordi ne charge plus
                                  Laneige

                                  3 réponses