pitsensas

Salut, http://www.sncf.fr/ -> NOK et 88.221.83.48 http://www.voyages-sncf.com/ -> OK et 88.221.83.64 Voici ce que donne tracert sur ww.lequipe.fr: Je vais donc contacter Free assistance via Chat Pour ma part, je suis près de Chartres (28) A+

Tiens, voici la procédure de téléchargeent et de lancement de RepWin. http://forum.zebulon.fr/connexion-reseau-ok-mais-internet-ko-t211802.html?p=1766290 Ensuite, fait ce que te demande Tonton

Ah ,t'as fait un test de débit sur Degroutest (tu trouves à peu près les mêmes résutats que sur Speedtest). Ca, ce sont les valeurs réelles mais maintenant, il faudrait les valeurs théoriques pour vérifier que tes débits sont conformes) Donc, faire le test d'égibilité indiqué plus haut. Pour la connection sur la livebox, tu arrives à la page du Login ou pas ?

Bonjour, Tu as fait un test de bande passante donc maintenant, il faut faire un test d'éligibilté pour comparer les débits réels avec les débits théoriques http://www.ariase.com/fr/eligibilite/test.html (ensuite, aller dans Infos ADSL) Sinon, tu peux aussi les comparer aux caractéristiques de connection de la LiveBox: http://www.ariase.com/fr/guides/debit-synchronisation-box.html A+

De mieux en mieux. Ca "marchotte" (1 coup oui, 1 coup non) sur mon PC fixe. D'après mes investigations, ca marche lorsque l'adresse IP du site est supérieur 88.221.83.50. C'est-à-dire: 88.221.83.51 (ou plus) = OK 88.221.83.50 (ou moins) = NOK Pour preuve: http://www.hostingpics.net/viewer.php?id=209782531.jpg

Bonsoir, Comme indiqué dans mon 1er message, j'ai même désinstallé Eset pour être sûr et j'avais toujours le problème. De plus, l'autre PC (portable) a Mcafee et les sites fonctionnent sur la box de mon pote mais pas sur ma box. A+

Bonjour, Un fichier .part signifie que le téléchargement ne s'est pas terminé normalement. Dans Internet Explorer, appuyer sur "CTRL" + "J" pour afficher la liste des téléchargements et ainsi voir le statut de ce téléchargement (sûrement besoin confirmer le téléchargement suite au message de sécurité du filtre SmartScreen). Si tout se passe bien, dans le dossier de téléchargement, tu devrais avoir à la fin, un fichier RepWin.exe

J'ai le problème sur un PC fixe avec Chrome (à jour -> v43) et sur un PC portable avec IE11 connectés sur la même Freebox. Ce sont 2 PC donc 2 configs complètement différentes. Lorsque je les connecte sur mon tél (en mode Hotspot WIFI) alors ca marche sans problème ! J'ai posté le message aujourd’hui mais ça fait quelques temps que le problème vient puis s'en va (par exemple, déconne pendant 2 jours puis Ok pendant 1 mois) Je ne sais pas s'il n'y a que ces 3 sites mais ce que je sais, c'est qu'à chaque fois que ca déconne, l'adresse IP commence en 88.221.83.xx. Et quand ca marche, ce n'est plus la même adresse IP. J'ai déjà testé un simple reboot et un hard reboot de ma freebox et ca n'avait rien changé. Pas convaincu du problème sur le PC fixe, j'ai quand effectué la manip que tu m'as demandé: [color=#FF0000]Windows Firewall is on[/color] 2 processes from Eset (NOD32) detected A+

J'ai fait de nouveaux essais. Un ami m'a prêté son PC portable et connecté sur le Wifi de ma Freebox, j'ai le même problème. Par contre, je me suis connecté en Wifi avec le PC portable sur mon téléphone (mode Modem) et là, ça marche sans problème. Donc, le problème semble lié à ma config Freebox (V5) mais je ne vois pas vraiment lequel !

Bonjour, Je rencontre depuis quelques semaines, des problèmes d'accès sur certains sites comme www.lequipe.fr, www.ebay.fr, www.commentcamarche.net Je vérifiais le fichier Hosts mais il date de l'installation de mon W7 (bientôt 3 ans) et aucune redirection dedans. Je désactivais et même désinstaller mon Antivirus et Pare-feu (Eset Smart Security mais le problème persiste. J'ai remarqué qu'à chaque fois que j'ai le problème, l'adresse pour le ping est 88.221.83.xx (comme vous pouvez le voir si l'image ci-dessous) Même si je n'y ai pas touché depuis des lustres, j'ai vérifié les paramètres de ma Freebox mais rien vu d'anormal. Donc, si quelqu’un a une idée ou une direction pour mes recherches, je suis preneur. D'avance merci

Bonjour, J'ai testé cette astuce sur mon PC. Pour le processeur ca a bien marché mais pour la mémoire, Win7 ne voulait pas gardé mes 4 Go. Il mettait automatiquement 256 (donc le PC mettait 15 min pour démarrer et 15min pour s'arrêter). En vérifiant dans les propriétés Système, je me suis aperçu qu'il était indiqué 4Go dont 3,84 de libre. Donc, j'ai mis 3932 (3,84x1024), et là, ca a marché !!!!! A+

Bonsoir, Ci-dessous le nouveau rapport de Gmer après suppresion de la ligne "mbr.sys" GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-02-06 20:55:34 Windows 5.1.2600 Service Pack 3 Running: gmer.exe; Driver: C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\pxldapob.sys ---- Modules - GMER 1.0.15 ---- Module PxHelp20.sys (Px Engine Device Driver for Windows 2000/XP/Sonic Solutions) F77BF000-F77C8000 (36864 bytes) Module SISAGPX.sys (SiS AGPv3.5 Filter/Silicon Integrated Systems Corporation) F77CF000-F77D9000 (40960 bytes) Module \SystemRoot\System32\DRIVERS\nv4_mini.sys (NVIDIA Compatible Windows 2000 Miniport Driver, Version 81.67 /NVIDIA Corporation) F66E1000-F6A3D000 (3522560 bytes) Module \SystemRoot\system32\drivers\cmuda.sys (C-Media Audio WDM Driver/C-Media Inc) F65F1000-F66AA000 (757760 bytes) Module \SystemRoot\system32\DRIVERS\sisnicxp.sys (SiS PCI Fast Ethernet Adapter Driver/SiS Corporation) F7ABF000-F7AC7000 (32768 bytes) Module \SystemRoot\system32\DRIVERS\Epfwndis.sys (ESET Personal Firewall NDIS filter/ESET) F6A3D000-F6A48000 (45056 bytes) Module \SystemRoot\System32\DRIVERS\ptilink.sys (Parallel Technologies DirectParallel IO Library/Parallel Technologies, Inc.) F7AE7000-F7AEC000 (20480 bytes) Module \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) F42EC000-F4309000 (118784 bytes) Module \SystemRoot\system32\DRIVERS\epfwtdi.sys (ESET Personal Firewall TDI filter/ESET) F424D000-F4260000 (77824 bytes) Module \??\C:\WINDOWS\system32\drivers\HFSYS.SYS (Hide Folders XP driver/FSPro Labs) F657C000-F6580000 (16384 bytes) Module \SystemRoot\system32\DRIVERS\camdrv41.sys (Philips camera minidriver/Philips Consumer Electronics) F3FEB000-F411A000 (1241088 bytes) Module \SystemRoot\System32\nv4_disp.dll (NVIDIA Compatible Windows 2000 Display driver, Version 81.67 /NVIDIA Corporation) BF9D6000-BFD91000 (3911680 bytes) Module \SystemRoot\System32\ATMFD.DLL (Windows NT OpenType/Type 1 Font Driver/Adobe Systems Incorporated) BFFA0000-BFFE6000 (286720 bytes) Module \SystemRoot\system32\DRIVERS\eamon.sys (Amon monitor/ESET) F35EE000-F36BA000 (835584 bytes) Module \??\C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes' Anti-Malware/Malwarebytes Corporation) F37CE000-F37D2000 (16384 bytes) Module \SystemRoot\system32\DRIVERS\epfw.sys (ESET Personal Firewall driver/ESET) F35A3000-F35C6000 (143360 bytes) Module \SystemRoot\System32\Drivers\Aspi32.SYS (ASPI for WIN32 Kernel Driver/Adaptec) F2B75000-F2B79000 (16384 bytes) Module \??\C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\pxldapob.sys (GMER) F0FDC000-F0FF3000 (94208 bytes) ---- Processes - GMER 1.0.15 ---- Process C:\Program Files\ESET\ESET Smart Security\ekrn.exe (ESET Service/ESET) 340 Library C:\Program Files\ESET\ESET Smart Security\ekrn.exe (ESET Service/ESET) 0x00400000 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Library C:\Program Files\ESET\ESET Smart Security\ekrnScan.dll (ESET On-demmand Scanner Kernel/ESET) 0x21E00000 Library C:\Program Files\ESET\ESET Smart Security\ekrnAmon.dll (ESET Amon Service/ESET) 0x21300000 Library C:\Program Files\ESET\ESET Smart Security\ekrnEmon.dll (ESET Emon Service/ESET) 0x03020000 Library C:\Program Files\ESET\ESET Smart Security\ekrnDmon.dll (ESET Document Scanner Kernel/ESET) 0x03050000 Library C:\Program Files\ESET\ESET Smart Security\ekrnEpfw.dll (ESET Personal Firewall service/ESET) 0x20300000 Library C:\Program Files\ESET\ESET Smart Security\ekrnSmon.dll (ESET Antispam Service/ESET) 0x20600000 Library C:\Program Files\ESET\ESET Smart Security\ekrnUpdate.dll (ESET Update Service/ESET) 0x21100000 Library C:\Program Files\ESET\ESET Smart Security\updater.dll (ESET Update Engine/ESET) 0x21000000 Library C:\Program Files\ESET\ESET Smart Security\ekrnMailPlugins.dll (ESET MailPlugins Service/ESET) 0x22900000 Process C:\Program Files\Java\jre6\bin\jqs.exe (Java Quick Starter Service/Sun Microsystems, Inc.) 372 Library C:\Program Files\Java\jre6\bin\jqs.exe (Java Quick Starter Service/Sun Microsystems, Inc.) 0x00400000 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes' Anti-Malware/Malwarebytes Corporation) 488 Library C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes' Anti-Malware/Malwarebytes Corporation) 0x00400000 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET GUI/ESET) 524 Library C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET GUI/ESET) 0x00400000 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Library C:\Program Files\ESET\ESET Smart Security\eguiScan.dll (ESET On-demmand Scanner GUI/ESET) 0x21C00000 Library C:\Program Files\ESET\ESET Smart Security\eguiAmon.dll (ESET Amon GUI/ESET) 0x21400000 Library C:\Program Files\ESET\ESET Smart Security\eguiEmon.dll (ESET Emon GUI/ESET) 0x21600000 Library C:\Program Files\ESET\ESET Smart Security\eguiDmon.dll (ESET Document Scanner GUI/ESET) 0x23200000 Library C:\Program Files\ESET\ESET Smart Security\eguiEpfw.dll (ESET Personal Firewall UI/ESET) 0x20400000 Library C:\Program Files\ESET\ESET Smart Security\eguiSmon.dll (ESET Antispam GUI/ESET) 0x20800000 Library C:\Program Files\ESET\ESET Smart Security\eguiUpdate.dll (ESET Update GUI/ESET) 0x21200000 Library C:\Program Files\ESET\ESET Smart Security\eguiMailPlugins.dll (ESET MailPlugins GUI/ESET) 0x22B00000 Process C:\WINDOWS\system32\HPZipm12.exe (PML Driver/HP) 568 Library C:\WINDOWS\system32\HPZipm12.exe (PML Driver/HP) 0x00400000 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\WINDOWS\system32\csrss.exe (Client Server Runtime Process/Microsoft Corporation) 696 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\WINDOWS\system32\winlogon.exe (Application d'ouverture de session Windows NT/Microsoft Corporation) 720 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\WINDOWS\system32\services.exe (Applications Services et Contrôleur/Microsoft Corporation) 764 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\WINDOWS\system32\lsass.exe (LSA Shell (Export Version)/Microsoft Corporation) 776 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 932 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\Documents and Settings\propriétaire\Bureau\gmer.exe 984 Library C:\Documents and Settings\propriétaire\Bureau\gmer.exe 0x00400000 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 1032 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 1096 Library C:\WINDOWS\System32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 1128 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes' Anti-Malware/Malwarebytes Corporation) 1260 Library C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes' Anti-Malware/Malwarebytes Corporation) 0x00400000 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 1428 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\Program Files\Free Download Manager\fdm.exe (Free Download Manager/FreeDownloadManager.ORG) 1444 Library C:\Program Files\Free Download Manager\fdm.exe (Free Download Manager/FreeDownloadManager.ORG) 0x00400000 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Library C:\Program Files\Free Download Manager\fum\fumcore.dll 0x10000000 Process C:\WINDOWS\system32\spoolsv.exe (Spooler SubSystem App/Microsoft Corporation) 1484 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Library C:\WINDOWS\system32\HpTcpMon.dll (Standard TCP/IP Port Monitor DLL/Hewlett Packard) 0x10000000 Library C:\WINDOWS\system32\hpzjrd01.dll (HP Rediscovery Library/Hewlett Packard) 0x009B0000 Library C:\WINDOWS\system32\HPTcpMUI.dll (Standard TCP/IP Port Monitor UI DLL/Microsoft Corporation) 0x00CE0000 Library C:\WINDOWS\system32\hptcpmib.dll (Standard TCP/IP Port Monitor DLL/Hewlett Packard) 0x00D40000 Library C:\WINDOWS\system32\hpzlnt05.dll (HP) 0x00D80000 Library C:\WINDOWS\system32\hpz3l054.dll (LanguageMonitor/Hewlett-Packard Company) 0x00DC0000 Library C:\WINDOWS\system32\mdimon.dll (Microsoft® Document Imaging/Microsoft Corporation) 0x00DD0000 Library C:\WINDOWS\system32\pdfcmnnt.dll 0x00DE0000 Library C:\WINDOWS\System32\spool\PRTPROCS\W32X86\hpzpp054.dll (Hewlett-Packard Corporation) 0x00E60000 Library C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll (Microsoft® Document Imaging/Microsoft Corporation) 0x00E80000 Library C:\WINDOWS\System32\spool\PRTPROCS\W32X86\filterpipelineprintproc.dll (Print Filter Pipeline Proxy/Microsoft Corporation) 0x3F420000 Process C:\Program Files\Protection PC\Tracks Eraser Pro\te.exe (Acesoft) 1512 Library C:\Program Files\Protection PC\Tracks Eraser Pro\te.exe (Acesoft) 0x00400000 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Library C:\Program Files\WinSCP\DragExt.dll (Drag&Drop shell extension for WinSCP/Martin Prikryl) 0x01AD0000 Process C:\WINDOWS\Explorer.EXE (Explorateur Windows/Microsoft Corporation) 1552 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Library C:\Program Files\WinSCP\DragExt.dll (Drag&Drop shell extension for WinSCP/Martin Prikryl) 0x02060000 Library C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll (Malwarebytes' Anti-Malware/Malwarebytes Corporation) 0x10000000 Library C:\PROGRA~1\COMPRE~1\WINZIP\WZSHLSTB.DLL (WinZip Shell Extension DLL/WinZip Computing, Inc.) 0x16200000 Library C:\Program Files\Compression\WinRAR\rarext.dll 0x01DE0000 Library C:\Program Files\ESET\ESET Smart Security\shellExt.dll (Shell Extension/ESET) 0x22000000 Library C:\WINDOWS\system32\CmdLineExt.dll (SecuROM Context-Menu for Explorer./Sony DADC Austria AG.) 0x03160000 Process C:\WINDOWS\System32\alg.exe (Application Layer Gateway Service/Microsoft Corporation) 2020 Library C:\WINDOWS\System32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 3524 Library C:\WINDOWS\System32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 ---- Services - GMER 1.0.15 ---- Service (ASPI for WIN32 Kernel Driver/Adaptec) [AUTO] Aspi32 Service C:\Program Files\Protection PC\Tracks Eraser Pro\autocomp.exe (Acesoft) [MANUAL] Autocomplete Service C:\WINDOWS\system32\DRIVERS\camdrv41.sys (Philips camera minidriver/Philips Consumer Electronics) [MANUAL] camvid40 Service C:\WINDOWS\system32\drivers\cmuda.sys (C-Media Audio WDM Driver/C-Media Inc) [MANUAL] cmuda Service C:\WINDOWS\system32\DRIVERS\eamon.sys (Amon monitor/ESET) [AUTO] eamon Service C:\WINDOWS\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) [sYSTEM] ehdrv Service C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe (ESET HTTP Server Service/ESET) [MANUAL] EhttpSrv Service C:\Program Files\ESET\ESET Smart Security\ekrn.exe (ESET Service/ESET) [AUTO] ekrn Service C:\WINDOWS\system32\DRIVERS\ENTECH.sys (EnTech Taiwan) [MANUAL] ENTECH Service C:\WINDOWS\system32\DRIVERS\epfw.sys (ESET Personal Firewall driver/ESET) [AUTO] epfw Service C:\WINDOWS\system32\DRIVERS\Epfwndis.sys (ESET Personal Firewall NDIS filter/ESET) [MANUAL] Epfwndis Service C:\WINDOWS\system32\DRIVERS\epfwtdi.sys (ESET Personal Firewall TDI filter/ESET) [sYSTEM] epfwtdi Service C:\WINDOWS\System32\DRIVERS\gmer.sys (GMER Driver http://www.gmer.net/GMER) [MANUAL] gmer Service C:\WINDOWS\system32\drivers\HFSYS.SYS (Hide Folders XP driver/FSPro Labs) [sYSTEM] HFSYS Service C:\WINDOWS\system32\DRIVERS\HPZid412.sys (IEEE-1284.4-1999 Driver (Windows 2000)/HP) [MANUAL] HPZid412 Service C:\WINDOWS\system32\DRIVERS\HPZipr12.sys (IEEE-1284.4-1999 Print Class Driver/HP) [MANUAL] HPZipr12 Service C:\WINDOWS\system32\DRIVERS\HPZius12.sys (1284.4<->Usb Datalink Driver (Windows 2000)/HP) [MANUAL] HPZius12 Service C:\Program Files\Java\jre6\bin\jqs.exe (Java Quick Starter Service/Sun Microsystems, Inc.) [AUTO] JavaQuickStarterService Service C:\WINDOWS\system32\DRIVERS\LwAdiHid.sys (Logitech WingMan Digital Game Controller Driver (HID)/Logitech Inc.) [MANUAL] LwAdiHid Service C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes' Anti-Malware/Malwarebytes Corporation) [MANUAL] MBAMProtector Service C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes' Anti-Malware/Malwarebytes Corporation) [AUTO] MBAMService Service MSDTC Bridge 3.0.0.0 Service C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Compatible Windows 2000 Miniport Driver, Version 81.67 /NVIDIA Corporation) [MANUAL] nv Service C:\WINDOWS\System32\nvsvc32.exe (NVIDIA Driver Helper Service, Version 81.67/NVIDIA Corporation) [AUTO] NVSvc Service C:\WINDOWS\system32\HPZipm12.exe (PML Driver/HP) [AUTO] Pml Driver HPZ12 Service C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies DirectParallel IO Library/Parallel Technologies, Inc.) [MANUAL] Ptilink Service C:\WINDOWS\System32\Drivers\PxHelp20.sys (Px Engine Device Driver for Windows 2000/XP/Sonic Solutions) [bOOT] PxHelp20 Service C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision SECURITY Driver/Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [MANUAL] Secdrv Service ServiceModelEndpoint 3.0.0.0 Service ServiceModelOperation 3.0.0.0 Service ServiceModelService 3.0.0.0 Service C:\WINDOWS\System32\DRIVERS\SISAGPX.sys (SiS AGPv3.5 Filter/Silicon Integrated Systems Corporation) [bOOT] SISAGP Service C:\WINDOWS\System32\DRIVERS\sisnic.sys (SiS PCI Fast Ethernet Adapter Driver/SiS Corporation) [MANUAL] SISNIC Service C:\WINDOWS\system32\DRIVERS\sisnicxp.sys (SiS PCI Fast Ethernet Adapter Driver/SiS Corporation) [MANUAL] SISNICXP Service SMSvcHost 3.0.0.0 Service C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS (Sony USB Lower Filter driver/Sony Corporation) [MANUAL] SONYPVU1 Service System32\Drivers\sptd.sys [bOOT] sptd Service C:\WINDOWS\system32\DRIVERS\StreamIP.sys (Microsoft IP Test Driver/Microsoft Corporation) [MANUAL] streamip Service Windows Workflow Foundation 3.0.0.0 ---- EOF - GMER 1.0.15 ---- Je lance le nettoyage des fichiers temporaires A+

Bonsoir, Désolé pour le délai. Ci-joint le rapport du scan de Gmer: GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-01-28 23:31:50 Windows 5.1.2600 Service Pack 3 Running: gmer.exe; Driver: C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\pxldapob.sys ---- Modules - GMER 1.0.15 ---- Module PxHelp20.sys (Px Engine Device Driver for Windows 2000/XP/Sonic Solutions) F77BF000-F77C8000 (36864 bytes) Module SISAGPX.sys (SiS AGPv3.5 Filter/Silicon Integrated Systems Corporation) F77CF000-F77D9000 (40960 bytes) Module \SystemRoot\System32\DRIVERS\nv4_mini.sys (NVIDIA Compatible Windows 2000 Miniport Driver, Version 81.67 /NVIDIA Corporation) F6765000-F6AC1000 (3522560 bytes) Module \SystemRoot\system32\drivers\cmuda.sys (C-Media Audio WDM Driver/C-Media Inc) F6675000-F672E000 (757760 bytes) Module \SystemRoot\system32\DRIVERS\sisnicxp.sys (SiS PCI Fast Ethernet Adapter Driver/SiS Corporation) F7ADF000-F7AE7000 (32768 bytes) Module \SystemRoot\system32\DRIVERS\Epfwndis.sys (ESET Personal Firewall NDIS filter/ESET) F785F000-F786A000 (45056 bytes) Module \SystemRoot\System32\DRIVERS\ptilink.sys (Parallel Technologies DirectParallel IO Library/Parallel Technologies, Inc.) F7B07000-F7B0C000 (20480 bytes) Module \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) F4370000-F438D000 (118784 bytes) Module \SystemRoot\system32\DRIVERS\epfwtdi.sys (ESET Personal Firewall TDI filter/ESET) F42D1000-F42E4000 (77824 bytes) Module \??\C:\WINDOWS\system32\drivers\HFSYS.SYS (Hide Folders XP driver/FSPro Labs) F65F8000-F65FC000 (16384 bytes) Module \SystemRoot\system32\DRIVERS\camdrv41.sys (Philips camera minidriver/Philips Consumer Electronics) F406F000-F419E000 (1241088 bytes) Module \SystemRoot\System32\nv4_disp.dll (NVIDIA Compatible Windows 2000 Display driver, Version 81.67 /NVIDIA Corporation) BF9D6000-BFD91000 (3911680 bytes) Module \SystemRoot\System32\ATMFD.DLL (Windows NT OpenType/Type 1 Font Driver/Adobe Systems Incorporated) BFFA0000-BFFE6000 (286720 bytes) Module \SystemRoot\system32\DRIVERS\eamon.sys (Amon monitor/ESET) F3672000-F373E000 (835584 bytes) Module \??\C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes' Anti-Malware/Malwarebytes Corporation) F3846000-F384A000 (16384 bytes) Module \SystemRoot\system32\DRIVERS\epfw.sys (ESET Personal Firewall driver/ESET) F3627000-F364A000 (143360 bytes) Module \SystemRoot\System32\Drivers\Aspi32.SYS (ASPI for WIN32 Kernel Driver/Adaptec) F2BF9000-F2BFD000 (16384 bytes) Module \??\C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\pxldapob.sys (GMER) EF6A6000-EF6BD000 (94208 bytes) ---- Processes - GMER 1.0.15 ---- Process C:\Program Files\ESET\ESET Smart Security\ekrn.exe (ESET Service/ESET) 304 Library C:\Program Files\ESET\ESET Smart Security\ekrn.exe (ESET Service/ESET) 0x00400000 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Library C:\Program Files\ESET\ESET Smart Security\ekrnScan.dll (ESET On-demmand Scanner Kernel/ESET) 0x21E00000 Library C:\Program Files\ESET\ESET Smart Security\ekrnAmon.dll (ESET Amon Service/ESET) 0x21300000 Library C:\Program Files\ESET\ESET Smart Security\ekrnEmon.dll (ESET Emon Service/ESET) 0x02E40000 Library C:\Program Files\ESET\ESET Smart Security\ekrnDmon.dll (ESET Document Scanner Kernel/ESET) 0x02E70000 Library C:\Program Files\ESET\ESET Smart Security\ekrnEpfw.dll (ESET Personal Firewall service/ESET) 0x20300000 Library C:\Program Files\ESET\ESET Smart Security\ekrnSmon.dll (ESET Antispam Service/ESET) 0x20600000 Library C:\Program Files\ESET\ESET Smart Security\ekrnUpdate.dll (ESET Update Service/ESET) 0x21100000 Library C:\Program Files\ESET\ESET Smart Security\updater.dll (ESET Update Engine/ESET) 0x21000000 Library C:\Program Files\ESET\ESET Smart Security\ekrnMailPlugins.dll (ESET MailPlugins Service/ESET) 0x22900000 Process C:\Program Files\Java\jre6\bin\jqs.exe (Java Quick Starter Service/Sun Microsystems, Inc.) 340 Library C:\Program Files\Java\jre6\bin\jqs.exe (Java Quick Starter Service/Sun Microsystems, Inc.) 0x00400000 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes' Anti-Malware/Malwarebytes Corporation) 388 Library C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes' Anti-Malware/Malwarebytes Corporation) 0x00400000 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\WINDOWS\system32\HPZipm12.exe (PML Driver/HP) 536 Library C:\WINDOWS\system32\HPZipm12.exe (PML Driver/HP) 0x00400000 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\WINDOWS\system32\csrss.exe (Client Server Runtime Process/Microsoft Corporation) 696 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\WINDOWS\system32\winlogon.exe (Application d'ouverture de session Windows NT/Microsoft Corporation) 720 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\WINDOWS\system32\services.exe (Applications Services et Contrôleur/Microsoft Corporation) 764 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\WINDOWS\system32\lsass.exe (LSA Shell (Export Version)/Microsoft Corporation) 776 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 932 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 1032 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET GUI/ESET) 1076 Library C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET GUI/ESET) 0x00400000 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Library C:\Program Files\ESET\ESET Smart Security\eguiScan.dll (ESET On-demmand Scanner GUI/ESET) 0x21C00000 Library C:\Program Files\ESET\ESET Smart Security\eguiAmon.dll (ESET Amon GUI/ESET) 0x21400000 Library C:\Program Files\ESET\ESET Smart Security\eguiEmon.dll (ESET Emon GUI/ESET) 0x21600000 Library C:\Program Files\ESET\ESET Smart Security\eguiDmon.dll (ESET Document Scanner GUI/ESET) 0x23200000 Library C:\Program Files\ESET\ESET Smart Security\eguiEpfw.dll (ESET Personal Firewall UI/ESET) 0x20400000 Library C:\Program Files\ESET\ESET Smart Security\eguiSmon.dll (ESET Antispam GUI/ESET) 0x20800000 Library C:\Program Files\ESET\ESET Smart Security\eguiUpdate.dll (ESET Update GUI/ESET) 0x21200000 Library C:\Program Files\ESET\ESET Smart Security\eguiMailPlugins.dll (ESET MailPlugins GUI/ESET) 0x22B00000 Process C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 1096 Library C:\WINDOWS\System32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 1132 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\Program Files\Protection PC\Tracks Eraser Pro\te.exe (Acesoft) 1152 Library C:\Program Files\Protection PC\Tracks Eraser Pro\te.exe (Acesoft) 0x00400000 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Library C:\Program Files\WinSCP\DragExt.dll (Drag&Drop shell extension for WinSCP/Martin Prikryl) 0x01AD0000 Process C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 1352 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\Program Files\Free Download Manager\fdm.exe (Free Download Manager/FreeDownloadManager.ORG) 1480 Library C:\Program Files\Free Download Manager\fdm.exe (Free Download Manager/FreeDownloadManager.ORG) 0x00400000 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Library C:\Program Files\Free Download Manager\fum\fumcore.dll 0x10000000 Process C:\WINDOWS\system32\spoolsv.exe (Spooler SubSystem App/Microsoft Corporation) 1496 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Library C:\WINDOWS\system32\HpTcpMon.dll (Standard TCP/IP Port Monitor DLL/Hewlett Packard) 0x10000000 Library C:\WINDOWS\system32\hpzjrd01.dll (HP Rediscovery Library/Hewlett Packard) 0x009B0000 Library C:\WINDOWS\system32\HPTcpMUI.dll (Standard TCP/IP Port Monitor UI DLL/Microsoft Corporation) 0x00CE0000 Library C:\WINDOWS\system32\hptcpmib.dll (Standard TCP/IP Port Monitor DLL/Hewlett Packard) 0x00D40000 Library C:\WINDOWS\system32\hpzlnt05.dll (HP) 0x00D80000 Library C:\WINDOWS\system32\hpz3l054.dll (LanguageMonitor/Hewlett-Packard Company) 0x00DC0000 Library C:\WINDOWS\system32\mdimon.dll (Microsoft® Document Imaging/Microsoft Corporation) 0x00DD0000 Library C:\WINDOWS\system32\pdfcmnnt.dll 0x00DE0000 Library C:\WINDOWS\System32\spool\PRTPROCS\W32X86\hpzpp054.dll (Hewlett-Packard Corporation) 0x00E60000 Library C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll (Microsoft® Document Imaging/Microsoft Corporation) 0x00E80000 Library C:\WINDOWS\System32\spool\PRTPROCS\W32X86\filterpipelineprintproc.dll (Print Filter Pipeline Proxy/Microsoft Corporation) 0x3F420000 Process C:\WINDOWS\Explorer.EXE (Explorateur Windows/Microsoft Corporation) 1560 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Library C:\Program Files\WinSCP\DragExt.dll (Drag&Drop shell extension for WinSCP/Martin Prikryl) 0x02040000 Library C:\PROGRA~1\COMPRE~1\WINZIP\WZSHLSTB.DLL (WinZip Shell Extension DLL/WinZip Computing, Inc.) 0x16200000 Library C:\Program Files\Compression\WinRAR\rarext.dll 0x03640000 Library C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll (Malwarebytes' Anti-Malware/Malwarebytes Corporation) 0x10000000 Library C:\Program Files\ESET\ESET Smart Security\shellExt.dll (Shell Extension/ESET) 0x22000000 Process C:\Documents and Settings\propriétaire\Bureau\gmer.exe 1880 Library C:\Documents and Settings\propriétaire\Bureau\gmer.exe 0x00400000 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\WINDOWS\System32\alg.exe (Application Layer Gateway Service/Microsoft Corporation) 1976 Library C:\WINDOWS\System32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\WINDOWS\explorer.exe (Explorateur Windows/Microsoft Corporation) 3040 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 Process C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 3368 Library C:\WINDOWS\System32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x753C0000 ---- Services - GMER 1.0.15 ---- Service (ASPI for WIN32 Kernel Driver/Adaptec) [AUTO] Aspi32 Service C:\Program Files\Protection PC\Tracks Eraser Pro\autocomp.exe (Acesoft) [MANUAL] Autocomplete Service C:\WINDOWS\system32\DRIVERS\camdrv41.sys (Philips camera minidriver/Philips Consumer Electronics) [MANUAL] camvid40 Service C:\WINDOWS\system32\drivers\cmuda.sys (C-Media Audio WDM Driver/C-Media Inc) [MANUAL] cmuda Service C:\WINDOWS\system32\DRIVERS\eamon.sys (Amon monitor/ESET) [AUTO] eamon Service C:\WINDOWS\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) [sYSTEM] ehdrv Service C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe (ESET HTTP Server Service/ESET) [MANUAL] EhttpSrv Service C:\Program Files\ESET\ESET Smart Security\ekrn.exe (ESET Service/ESET) [AUTO] ekrn Service C:\WINDOWS\system32\DRIVERS\ENTECH.sys (EnTech Taiwan) [MANUAL] ENTECH Service C:\WINDOWS\system32\DRIVERS\epfw.sys (ESET Personal Firewall driver/ESET) [AUTO] epfw Service C:\WINDOWS\system32\DRIVERS\Epfwndis.sys (ESET Personal Firewall NDIS filter/ESET) [MANUAL] Epfwndis Service C:\WINDOWS\system32\DRIVERS\epfwtdi.sys (ESET Personal Firewall TDI filter/ESET) [sYSTEM] epfwtdi Service C:\WINDOWS\System32\DRIVERS\gmer.sys (GMER Driver http://www.gmer.net/GMER) [MANUAL] gmer Service C:\WINDOWS\system32\drivers\HFSYS.SYS (Hide Folders XP driver/FSPro Labs) [sYSTEM] HFSYS Service C:\WINDOWS\system32\DRIVERS\HPZid412.sys (IEEE-1284.4-1999 Driver (Windows 2000)/HP) [MANUAL] HPZid412 Service C:\WINDOWS\system32\DRIVERS\HPZipr12.sys (IEEE-1284.4-1999 Print Class Driver/HP) [MANUAL] HPZipr12 Service C:\WINDOWS\system32\DRIVERS\HPZius12.sys (1284.4<->Usb Datalink Driver (Windows 2000)/HP) [MANUAL] HPZius12 Service C:\Program Files\Java\jre6\bin\jqs.exe (Java Quick Starter Service/Sun Microsystems, Inc.) [AUTO] JavaQuickStarterService Service C:\WINDOWS\system32\DRIVERS\LwAdiHid.sys (Logitech WingMan Digital Game Controller Driver (HID)/Logitech Inc.) [MANUAL] LwAdiHid Service C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes' Anti-Malware/Malwarebytes Corporation) [MANUAL] MBAMProtector Service C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes' Anti-Malware/Malwarebytes Corporation) [AUTO] MBAMService Service C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\mbr.sys [MANUAL] mbr Service MSDTC Bridge 3.0.0.0 Service C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Compatible Windows 2000 Miniport Driver, Version 81.67 /NVIDIA Corporation) [MANUAL] nv Service C:\WINDOWS\System32\nvsvc32.exe (NVIDIA Driver Helper Service, Version 81.67/NVIDIA Corporation) [AUTO] NVSvc Service C:\WINDOWS\system32\HPZipm12.exe (PML Driver/HP) [AUTO] Pml Driver HPZ12 Service C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies DirectParallel IO Library/Parallel Technologies, Inc.) [MANUAL] Ptilink Service C:\WINDOWS\System32\Drivers\PxHelp20.sys (Px Engine Device Driver for Windows 2000/XP/Sonic Solutions) [bOOT] PxHelp20 Service C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision SECURITY Driver/Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [MANUAL] Secdrv Service ServiceModelEndpoint 3.0.0.0 Service ServiceModelOperation 3.0.0.0 Service ServiceModelService 3.0.0.0 Service C:\WINDOWS\System32\DRIVERS\SISAGPX.sys (SiS AGPv3.5 Filter/Silicon Integrated Systems Corporation) [bOOT] SISAGP Service C:\WINDOWS\System32\DRIVERS\sisnic.sys (SiS PCI Fast Ethernet Adapter Driver/SiS Corporation) [MANUAL] SISNIC Service C:\WINDOWS\system32\DRIVERS\sisnicxp.sys (SiS PCI Fast Ethernet Adapter Driver/SiS Corporation) [MANUAL] SISNICXP Service SMSvcHost 3.0.0.0 Service C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS (Sony USB Lower Filter driver/Sony Corporation) [MANUAL] SONYPVU1 Service System32\Drivers\sptd.sys [bOOT] sptd Service C:\WINDOWS\system32\DRIVERS\StreamIP.sys (Microsoft IP Test Driver/Microsoft Corporation) [MANUAL] streamip Service Windows Workflow Foundation 3.0.0.0 ---- EOF - GMER 1.0.15 ---- D'avance merci pour votre retour Cordialement

Bonjour, Ci-joint le log de mbr: Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully kernel: MBR read successfully user & kernel MBR OK PE file found in sector at 0x04A98CC5 ! J'ai essayé la commande "%userprofile%\Bureau\mbr" -f mais je n'ai pas le message "original MBR restored successfully !" et toujours le message PE File found in sector ..... Est ce grave et que dois je faire ? D'avance merci

Bonjour, Personne pour m'aider (au moins analyser le rapport de RSIT) ? D'avance merci A+

Bonjour, J'étais sur la page Internet Facebook et j'ai fermé IE avec la croix en haut à droite. IE s'est fermé et s'est ré-ouvert avec pleins de pages Internet (onglets en fait). Obligé de faire plusieurs fins de tâches de Iexplorer.exe pour m'en sortir. C'est la première fois mais je trouve cela très louche. Donc, j'ai pensé à de la pub intempestives donc j'ai passé Navilog1 mais il n'a rien trouvé: cleanavi.txt Fix Navipromo version 4.0.6 commencé le 03/01/2010 19:02:14,82 !!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!! !!! Postez ce rapport sur le forum pour le faire analyser !!! Outil exécuté depuis C:\Program Files\navilog1 Mise à jour le 03.01.2010 à 11h00 par IL-MAFIOSO Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3 X86-based PC ( Uniprocessor Free : AMD Athlon XP 3000+ ) BIOS : Version 1.00 USER : propriétaire ( Administrator ) BOOT : Normal boot Antivirus : ESET Smart Security 4.0 4.0 (Activated) Firewall : Pare-feu personnel d'ESET 4.0.467.0 (Activated) A:\ (USB) C:\ (Local Disk) - NTFS - Total:37 Go (Free:1 Go) D:\ (CD or DVD) E:\ (CD or DVD) F:\ (Local Disk) - NTFS - Total:74 Go (Free:29 Go) Recherche executée en mode normal Aucune Infection Navipromo/Egdaccess trouvée *** Scan terminé 03/01/2010 19:03:09,31 *** Donc, je vous joins pour analyse les log RSIT: info.txt logfile of random's system information tool 1.06 2010-01-03 19:05:17 ======Uninstall list====== -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Flash Player Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe Adobe Shockwave Player 11.5-->"C:\WINDOWS\system32\Adobe\Shockwave 11\uninstaller.exe" AIDA32 v3.93-->"C:\Program Files\Protection PC\AIDA32\unins000.exe" Analyseur et SDK MSXML 4.0 SP2-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC} Archiveur WinRAR-->C:\Program Files\Compression\WinRAR\uninstall.exe Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7} Auslogics Disk Defrag-->"C:\Program Files\Protection PC\Auslogics Disk Defrag\unins000.exe" BitComet 0.70-->F:\Logiciels\BitComet\uninst.exe CCleaner-->"C:\Program Files\Protection PC\CCleaner\uninst.exe" C-Media 3D Audio-->C:\WINDOWS\CMIUnInstall.exe Correctif pour Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe" Correctif pour Windows XP (KB976098-v2)-->"C:\WINDOWS\$NtUninstallKB976098-v2$\spuninst\spuninst.exe" Davory-->C:\Program Files\Restauration\Davory\Davory.exe uninst Debugging Tools for Windows (x86)-->MsiExec.exe /I{83DD27C9-CDC2-489A-87FA-8622C1F8F8EC} ExtraFilm FotoFacil-->C:\Program Files\Extrafilm FotoFacil\Uninstall.exe Foxit Reader-->C:\Program Files\Foxit Software\Foxit Reader\Uninstall.exe Free Download Manager 2.5-->"C:\Program Files\Free Download Manager\unins000.exe" Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3} Hide Folders XP 1.3 for Windows 2000/XP-->C:\Program Files\HideFolder\hfxp.exe /u HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT="" Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT="" HP Imaging Device Functions 7.0-->C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat HP Photosmart and Deskjet 7.0.A-->C:\Program Files\HP\Digital Imaging\{A9F5421F-DA70-4C77-BB97-8D77EC33ED5E}\setup\hpzscr01.exe -datfile hposcr09.dat HP Photosmart Essential-->MsiExec.exe /X{6994491D-D491-48F1-AE1F-E179C1FFFC2F} HP Solution Center 7.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe Installation Windows Live-->MsiExec.exe /I{46ABBC54-1872-4AA3-95E2-F2C063A63F31} Java 6 Update 17-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216017FF} Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall MaestroList-->"C:\Program Files\MaestroList\uninstall.exe" Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe" Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700} Microsoft .NET Framework 1.1 Security Update (KB953297)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp" Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} Microsoft .NET Framework 3.0 French Language Pack-->MsiExec.exe /X{E3C080B0-23F5-49AF-89F8-8E8DBC89E659} Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7} Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570} Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9} Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118} Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d} Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows Internet Explorer 7 (KB969897)-->"C:\WINDOWS\ie7updates\KB969897-IE7\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows Internet Explorer 7 (KB972260)-->"C:\WINDOWS\ie7updates\KB972260-IE7\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows Internet Explorer 7 (KB974455)-->"C:\WINDOWS\ie7updates\KB974455-IE7\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows Internet Explorer 7 (KB976325)-->"C:\WINDOWS\ie7updates\KB976325-IE7\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB969947)-->"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB970430)-->"C:\WINDOWS\$NtUninstallKB970430$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB973904)-->"C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB974318)-->"C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB974392)-->"C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.exe" Mise à jour pour Windows Internet Explorer 7 (KB976749)-->"C:\WINDOWS\ie7updates\KB976749-IE7\spuninst\spuninst.exe" Mise à jour pour Windows XP (KB971737)-->"C:\WINDOWS\$NtUninstallKB971737$\spuninst\spuninst.exe" Mise à jour pour Windows XP (KB973687)-->"C:\WINDOWS\$NtUninstallKB973687$\spuninst\spuninst.exe" Module de compatibilité pour Microsoft Office System 2007-->MsiExec.exe /X{90120000-0020-040C-0000-0000000FF1CE} Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe Module de prise en charge linguistique du français de Microsoft .NET Framework 3.0-->C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 French Language Pack\setup.exe Mozilla Firefox (3.0.-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe MSVC80_x86-->MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27} MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94} MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF} MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71} MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC} MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E} Nero - Burning Rom-->MsiExec.exe /X{A4D7B764-4140-11D4-88EB-0050DA3579C0} NVIDIA Drivers-->C:\WINDOWS\System32\nvudisp.exe UninstallGUI OCR Software by I.R.I.S 7.0-->C:\Program Files\HP\Digital Imaging\OCR\hpzscr01.exe -datfile hpqbud11.dat OGA Notifier 2.0.0048.0-->MsiExec.exe /I{B2544A03-10D0-4E5E-BA69-0362FFC20D18} Outlook Express Quick Backup-->C:\WINDOWS\st6unst.exe -n "C:\Program Files\Outlook Express\Outlook Express Quick Backup\ST6UNST.LOG" PDFCreator-->C:\Program Files\PDFCreator\unins000.exe Philips SPC 900NC PC Camera-->C:\Program Files\InstallShield Installation Information\{51E13E14-F72A-4C97-8FD7-04322D995E2F}\setup.exe -runfromtemp -l0x040c -removeonly Philips SPC 900NC PC Camera-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{220F6386-5D1F-4DA5-94DB-F12133C3AE2C}\Setup.exe" -l0x40c PhotoMix 5.3-->"C:\Program Files\PhotoMix\unins000.exe" Pro Evolution Soccer 6-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{EBB794ED-D282-4334-92FB-254481EFF514} /l1036 QuickTime-->MsiExec.exe /I{C78EAC6F-7A73-452E-8134-DBB2165C5A68} Réceptions et fêtes-->"C:\Program Files\Anuman Interactive\Réceptions et fêtes\unins000.exe" Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7} SierraHome Hallmark Scrapbook Studio-->C:\WINDOWS\IsUninst.exe -f"c:\program files\Scrapbook Studio\HmUninst.isu" -c"c:\program files\Scrapbook Studio\Uninsthm.DLL" SiS 900 PCI Fast Ethernet Adapter Driver-->C:\WINDOWS\SiS\900\Uninst.exe Spybot - Search & Destroy-->"C:\Program Files\Protection PC\Spybot - Search & Destroy\unins000.exe" Studio-Scrap-->"C:\Program Files\Studio-Scrap\unins000.exe" Tracks Eraser Pro v4.03-->"C:\Program Files\Protection PC\Tracks Eraser Pro\unins000.exe" UnLockOE-->C:\Program Files\Outlook Express\UnLockOE\uninstall.exe Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT="" VideoLAN VLC media player 0.8.6f-->C:\Program Files\VLC\uninstall.exe Windows Defender Signatures-->MsiExec.exe /I{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C} Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41} Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52} Windows Live Messenger-->MsiExec.exe /X{770F1BEC-2871-4E70-B837-FB8525FFA3B1} Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll Windows Presentation Foundation Language Pack (FRA)-->MsiExec.exe /X{6901DD22-527A-41EF-9059-E81FEDE9E494} Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840} Windows Workflow Foundation FR Language Pack-->MsiExec.exe /I{B84C141C-9A13-44BE-9A69-301D7B11D836} WinSCP 4.0.4-->"C:\Program Files\WinSCP\unins000.exe" WinZip-->"C:\Program Files\Compression\WinZip\WINZIP32.EXE" /uninstall xp-AntiSpy 3.95-->C:\Program Files\Protection PC\xp-AntiSpy\Uninstall.exe Zeb-Utility 1.2-->C:\Program Files\Protection PC\Zeb-Utility\Uninstal.exe Zylom Games Player Plugin-->"C:\Program Files\Zylom Games\UninstallPlugin.exe" --uninstall ======Hosts File====== 127.0.0.1 localhost 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com ======Security center information====== AV: ESET Smart Security 4.0 FW: Pare-feu personnel d'ESET ======System event log====== Computer Name: PC-FIXE Event Code: 7035 Message: Un contrôle Démarrer a correctement été envoyé au service Explorateur d'ordinateur. Record Number: 2251 Source Name: Service Control Manager Time Written: 20091024182037.000000+120 Event Type: Informations User: AUTORITE NT\SYSTEM Computer Name: PC-FIXE Event Code: 26 Message: Application popup : : Machine Check: Regs Record Number: 2250 Source Name: Application Popup Time Written: 20091024182036.000000+120 Event Type: Informations User: Computer Name: PC-FIXE Event Code: 26 Message: Application popup : : Machine Check: Record Number: 2249 Source Name: Application Popup Time Written: 20091024182036.000000+120 Event Type: Informations User: Computer Name: PC-FIXE Event Code: 26 Message: Application popup : : Machine Check: Regs Record Number: 2248 Source Name: Application Popup Time Written: 20091024182036.000000+120 Event Type: Informations User: Computer Name: PC-FIXE Event Code: 26 Message: Application popup : : Machine Check: Record Number: 2247 Source Name: Application Popup Time Written: 20091024182036.000000+120 Event Type: Informations User: =====Application event log===== Computer Name: PC-FIXE Event Code: 102 Message: msnmsgr (708) \\.\C:\Documents and Settings\propriétaire\Local Settings\Application Data\Microsoft\Messenger\kiela.lxxx@hotmail.fr\SharingMetadata\Working\database_9610_1010_100F_F651\dfsr.db: Le moteur de base de données a démarré une nouvelle instance (0). Record Number: 5 Source Name: ESENT Time Written: 20090816195751.000000+120 Event Type: Informations User: Computer Name: PC-FIXE Event Code: 100 Message: msnmsgr (708) Le moteur de base de données 5.01.2600.5512 est démarré. Record Number: 4 Source Name: ESENT Time Written: 20090816195751.000000+120 Event Type: Informations User: Computer Name: PC-FIXE Event Code: 12001 Message: Record Number: 3 Source Name: usnjsvc Time Written: 20090816195749.000000+120 Event Type: User: Computer Name: PC-FIXE Event Code: 1800 Message: Le service Centre de sécurité Windows a démarré. Record Number: 2 Source Name: SecurityCenter Time Written: 20090816192205.000000+120 Event Type: Informations User: Computer Name: PC-FIXE Event Code: 11707 Message: Produit : Java 6 Update 15 -- Installation terminée. Record Number: 1 Source Name: MsiInstaller Time Written: 20090816182453.000000+120 Event Type: Informations User: PC-FIXE\propriétaire ======Environment variables====== "ComSpec"=%SystemRoot%\system32\cmd.exe "FP_NO_HOST_CHECK"=NO "NUMBER_OF_PROCESSORS"=1 "OS"=Windows_NT "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\wbem;C:\Program Files\Fichiers communs\GTK\2.0\bin;C:\Program Files\QuickTime\QTSystem "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH "PROCESSOR_ARCHITECTURE"=x86 "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 10 Stepping 0, AuthenticAMD "PROCESSOR_LEVEL"=6 "PROCESSOR_REVISION"=0a00 "TEMP"=%USERPROFILE%\Local Settings\Temp "TMP"=%USERPROFILE%\Local Settings\Temp "windir"=%SystemRoot% "LANG"=fr "CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip "QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip -----------------EOF----------------- Logfile of random's system information tool 1.06 (written by random/random) Run by propriétaire at 2010-01-03 19:04:34 Microsoft Windows XP Professionnel Service Pack 3 System drive C: has 1 GB (3%) free of 38 GB Total RAM: 1023 MB (50% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:05:15, on 03/01/2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16945) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe C:\Program Files\Protection PC\Tracks Eraser Pro\te.exe C:\Program Files\Free Download Manager\fdm.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\rundll32.exe C:\Temp\Aide Virus\RSIT\RSIT.exe C:\Program Files\trend micro\propriétaire.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.google.fr/keyword/%s R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/ie R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favoris O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [MAJ Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\Tempo Lancement MAJ.vbs" O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray O4 - HKCU\..\Run: [Tracks Eraser Pro] C:\Program Files\Protection PC\Tracks Eraser Pro\te.exe min O4 - HKCU\..\Run: [Free Download Manager] "C:\Program Files\Free Download Manager\fdm.exe" -autorun O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user') O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Translate with &Babylon - res://G:\Portable Babylon 7\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.extrafilm.fr/ImageUploader5.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.zebulon.fr/scan8/oscan8.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1254072300375 O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://fichiers.touslesdrivers.com/fichier...on_2_0_4_13.cab O16 - DPF: {A73BAEFA-EE65-494D-BEDB-DD3E5A34FA98} - http://www.extrafilm.fr/ImageUploader4.cab O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photo...ol/MSNPUpld.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{A9A298E5-7642-4D3B-86AA-2EADC6CF8859}: NameServer = 212.27.54.252,212.27.53.252 O23 - Service: AutoComplete Service (Autocomplete) - Acesoft - C:\Program Files\Protection PC\Tracks Eraser Pro\autocomp.exe O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe -- End of file - 6217 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\OGALogon.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-01-03 41760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-01-03 73728] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2005-11-04 7204864] "SiSUSBRG"=C:\WINDOWS\SiSUSBrg.exe [2002-07-12 106496] "MAJ Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\Tempo Lancement MAJ.vbs [2009-05-09 381] "egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2009-09-11 2054360] "Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2009-12-30 429392] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Tracks Eraser Pro"=C:\Program Files\Protection PC\Tracks Eraser Pro\te.exe [2004-03-13 254976] "Free Download Manager"=C:\Program Files\Free Download Manager\fdm.exe [2008-02-25 2465839] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "aawservice"=3 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon] C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=1 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=323 "NoSMConfigurePrograms"=1 "NoDrives"=0 "NoDriveAutoRun"=67108863 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoSMConfigurePrograms"= "NoDriveAutoRun"= "NoDriveTypeAutoRun"= "NoDrives"= "HonorAutoRunSetting"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "F:\Logiciels\eMule\emule.exe"="F:\Logiciels\eMule\emule.exe:*:Enabled:eMule" "C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019" "C:\Program Files\Jeux\Pro Evolution Soccer 6\PES6.exe"="C:\Program Files\Jeux\Pro Evolution Soccer 6\PES6.exe:*:Enabled:pes6.exe" "C:\Program Files\VLC\vlc.exe"="C:\Program Files\VLC\vlc.exe:*:Enabled:VLC media player" "F:\Logiciels\BitComet\BitComet.exe"="F:\Logiciels\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client" "C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Disabled:Microsoft DirectPlay Voice Test" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger" ======List of files/folders created in the last 3 months====== 2010-01-03 19:04:35 ----D---- C:\Program Files\trend micro 2010-01-03 19:04:34 ----D---- C:\rsit 2010-01-03 19:02:14 ----A---- C:\cleannavi.txt 2010-01-03 19:01:32 ----D---- C:\Program Files\Navilog1 2010-01-03 15:53:12 ----A---- C:\WINDOWS\system32\javaws.exe 2010-01-03 15:53:11 ----A---- C:\WINDOWS\system32\javaw.exe 2010-01-03 15:53:11 ----A---- C:\WINDOWS\system32\java.exe 2010-01-03 14:43:45 ----D---- C:\Program Files\Foxit Software 2010-01-03 14:38:34 ----D---- C:\Documents and Settings\propriétaire\Application Data\Foxit 2009-12-23 22:39:17 ----D---- C:\WINDOWS\Temp 2009-12-23 21:16:18 ----A---- C:\WINDOWS\PEV.exe 2009-12-10 19:29:01 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$ 2009-12-10 19:28:04 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$ 2009-12-10 19:26:17 ----HDC---- C:\WINDOWS\$NtUninstallKB973904$ 2009-12-10 19:24:29 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$ 2009-12-10 19:24:06 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$ 2009-12-06 14:20:31 ----D---- C:\WINDOWS\system32\Adobe 2009-11-24 23:29:38 ----HDC---- C:\WINDOWS\$NtUninstallKB976098-v2$ 2009-11-24 23:29:22 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$ 2009-11-11 22:40:49 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$ 2009-10-17 23:19:23 ----D---- C:\Documents and Settings\propriétaire\Application Data\ESET 2009-10-17 23:17:16 ----D---- C:\Documents and Settings\All Users\Application Data\ESET 2009-10-11 19:42:45 ----D---- C:\Documents and Settings\propriétaire\Application Data\Office Genuine Advantage 2009-10-11 18:49:42 ----D---- C:\WINDOWS\system32\zh-TW 2009-10-11 18:49:42 ----D---- C:\WINDOWS\system32\zh-HK 2009-10-11 18:49:42 ----D---- C:\WINDOWS\system32\tr-TR 2009-10-11 18:49:42 ----D---- C:\WINDOWS\system32\sv-SE 2009-10-11 18:49:42 ----D---- C:\WINDOWS\system32\pt-BR 2009-10-11 18:49:42 ----D---- C:\WINDOWS\system32\nl-NL 2009-10-11 18:49:42 ----D---- C:\WINDOWS\system32\nb-NO 2009-10-11 18:49:42 ----D---- C:\WINDOWS\system32\ko-KR 2009-10-11 18:49:42 ----D---- C:\WINDOWS\system32\it-IT 2009-10-11 18:49:42 ----D---- C:\WINDOWS\system32\he-IL 2009-10-11 18:49:42 ----D---- C:\WINDOWS\system32\fi-FI 2009-10-11 18:49:42 ----D---- C:\WINDOWS\system32\es-ES 2009-10-11 18:49:42 ----D---- C:\WINDOWS\system32\el-GR 2009-10-11 18:49:42 ----D---- C:\WINDOWS\system32\de-DE 2009-10-11 18:49:42 ----D---- C:\WINDOWS\system32\da-DK 2009-10-11 18:49:42 ----D---- C:\WINDOWS\system32\ar-SA ======List of files/folders modified in the last 3 months====== 2010-01-03 19:04:35 ----RD---- C:\Program Files 2010-01-03 19:04:07 ----D---- C:\Documents and Settings\propriétaire\Application Data\Free Download Manager 2010-01-03 18:00:29 ----D---- C:\Temp 2010-01-03 16:22:09 ----D---- C:\WINDOWS\Prefetch 2010-01-03 16:08:21 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2010-01-03 16:08:11 ----D---- C:\WINDOWS\Debug 2010-01-03 16:08:11 ----D---- C:\WINDOWS 2010-01-03 15:57:15 ----ASH---- C:\boot.ini 2010-01-03 15:57:15 ----A---- C:\WINDOWS\win.ini 2010-01-03 15:57:15 ----A---- C:\WINDOWS\system.ini 2010-01-03 15:53:24 ----SHD---- C:\WINDOWS\Installer 2010-01-03 15:53:21 ----HD---- C:\Config.Msi 2010-01-03 15:53:12 ----D---- C:\WINDOWS\system32 2010-01-03 15:52:53 ----A---- C:\WINDOWS\system32\deploytk.dll 2010-01-03 14:40:18 ----D---- C:\Program Files\Free Download Manager 2010-01-03 14:26:08 ----D---- C:\Program Files\Protection PC 2010-01-03 14:20:52 ----D---- C:\Program Files\Fichiers communs\Adobe 2010-01-03 14:20:44 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe 2010-01-03 13:40:14 ----N---- C:\WINDOWS\SchedLgU.Txt 2010-01-01 11:29:06 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2009-12-31 18:56:26 ----D---- C:\WINDOWS\system32\drivers 2009-12-24 08:41:48 ----D---- C:\WINDOWS\system32\CatRoot2 2009-12-23 22:44:11 ----D---- C:\WINDOWS\ERUNT 2009-12-23 22:43:47 ----D---- C:\Program Files\ESET 2009-12-23 21:21:45 ----D---- C:\WINDOWS\AppPatch 2009-12-23 21:21:41 ----D---- C:\Program Files\Fichiers communs 2009-12-18 21:01:30 ----RSD---- C:\WINDOWS\Fonts 2009-12-10 19:49:51 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2009-12-10 19:47:55 ----D---- C:\Program Files\Internet Explorer 2009-12-10 19:29:12 ----HD---- C:\WINDOWS\inf 2009-12-10 19:29:08 ----RSHDC---- C:\WINDOWS\system32\dllcache 2009-12-10 19:26:14 ----HD---- C:\WINDOWS\$hf_mig$ 2009-12-10 19:25:42 ----D---- C:\WINDOWS\system32\fr-fr 2009-12-06 14:21:01 ----D---- C:\Documents and Settings\propriétaire\Application Data\Adobe 2009-12-06 14:20:34 ----SD---- C:\WINDOWS\Downloaded Program Files 2009-12-01 21:06:19 ----A---- C:\WINDOWS\system32\MRT.exe 2009-11-24 23:28:08 ----D---- C:\WINDOWS\WinSxS 2009-11-08 19:00:57 ----D---- C:\Program Files\Mozilla Firefox 2009-11-05 19:32:20 ----D---- C:\WINDOWS\ie7updates 2009-11-05 19:32:17 ----D---- C:\Program Files\Java 2009-10-29 08:44:19 ----A---- C:\WINDOWS\system32\wininet.dll 2009-10-29 08:44:19 ----A---- C:\WINDOWS\system32\webcheck.dll 2009-10-29 08:44:19 ----A---- C:\WINDOWS\system32\urlmon.dll 2009-10-29 08:44:18 ----N---- C:\WINDOWS\system32\occache.dll 2009-10-29 08:44:18 ----N---- C:\WINDOWS\system32\mstime.dll 2009-10-29 08:44:18 ----N---- C:\WINDOWS\system32\msrating.dll 2009-10-29 08:44:18 ----A---- C:\WINDOWS\system32\url.dll 2009-10-29 08:44:18 ----A---- C:\WINDOWS\system32\pngfilt.dll 2009-10-29 08:44:18 ----A---- C:\WINDOWS\system32\mshtmled.dll 2009-10-29 08:44:18 ----A---- C:\WINDOWS\system32\mshtml.dll 2009-10-29 08:44:17 ----N---- C:\WINDOWS\system32\jsproxy.dll 2009-10-29 08:44:17 ----N---- C:\WINDOWS\system32\iernonce.dll 2009-10-29 08:44:17 ----A---- C:\WINDOWS\system32\msfeedsbs.dll 2009-10-29 08:44:17 ----A---- C:\WINDOWS\system32\msfeeds.dll 2009-10-29 08:44:17 ----A---- C:\WINDOWS\system32\iertutil.dll 2009-10-29 08:44:17 ----A---- C:\WINDOWS\system32\ieframe.dll 2009-10-29 08:44:15 ----N---- C:\WINDOWS\system32\iedkcs32.dll 2009-10-29 08:44:15 ----N---- C:\WINDOWS\system32\ieaksie.dll 2009-10-29 08:44:15 ----N---- C:\WINDOWS\system32\ieakeng.dll 2009-10-29 08:44:15 ----N---- C:\WINDOWS\system32\extmgr.dll 2009-10-29 08:44:15 ----A---- C:\WINDOWS\system32\ieencode.dll 2009-10-29 08:44:15 ----A---- C:\WINDOWS\system32\ieapfltr.dll 2009-10-29 08:44:15 ----A---- C:\WINDOWS\system32\icardie.dll 2009-10-29 08:44:15 ----A---- C:\WINDOWS\system32\dxtrans.dll 2009-10-29 08:44:15 ----A---- C:\WINDOWS\system32\dxtmsft.dll 2009-10-29 08:44:14 ----N---- C:\WINDOWS\system32\corpol.dll 2009-10-29 08:44:14 ----A---- C:\WINDOWS\system32\advpack.dll 2009-10-28 16:07:15 ----A---- C:\WINDOWS\system32\tzchange.exe 2009-10-28 15:36:53 ----A---- C:\WINDOWS\system32\ieudinit.exe 2009-10-28 15:36:52 ----N---- C:\WINDOWS\system32\ie4uinit.exe 2009-10-28 07:52:46 ----N---- C:\WINDOWS\system32\ieakui.dll 2009-10-23 19:44:09 ----D---- C:\Documents and Settings\propriétaire\Application Data\Studio-Scrap 2009-10-21 06:39:43 ----A---- C:\WINDOWS\system32\strmfilt.dll 2009-10-21 06:39:43 ----A---- C:\WINDOWS\system32\httpapi.dll 2009-10-18 15:53:07 ----D---- C:\WINDOWS\Minidump 2009-10-17 18:34:15 ----D---- C:\WINDOWS\Microsoft.NET 2009-10-17 18:33:30 ----RSD---- C:\WINDOWS\assembly 2009-10-17 17:49:59 ----D---- C:\WINDOWS\system32\CatRoot 2009-10-13 11:33:37 ----A---- C:\WINDOWS\system32\oakley.dll 2009-10-12 14:39:22 ----A---- C:\WINDOWS\system32\rastls.dll 2009-10-12 14:39:22 ----A---- C:\WINDOWS\system32\raschap.dll 2009-10-11 18:49:43 ----SD---- C:\WINDOWS\Tasks 2009-10-11 18:49:42 ----D---- C:\WINDOWS\system32\en-us 2009-10-11 14:45:56 ----D---- C:\WINDOWS\Help ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 AmdK7;Pilote de processeur AMD K7; C:\WINDOWS\System32\DRIVERS\amdk7.sys [2008-04-14 41856] R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-09-11 108792] R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2009-09-11 55768] R1 HFSYS;HFSYS; \??\C:\WINDOWS\system32\drivers\HFSYS.SYS [] R2 Aspi32;Aspi32; C:\WINDOWS\system32\drivers\Aspi32.sys [1999-09-10 25244] R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-09-11 116008] R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2009-09-11 135048] R2 irda;Protocole IrDA; C:\WINDOWS\System32\DRIVERS\irda.sys [2008-04-13 88192] R3 camvid40;Philips SPC 900NC PC Camera; C:\WINDOWS\system32\DRIVERS\camdrv41.sys [2005-09-12 1239552] R3 cmuda;C-Media WDM Audio Interface; C:\WINDOWS\system32\drivers\cmuda.sys [2003-10-17 754560] R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2009-06-19 33096] R3 irsir;Pilote série infrarouge Microsoft; C:\WINDOWS\System32\DRIVERS\irsir.sys [2001-08-17 18688] R3 MBAMProtector;MBAMProtector; \??\C:\WINDOWS\system32\drivers\mbam.sys [] R3 ms_mpu401;Pilote UART MIDI MPU-401 Microsoft; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944] R3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2005-11-04 3519360] R3 Rasirda;Miniport réseau étendu (IrDA); C:\WINDOWS\System32\DRIVERS\rasirda.sys [2001-08-17 19584] R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51; C:\WINDOWS\system32\DRIVERS\sisnicxp.sys [2006-02-14 32768] R3 usbaudio;Philips USB Microphone; C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032] R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208] R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2008-04-13 17152] S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024] S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys [] S3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368] S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-02-01 49664] S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-02-01 16496] S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2005-10-22 21568] S3 LwAdiHid;Périphériques numériques WingMan Logitech (détection automatique); C:\WINDOWS\system32\DRIVERS\LwAdiHid.sys [2004-08-03 20864] S3 mbr;mbr; \??\C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\mbr.sys [] S3 msgame;Activateur de port HID vers manette de jeu Sidewinder; C:\WINDOWS\system32\DRIVERS\msgame.sys [2001-08-17 35200] S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504] S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248] S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880] S3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\System32\DRIVERS\sisnic.sys [2004-08-03 32768] S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136] S3 SONYPVU1;Pilote de filtrage Sony USB (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552] S3 StillCam;Pilote d'appareil photo numérique série; C:\WINDOWS\system32\DRIVERS\serscan.sys [2001-08-23 6912] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232] S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128] S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856] S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104] S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] S3 wceusbsh;Windows CE USB Serial Host Driver; C:\WINDOWS\system32\DRIVERS\wceusbsh.sys [2006-04-10 104576] S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000] S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] S4 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-09-28 12032] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2009-09-11 735960] R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-01-03 153376] R2 MBAMService;MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2009-12-30 235344] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\System32\nvsvc32.exe [2005-11-04 143427] R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2005-11-22 69632] R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336] S3 aspnet_state;Service d'état ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312] S3 Autocomplete;AutoComplete Service; C:\Program Files\Protection PC\Tracks Eraser Pro\autocomp.exe [2004-03-08 24064] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632] S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-09-11 20680] S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104] S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664] S3 Irmon;Moniteur infrarouge; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336] S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136] S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016] S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096] -----------------EOF----------------- D'avance merci pour votre aide Cordialement

Bonjour, désolé pour le délai ! Pas eu le temps aavnt ! Voici le rapport SYSTEMLOOK: SystemLook v1.0 by jpshortstuff (29.08.09) Log created at 16:47 on 22/09/2009 by XXXXX (Administrator - Elevation successful) ========== regfind ========== Searching for "fystemroot" No data found. -=End Of File=- Voici le rapport HIJACKTHIS: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:51:04, on 22/09/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16876) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Logitech\QuickCam\Quickcam.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\explorer.exe C:\Temp\SystemLook.exe C:\WINDOWS\notepad.exe C:\Temp\scanner.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.google.fr/keyword/%s R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6f74-2d53-2644-206d7942484f} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [MàJ Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\Tempo Lancement MAJ.vbs" O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.extrafilm.fr/ImageUploader5.cab O16 - DPF: {6414512b-b978-451d-a0d8-fcfdf33e833c} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1251584135031 O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe -- End of file - 6563 bytes Voici le rapport MBAM: Malwarebytes' Anti-Malware 1.40 Version de la base de données: 2752 Windows 5.1.2600 Service Pack 3 07/09/2009 21:06:52 mbam-log-2009-09-07 (21-06-52).txt Type de recherche: Examen complet (C:\|D:\|) Eléments examinés: 137149 Temps écoulé: 1 hour(s), 12 minute(s), 4 second(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 0 Clé(s) du Registre infectée(s): 0 Valeur(s) du Registre infectée(s): 0 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 0 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): (Aucun élément nuisible détecté) Clé(s) du Registre infectée(s): (Aucun élément nuisible détecté) Valeur(s) du Registre infectée(s): (Aucun élément nuisible détecté) Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): (Aucun élément nuisible détecté) Voici le rapport Kaspersky Online Scanner: KASPERSKY ONLINE SCANNER 7.0: scan report Saturday, September 12, 2009 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Saturday, September 12, 2009 17:01:02 Records in database: 2784345 Scan settings scan using the following database extended Scan archives yes Scan e-mail databases yes Scan area My Computer A:\ C:\ D:\ Scan statistics Objects scanned 39849 Threats found 0 Infected objects found 0 Suspicious objects found 0 Scan duration 01:27:02 No threats found. Scanned area is clean. Selected area has been scanned. D'avance merci pour votre retour

Bonjour, Je suis dispo vers 17H30 aujourd'hui. J'attends donc tes instructions. A tout à l'heure.

Bonjour Falkra, Désolé, je n'ai pas mis beaucoup d'éléments dans ma réponse. Dans regedit, je suis allé sur les clés incriminées (%fystemroot%) que nous avez trouvé "SystemLook". Dans Autorisations, j'ai donné les droits à Administrateur en contrôle total. J'ai ainsi pu changé le chemin m(remplacé %fystemroot% par %systemroot%) manuellement toutes clés ci-dessous: ========== regfind ========== Searching for "fystemroot" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITS] "ImagePath"="%fystemRoot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITS] "ImagePath"="%fystemRoot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITS] "ImagePath"="%fystemRoot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITS] "ImagePath"="%fystemRoot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITS] "ImagePath"="%fystemRoot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITS] "ImagePath"="%fystemRoot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wuauserv] "ImagePath"="%fystemroot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wuauserv] "ImagePath"="%fystemroot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wuauserv] "ImagePath"="%fystemroot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wuauserv] "ImagePath"="%fystemroot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BITS] "ImagePath"="%fystemRoot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BITS] "ImagePath"="%fystemRoot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BITS] "ImagePath"="%fystemRoot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BITS] "ImagePath"="%fystemRoot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BITS] "ImagePath"="%fystemRoot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BITS] "ImagePath"="%fystemRoot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\wuauserv] "ImagePath"="%fystemroot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\wuauserv] "ImagePath"="%fystemroot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\wuauserv] "ImagePath"="%fystemroot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\wuauserv] "ImagePath"="%fystemroot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS] "ImagePath"="%fystemRoot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS] "ImagePath"="%fystemRoot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS] "ImagePath"="%fystemRoot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS] "ImagePath"="%fystemRoot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS] "ImagePath"="%fystemRoot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS] "ImagePath"="%fystemRoot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv] "ImagePath"="%fystemroot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv] "ImagePath"="%fystemroot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv] "ImagePath"="%fystemroot%\system32\svchost.exe -k netsvcs" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv] "ImagePath"="%fystemroot%\system32\svchost.exe -k netsvcs" J'ai pris des initiatives mais je pense qu'elles étaient mesurées. Donc, les 2 services re-fonctionne mais je pense que le rootkit est très mâlin car j'ai remarqué que mon antivirus (NOD32) ne se lancait plus. J'ai voulu le désinstaller pour le ré-installer proprement. Mais à la désintallation, j'ai eu des erreurs d'accès refusé sur des clés du registre et à la ré-installation, j'ai des erreurs d'accès refusé sur des fichiers du disque (donc NOD32 n'est plus installé). D'avance merci

Bonsoir, Ci-joint le rapport combofix: ComboFix 09-08-31.04 - Lembré 01/09/2009 17:38.1.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.447.138 [GMT 2:00] Running from: c:\documents and settings\Lembré\Bureau\ComboFix.exe AV: ESET Smart Security 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} FW: Pare-feu personnel d'ESET *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0} WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\drivers\d173e42.sys . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_d173e42 ((((((((((((((((((((((((( Files Created from 2009-08-01 to 2009-09-01 ))))))))))))))))))))))))))))))) . 2009-08-31 17:44 . 2009-08-31 17:53 -------- d-----w- c:\program files\trend micro 2009-08-31 16:56 . 2009-08-31 16:56 147456 ----a-w- c:\temp\catchme.exe 2009-08-31 16:02 . 2009-08-31 16:02 102660 ----a-w- c:\temp\SystemLook.exe 2009-08-29 21:14 . 2009-08-29 21:14 7274 ----a-w- c:\temp\repar.reg 2009-08-25 19:00 . 2009-08-25 19:00 552 ----a-w- c:\windows\system32\d3d8caps.dat 2009-08-25 18:57 . 2009-08-25 18:57 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Malwarebytes 2009-08-25 18:56 . 2009-08-25 18:56 17144 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-08-25 18:55 . 2009-08-25 18:55 -------- d-----w- c:\documents and settings\Administrateur\Application Data\ESET 2009-08-25 18:53 . 2009-09-01 15:37 -------- d-----w- c:\windows\system32\CatRoot2 2009-08-25 16:37 . 2009-08-25 16:50 -------- d-----w- c:\temp\Dial-a-fix-v0.60.0.24 2009-08-24 16:54 . 2009-08-24 16:54 -------- d-----w- c:\windows\system32\CatRoot_bak 2009-08-24 16:51 . 2009-08-24 16:52 324222504 ----a-w- c:\temp\WindowsXP-KB936929-SP3-x86-FRA.exe 2009-08-12 09:37 . 2009-08-12 09:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-08-12 09:37 . 2009-08-12 09:37 -------- d-----w- c:\program files\Spybot - Search & Destroy . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-08-06 13:09 . 2008-12-27 19:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-08-05 10:13 . 2009-05-28 07:33 3942048 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 2009-08-03 11:36 . 2009-05-07 23:03 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-08-03 11:36 . 2009-05-07 23:03 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-08-01 21:04 . 2008-04-13 09:54 -------- d-----w- c:\program files\Google 2006-03-20 21:05 . 2008-03-15 13:38 45568 ----a-w- c:\program files\ATF-Cleaner.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-31 86016] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-31 7634944] "MàJ Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\Tempo Lancement MAJ.vbs" [2009-05-07 381] "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-08-03 419088] "LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 2178832] "LogitechCommunicationsManager"="c:\program files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 563984] "egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-05-14 2029640] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2006-08-01 16049664] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-10-31 1622016] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"= R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14/05/2009 15:47 107256] R2 mbamservice;mbamservice;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [08/05/2009 01:03 232720] R3 mbamprotector;mbamprotector;c:\windows\system32\drivers\mbam.sys [08/05/2009 01:03 19096] S4 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [14/05/2009 15:47 731840] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.fr/ IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000 DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-09-01 17:45 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(492) c:\windows\system32\eappprxy.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Fichiers communs\logishrd\LVCOMSER\LVComSer.exe c:\windows\system32\nvsvc32.exe c:\program files\Fichiers communs\logishrd\LVCOMSER\LVComSer.exe c:\windows\system32\HPZipm12.exe c:\program files\Fichiers communs\logishrd\LQCVFX\COCIManager.exe . ************************************************************************** . Completion time: 2009-09-01 17:52 - machine was rebooted ComboFix-quarantined-files.txt 2009-09-01 15:52 Pre-Run: 55 606 296 576 octets libres Post-Run: 55 528 607 744 octets libres Current=1 Default=1 Failed=0 LastKnownGood=3 Sets=1,3 125 --- E O F --- 2009-06-10 14:57 J'ai enfin pu réparé tous les liens contennant "%fystemroot%" dans la base de registre et ainsi pu relancer les services de mise à jour auto et transfert intelligent en arrière plan. J'attends vos prochaines instructions. cordialement

log de Gmer: GMER 1.0.15.15077 [look.exe] - http://www.gmer.net Rootkit scan 2009-08-31 20:24:02 Windows 5.1.2600 Service Pack 3 ---- System - GMER 1.0.15 ---- SSDT 836DD630 ZwAssignProcessToJobObject SSDT \SystemRoot\System32\drivers\d173e42.sys ZwCreateEvent [0xF3DA98FD] SSDT \SystemRoot\System32\drivers\d173e42.sys ZwCreateKey [0xF3DA7905] SSDT \SystemRoot\System32\drivers\d173e42.sys ZwOpenKey [0xF3DA79C5] SSDT 836DCA60 ZwOpenProcess SSDT 836DCE80 ZwOpenThread SSDT 836DD460 ZwSuspendProcess SSDT 836DD280 ZwSuspendThread SSDT 836DCC90 ZwTerminateProcess SSDT 836DD0B0 ZwTerminateThread ---- Kernel code sections - GMER 1.0.15 ---- ? C:\WINDOWS\System32\drivers\d173e42.sys Le fichier spécifié est introuvable. ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\WINDOWS\Explorer.EXE[376] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [01C22F30] C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.) IAT C:\WINDOWS\Explorer.EXE[376] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [01C22CA0] C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.) IAT C:\WINDOWS\Explorer.EXE[376] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [01C22D00] C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.) IAT C:\WINDOWS\Explorer.EXE[376] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [01C22CD0] C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.) IAT C:\Program Files\Logitech\QuickCam\Quickcam.exe[812] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [024A2F30] C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.) IAT C:\Program Files\Logitech\QuickCam\Quickcam.exe[812] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [024A2CA0] C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.) IAT C:\Program Files\Logitech\QuickCam\Quickcam.exe[812] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [024A2D00] C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.) IAT C:\Program Files\Logitech\QuickCam\Quickcam.exe[812] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [024A2CD0] C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.) IAT C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe[984] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [003D2F30] C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.) IAT C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe[984] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [003D2CA0] C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.) IAT C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe[984] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [003D2D00] C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.) IAT C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe[984] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [003D2CD0] C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.) IAT C:\Documents and Settings\Lembré\Bureau\look.exe[2616] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00802F30] C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.) IAT C:\Documents and Settings\Lembré\Bureau\look.exe[2616] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00802CA0] C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.) IAT C:\Documents and Settings\Lembré\Bureau\look.exe[2616] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00802D00] C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.) IAT C:\Documents and Settings\Lembré\Bureau\look.exe[2616] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00802CD0] C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.) ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Ntfs \Ntfs d173e42.sys AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET) AttachedDevice \Driver\Tcpip \Device\Ip epfwtdi.sys (ESET Personal Firewall TDI filter/ESET) AttachedDevice \Driver\Tcpip \Device\Ip d173e42.sys AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET) AttachedDevice \Driver\Tcpip \Device\Tcp d173e42.sys AttachedDevice \Driver\Tcpip \Device\Udp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET) AttachedDevice \Driver\Tcpip \Device\Udp d173e42.sys AttachedDevice \Driver\Tcpip \Device\RawIp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET) AttachedDevice \Driver\Tcpip \Device\RawIp d173e42.sys Device \Driver\epfwtdi \Device\Epfwtdi d173e42.sys ---- Threads - GMER 1.0.15 ---- Thread System [4:604] 836DB790 ---- Services - GMER 1.0.15 ---- Service C:\WINDOWS\System32\drivers\d173e42.sys (*** hidden *** ) [SYSTEM] d173e42 <-- ROOTKIT !!! ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\d173e42@ImagePath \SystemRoot\System32\drivers\d173e42.sys Reg HKLM\SYSTEM\CurrentControlSet\Services\d173e42@Type 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\d173e42@Start 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\d173e42@ErrorControl 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\d173e42@F96ZK6nPB YmF0dXJhbWViZWwuY29t Reg HKLM\SYSTEM\ControlSet003\Services\d173e42@ImagePath \SystemRoot\System32\drivers\d173e42.sys Reg HKLM\SYSTEM\ControlSet003\Services\d173e42@Type 1 Reg HKLM\SYSTEM\ControlSet003\Services\d173e42@Start 1 Reg HKLM\SYSTEM\ControlSet003\Services\d173e42@ErrorControl 1 Reg HKLM\SYSTEM\ControlSet003\Services\d173e42@F96ZK6nPB YmF0dXJhbWViZWwuY29t ---- EOF - GMER 1.0.15 ----

Pas d'info sur Internet de ce fameux fichier d173e42.sys. J'ai voulu l'envoyer en analyse sur le site VirusTotal mais une erreur survient à chaque fois (d'aileurs même lorsque je veux faire une analyse avec mon antivirus) J'ai executé dans CATCHME le script: Files: C:\WINDOWS\system32\drivers\d173e42.sys qui m'a créé un ctachme.zip avec le fichier incriminé. Je l'ai soumis à l'analyse du site VirusTotal et le résultat est sans appel: Fichier catchme.zip reçu le 2009.08.31 17:10:11 (UTC)Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.31 - AhnLab-V3 5.0.0.2 2009.08.31 Win-Trojan/Agent.92800.B AntiVir 7.9.1.7 2009.08.31 RKIT/Rustock.njn Antiy-AVL 2.0.3.7 2009.08.31 Trojan/Win32.Agent.gen Authentium 5.1.2.4 2009.08.31 W32/Trojan2.IFQZ Avast 4.8.1335.0 2009.08.31 Win32:RustNT AVG 8.5.0.406 2009.08.31 Win32/Rustock.M BitDefender 7.2 2009.08.31 Trojan.Generic.IS.511693 CAT-QuickHeal 10.00 2009.08.31 Trojan.Agent.coan ClamAV 0.94.1 2009.08.31 Trojan.Rustock-11 Comodo 2124 2009.08.31 UnclassifiedMalware DrWeb 5.0.0.12182 2009.08.31 - eSafe 7.0.17.0 2009.08.31 Win32.Agent.Coan eTrust-Vet 31.6.6712 2009.08.31 Win32/Rustock.FO F-Prot 4.5.1.85 2009.08.31 W32/Trojan2.IFQZ F-Secure 8.0.14470.0 2009.08.31 Trojan.Win32.Agent.coan Fortinet 3.120.0.0 2009.08.31 W32/Agent.COAN!tr GData 19 2009.08.31 Trojan.Generic.IS.511693 Ikarus T3.1.1.68.0 2009.08.31 Trojan.Win32.Agent Jiangmin 11.0.800 2009.08.31 Trojan/Agent.cswa K7AntiVirus 7.10.832 2009.08.31 Trojan.Win32.Agent.coan Kaspersky 7.0.0.125 2009.08.31 Trojan.Win32.Agent.coan McAfee 5726 2009.08.31 Generic BackDoor!ec McAfee+Artemis 5726 2009.08.31 Generic BackDoor!ec McAfee-GW-Edition 6.8.5 2009.08.31 Rootkit.Rustock.njn Microsoft 1.5005 2009.08.31 Backdoor:WinNT/Rustock.AN NOD32 4384 2009.08.31 a variant of Win32/Rustock.NJN Norman 2009.08.31 Rustock.AAN nProtect 2009.1.8.0 2009.08.31 - Panda 10.0.2.2 2009.08.31 - PCTools 4.4.2.0 2009.08.31 - Prevx 3.0 2009.08.31 - Rising 21.45.04.00 2009.08.31 - Sophos 4.45.0 2009.08.31 Mal/RKRustok-B Sunbelt 3.2.1858.2 2009.08.31 - Symantec 1.4.4.12 2009.08.31 Trojan.Pandex TheHacker 6.3.4.3.393 2009.08.31 Trojan/Agent.coan TrendMicro 8.950.0.1094 2009.08.30 TROJ_PANDEX.AX VBA32 3.12.10.10 2009.08.31 Trojan.Win32.Agent.coan ViRobot 2009.8.31.1909 2009.08.31 Backdoor.Win32.NewRest.92800 VirusBuster 4.6.5.0 2009.08.31 Rootkit.Agent.NIKD Information additionnelle File size: 92495 bytes MD5...: 39fc74e7410f3a5ff727d1bf983f4cfe SHA1..: ecbc9622a1e7ab0e103ded74633c5a41ad757fed SHA256: 7d55486743896ca6ab95b3182950be10736222863ff0e6cb2875dabd0eb5910f ssdeep: 1536:w1nl8hxyWn6DXxTDHWUoqUV8uDEVS2uFH2FLudnyikoZ17n3NVWqAGdEFWO<BR>Vc+:w1nShx76DBTDHA6DfuFHminywLDWVGdg<BR> PEiD..: - PEInfo: - RDS...: NSRL Reference Data Set<BR>- pdfid.: - trid..: ZIP compressed archive (100.0%) Je serais bien tenté de tuer avec CATCHME le service et voir si je récupére la main: Files to kill: C:\WINDOWS\system32\drivers\d173e42.sys Mais ne maîtrisant pas assez CATCHME, je préfére attendre votre avis d'expert Slts

Bonjour, Malheureusement, ca ne fonctionne pas. Toujours pas d'accès au clé. Pour info, j'ai utilisé le soft CATCHME de gmer et voici le résultat: catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-08-31 18:57:02 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d173e42] "ImagePath"="\SystemRoot\System32\drivers\d173e42.sys" "Type"=dword:00000001 "Start"=dword:00000001 "ErrorControl"=dword:00000001 "F96ZK6nPB"="YmF0dXJhbWViZWwuY29t" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\d173e42] "ImagePath"="\SystemRoot\System32\drivers\d173e42.sys" "Type"=dword:00000001 "Start"=dword:00000001 "ErrorControl"=dword:00000001 "F96ZK6nPB"="YmF0dXJhbWViZWwuY29t" scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 d173e42.sys me semble être un service douteux ?

Merci et bonsoir. Malheureusement, je ne pourrais aps demain. Mais laisse moi les choses à essayer et dès que possible, je le ferai. J'ai essayé de modifié les Autorisations dans Regedit car par exemple pour la clé BITS, impossible d'ajouter des autorisations ni mon compte utilisateur. Je pense que la solution est par là ! A+

Toujours pareil dans OTM et dans systemlook. Préviens moi quand c'est ton dernier message (pour ce soir j'espère) car je ne suis pas chez moi !