criri

bonsoir Angélique je te remercie beaucoup pour ton aide

et voilà le rapport HJT Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:04:31, on 23/04/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe C:\Program Files\Keyboard & Mouse Driver\StartAutorun.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Vista Start Menu\VistaStartMenu.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Program Files\Keyboard & Mouse Driver\KMConfig.exe C:\Program Files\Keyboard & Mouse Driver\KMProcess.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe C:\Program Files\Keyboard & Mouse Driver\KMWDSrv.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE C:\Program Files\Mozilla Thunderbird\thunderbird.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Administrateur\Bureau\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [KMCONFIG] C:\Program Files\Keyboard & Mouse Driver\StartAutorun.exe KMConfig.exe O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [VistaStartMenu] "C:\Program Files\Vista Start Menu\VistaStartMenu.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.google.fr/ O23 - Service: Avira AntiVir Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe O23 - Service: Avira AntiVir Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe O23 - Service: Avira AntiVir Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe O23 - Service: Avira AntiVir Premium WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Avira AntiVir Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Keyboard & Mouse Driver\KMWDSrv.exe O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe -- End of file - 4714 bytes

Voici le rapport antivir Avira AntiVir Premium Report file date: mercredi 23 avril 2008 20:45 Scanning for 1229906 virus strains and unwanted programs. Licensed to: rico piller Serial number: 1100320262-PEPWE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Boot mode: Normally booted Username: SYSTEM Computer name: TITI Version information: BUILD.DAT : 8.1.00.331 19215 Bytes 09/04/2008 16:10:00 AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:56 AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:37 LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:23 LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:40 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34 ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 13:08:58 ANTIVIR2.VDF : 7.0.3.197 1260032 Bytes 22/04/2008 19:00:36 ANTIVIR3.VDF : 7.0.3.200 13824 Bytes 22/04/2008 19:00:37 Engineversion : 8.1.0.32 AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21 AESCRIPT.DLL : 8.1.0.26 233850 Bytes 20/04/2008 19:52:17 AESCN.DLL : 8.1.0.14 119156 Bytes 20/04/2008 19:52:15 AERDL.DLL : 8.1.0.19 418164 Bytes 07/04/2008 15:34:44 AEPACK.DLL : 8.1.1.2 364917 Bytes 20/04/2008 19:52:13 AEOFFICE.DLL : 8.1.0.18 192890 Bytes 20/04/2008 19:52:09 AEHEUR.DLL : 8.1.0.18 1167735 Bytes 20/04/2008 19:52:06 AEHELP.DLL : 8.1.0.14 115063 Bytes 20/04/2008 19:51:40 AEGEN.DLL : 8.1.0.17 299380 Bytes 20/04/2008 19:51:39 AEEMU.DLL : 8.1.0.5 430450 Bytes 07/04/2008 15:34:43 AECORE.DLL : 8.1.0.27 168310 Bytes 20/04/2008 19:51:36 AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:53 AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:50 AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:26:47 AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:49 AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23 AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:31 SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02 SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:39 NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10 RCIMAGE.DLL : 8.0.0.31 2564353 Bytes 28/02/2008 09:19:50 RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 11:45:45 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition premium\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: on Scan all files...................: All files Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox, Macro heuristic..................: on File heuristic...................: medium Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR, Start of the scan: mercredi 23 avril 2008 20:45 Starting search for hidden objects. '35274' objects were checked, '0' hidden objects were found. The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'notepad.exe' - '1' Module(s) have been scanned Scan process 'firefox.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'thunderbird.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'avwebgrd.exe' - '1' Module(s) have been scanned Scan process 'avmailc.exe' - '1' Module(s) have been scanned Scan process 'KMWDSrv.exe' - '1' Module(s) have been scanned Scan process 'avesvc.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'CCC.exe' - '1' Module(s) have been scanned Scan process 'KMProcess.exe' - '1' Module(s) have been scanned Scan process 'KMCONFIG.exe' - '1' Module(s) have been scanned Scan process 'MOM.exe' - '1' Module(s) have been scanned Scan process 'VistaStartMenu.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'StartAutorun.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 35 processes with 35 modules were scanned Starting master boot sector scan: Master boot sector HD0 [iNFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [iNFO] No virus was found! Starting to scan the registry. The registry was scanned ( '24' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe [DETECTION] Contains detection pattern of the application APPL/Tool.NirCmd.D [DETECTION] Contains detection pattern of the application APPL/Rmadmin.131072 [DETECTION] Contains detection pattern of the SPR/Tool.PV program [NOTE] The file was moved to '487c8505.qua'! C:\QooBox\Quarantine\C\WINDOWS\system32\geBuRJYO.dll.vir [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48518620.qua'! C:\QooBox\Quarantine\C\WINDOWS\system32\ljJAPHxV.VIR.vir [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48598629.qua'! C:\System Volume Information\_restore{2A5D4203-48A8-4B20-A41D-23BEB1D98392}\RP1\A0000126.exe [DETECTION] Contains detection pattern of the SPR/Tool.Hardoff.A program [NOTE] The file was moved to '483f85f6.qua'! C:\System Volume Information\_restore{2A5D4203-48A8-4B20-A41D-23BEB1D98392}\RP3\A0000202.exe [DETECTION] Contains detection pattern of the application APPL/Tool.NirCmd.D [DETECTION] Contains detection pattern of the application APPL/Rmadmin.131072 [DETECTION] Contains detection pattern of the SPR/Tool.PV program [NOTE] The file was moved to '483f8601.qua'! End of the scan: mercredi 23 avril 2008 20:59 Used time: 14:19 min The scan has been done completely. 3678 Scanning directories 115063 Files were scanned 9 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 5 files were moved to quarantine 0 files were renamed 1 Files cannot be scanned 115054 Files not concerned 1159 Archives were scanned 1 Warnings 5 Notes 35274 Objects were scanned with rootkit scan 0 Hidden objects were found

Voici le rapport combofix ComboFix 08-04-20.5 - Administrateur 2008-04-23 20:38:35.2 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.820 [GMT 2:00] Endroit: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Administrateur\Bureau\CFScript.txt * Création d'un nouveau point de restauration AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !! FILE :: C:\WINDOWS\system32\dumphive.exe C:\WINDOWS\system32\IEDFix.exe C:\WINDOWS\system32\ljJAPHxV.VIR C:\WINDOWS\system32\ljJASmlM.dll C:\WINDOWS\system32\Process.exe C:\WINDOWS\system32\SrchSTS.exe C:\WINDOWS\system32\ssqNDtUK.dll C:\WINDOWS\system32\VACFix.exe C:\WINDOWS\system32\VCCLSID.exe C:\WINDOWS\system32\WS2Fix.exe C:\WINDOWS\system32\yayvSiHX.dll C:\WINDOWS\system32\yayvuTjG.dll C:\WINDOWS\system32\yaywtuuT.dll . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\VundoFix Backups C:\WINDOWS\system32\dumphive.exe C:\WINDOWS\system32\IEDFix.exe C:\WINDOWS\system32\ljJAPHxV.VIR C:\WINDOWS\system32\ljJASmlM.dll C:\WINDOWS\system32\Process.exe C:\WINDOWS\system32\SrchSTS.exe C:\WINDOWS\system32\ssqNDtUK.dll C:\WINDOWS\system32\VACFix.exe C:\WINDOWS\system32\VCCLSID.exe C:\WINDOWS\system32\WS2Fix.exe C:\WINDOWS\system32\yayvSiHX.dll C:\WINDOWS\system32\yayvuTjG.dll C:\WINDOWS\system32\yaywtuuT.dll . ((((((((((((((((((((((((((((( Fichiers créés 2008-03-23 to 2008-04-23 )))))))))))))))))))))))))))))))))))) . 2008-04-22 20:46 . 2008-04-22 20:46 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG 2008-04-22 20:32 . 2008-04-22 20:33 <REP> d-------- C:\HJT 2008-04-22 20:20 . 2008-04-22 20:20 17,144 --a------ C:\Documents and Settings\Administrateur\Application Data\GDIPFONTCACHEV1.DAT 2008-04-21 21:59 . 2008-04-21 21:59 1,868 --a------ C:\WINDOWS\system32\tmp.reg 2008-04-21 01:50 . 2008-04-21 03:30 1,064,662,528 --a------ C:\MeuhMeuhTV08-04-21_01-50-00_01.avi 2008-04-20 22:28 . 2008-04-20 22:28 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Avira 2008-04-20 21:42 . 2008-04-20 21:42 <REP> d-------- C:\Program Files\Avira 2008-04-20 10:17 . 2008-04-20 10:51 <REP> d-------- C:\Program Files\Spyware Doctor 2008-04-20 09:44 . 2008-04-20 09:44 <REP> d-------- C:\Documents and Settings\LocalService\Mes documents 2008-04-20 09:41 . 2008-04-20 09:41 1,024 --ah----- C:\Documents and Settings\Default User\NtUser.dat.LOG 2008-04-20 09:40 . 2008-04-20 09:40 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Nero 2008-04-20 09:36 . 2008-04-20 09:36 <REP> d-------- C:\Program Files\Nero 2008-04-20 09:36 . 2008-04-20 10:51 <REP> d-------- C:\Program Files\Fichiers communs\Nero 2008-04-20 09:36 . 2008-04-20 10:51 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero 2008-04-19 09:06 . 2008-04-19 09:06 <REP> d-------- C:\WINDOWS\Downloaded Installations 2008-04-19 09:06 . 2008-04-19 09:06 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Leadertech 2008-04-19 09:05 . 2008-04-19 09:06 <REP> d-------- C:\Program Files\Executive Software 2008-04-19 08:56 . 2008-04-19 08:56 <REP> d-------- C:\Program Files\TuneUp Utilities 2008 2008-04-19 08:56 . 2008-04-19 08:56 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software 2008-04-19 08:56 . 2008-04-19 08:56 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\TuneUp Software 2008-04-19 08:56 . 2008-04-19 08:56 306,432 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe 2008-04-19 08:56 . 2007-12-20 10:41 29,440 --a------ C:\WINDOWS\system32\uxtuneup.dll 2008-04-19 08:55 . 2008-04-19 08:55 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard 2008-04-18 21:37 . 2008-04-18 21:37 <REP> d-------- C:\Program Files\uTorrent 2008-04-18 21:36 . 2008-04-21 20:59 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\uTorrent 2008-04-16 21:08 . 2008-04-16 21:10 14,827,008 --a------ C:\MeuhMeuhTV08-04-16_21-08-58_01.avi 2008-04-16 11:19 . 2008-04-16 11:19 <REP> d-------- C:\Program Files\Driver-Soft 2008-04-16 11:19 . 2004-03-09 16:45 662,288 --a------ C:\WINDOWS\system32\MSCOMCT2.OCX 2008-04-16 11:19 . 2004-06-14 14:56 427,864 --a------ C:\WINDOWS\system32\XceedZip.dll 2008-04-16 10:07 . 2008-04-16 10:07 <REP> d-------- C:\Documents and Settings\All Users\Application Data\ATI 2008-04-16 10:01 . 2008-01-10 04:35 3,107,788 -ra------ C:\WINDOWS\system32\ativvaxx.dat 2008-04-16 10:01 . 2008-01-10 04:35 3,107,788 -ra------ C:\WINDOWS\system32\ativva5x.dat 2008-04-16 10:01 . 2008-01-10 04:35 887,724 -ra------ C:\WINDOWS\system32\ativva6x.dat 2008-04-16 10:01 . 2008-01-09 21:05 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe 2008-04-16 10:01 . 2008-01-10 05:07 368,640 -ra------ C:\WINDOWS\system32\ATIDEMGX.dll 2008-04-16 10:01 . 2008-01-10 04:58 307,200 -ra------ C:\WINDOWS\system32\atiiiexx.dll 2008-04-16 10:01 . 2008-01-07 16:43 165,782 -ra------ C:\WINDOWS\system32\atiicdxx.dat 2008-04-16 10:01 . 2007-08-31 16:20 7,167 -ra------ C:\WINDOWS\system32\atifglpf.xml 2008-04-16 10:00 . 2008-04-16 10:04 <REP> d-------- C:\Program Files\ATI Technologies 2008-04-16 09:54 . 2008-04-16 09:54 10 --a------ C:\WINDOWS\WININIT.INI 2008-04-16 09:47 . 2008-01-10 05:07 368,640 -ra------ C:\WINDOWS\system32\SET7B.tmp 2008-04-14 20:56 . 2008-04-14 20:56 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\ATI 2008-04-14 20:50 . 2008-04-14 20:50 <REP> d-------- C:\Program Files\Fichiers communs\ATI Technologies 2008-04-14 18:43 . 2007-12-04 16:44 23,600 --a------ C:\WINDOWS\system32\drivers\TVICHW32.SYS 2008-04-10 13:03 . 2008-04-10 13:03 <REP> d-------- C:\Program Files\Keyboard & Mouse Driver 2008-04-10 13:03 . 2007-03-29 15:00 17,024 --a------ C:\WINDOWS\system32\drivers\KMWDFilter.SYS 2008-04-10 12:59 . 2008-04-10 12:59 <REP> d--h----- C:\WINDOWS\PIF 2008-04-06 00:59 . 2008-04-06 02:34 1,011,906,560 --a------ C:\MeuhMeuhTV08-04-06_00-59-28_01.avi 2008-04-05 23:56 . 2008-04-06 00:28 <REP> d-------- C:\Program Files\K-Lite Codec Pack 2008-04-05 23:56 . 2004-07-29 02:23 401,408 --a------ C:\WINDOWS\system32\lameACM.acm 2008-04-05 23:56 . 2004-02-04 22:11 81,920 --a------ C:\WINDOWS\system32\ac3acm.acm 2008-04-05 23:56 . 2004-04-18 12:34 401 --a------ C:\WINDOWS\system32\lame_acm.xml 2008-04-05 20:07 . 2008-04-06 00:18 <REP> d-------- C:\Documents and Settings\All Users\Application Data\ATI(2) 2008-04-05 19:19 . 2008-04-11 21:56 <REP> d-------- C:\Program Files\Lavalys 2008-04-05 19:18 . 2008-04-05 19:19 <REP> d-------- C:\WINDOWS\system32\NtmsData 2008-04-05 19:08 . 2008-04-05 19:08 <REP> d-------- C:\ATI 2008-04-05 18:54 . 2008-04-14 17:41 <REP> d-------- C:\Program Files\ma-config.com 2008-04-05 18:54 . 2008-04-16 09:10 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\ma-config.com 2008-04-05 18:14 . 2007-11-20 10:23 11,874 -ra------ C:\WINDOWS\atiogl.xml 2008-04-05 18:14 . 2008-04-05 18:14 0 --a------ C:\WINDOWS\ativpsrm.bin 2008-04-01 11:14 . 2008-04-01 11:14 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\vlc 2008-03-31 11:27 . 2008-03-31 11:27 <REP> d-------- C:\Program Files\VideoLAN 2008-03-31 10:27 . 2008-03-31 10:28 <REP> d-------- C:\Program Files\Fichiers communs\Adobe 2008-03-31 09:50 . 2008-03-31 09:50 385 --a------ C:\WINDOWS\ODBC.INI 2008-03-31 09:49 . 2008-04-01 11:21 <REP> d-------- C:\WINDOWS\ShellNew 2008-03-30 11:31 . 2008-04-23 20:36 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Vista Start Menu 2008-03-28 23:30 . 2008-04-14 18:43 3,249 --a------ C:\WINDOWS\mozver.dat 2008-03-28 23:19 . 2008-03-28 23:19 <REP> d-------- C:\Program Files\e-Carte Bleue Banque Populaire 2008-03-28 22:44 . 2008-03-30 11:33 <REP> d-------- C:\Program Files\Vista Start Menu 2008-03-28 22:42 . 2008-03-28 22:42 <REP> d-------- C:\Program Files\AVIConverter 2008-03-28 20:45 . 2008-04-16 22:36 3,477,504 --a------ C:\Money1.mny 2008-03-28 20:26 . 2008-03-28 20:26 <REP> d-------- C:\Program Files\Microsoft Money 2008-03-28 17:18 . 2008-04-15 18:49 <REP> d-------- C:\Program Files\Dofus 2008-03-28 15:51 . 2008-03-28 15:51 <REP> d---s---- C:\Documents and Settings\Administrateur\UserData 2008-03-27 23:12 . 2008-03-27 23:38 <REP> d-------- C:\Program Files\MeuhMeuhTV 2008-03-27 22:17 . 2008-03-27 22:17 <REP> d-------- C:\Program Files\hp deskjet 3420 series 2008-03-27 22:17 . 2008-03-27 22:18 <REP> d-------- C:\Program Files\Hewlett-Packard 2008-03-27 22:17 . 2008-03-27 22:17 800 --a------ C:\WINDOWS\hpinfo.lnk 2008-03-27 22:15 . 2004-08-04 00:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-03-27 22:15 . 2004-08-04 00:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2008-03-24 02:47 . 2008-03-24 02:47 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Talkback 2008-03-24 02:14 . 2008-04-23 20:11 <REP> d-------- C:\Program Files\Mozilla Thunderbird 2008-03-24 02:14 . 2008-03-24 02:14 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Thunderbird 2008-03-24 01:46 . 2008-03-24 01:46 0 --a------ C:\WINDOWS\nsreg.dat 2008-03-24 00:41 . 2008-04-20 21:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira 2008-03-23 23:52 . 2008-03-23 23:52 <REP> d-------- C:\Program Files\Windows Media Connect 2 2008-03-23 23:52 . 2006-10-04 16:06 1,197,294 -----c--- C:\WINDOWS\system32\dllcache\sysmain.sdb 2008-03-23 23:52 . 2006-10-04 16:06 764,868 -----c--- C:\WINDOWS\system32\dllcache\apph_sp.sdb 2008-03-23 23:52 . 2006-10-04 16:06 217,118 -----c--- C:\WINDOWS\system32\dllcache\apphelp.sdb 2008-03-23 23:51 . 2008-03-23 23:51 <REP> d-------- C:\WINDOWS\system32\LogFiles 2008-03-23 23:51 . 2008-03-23 23:52 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF 2008-03-23 23:48 . 2008-03-23 23:48 <REP> d-------- C:\Documents and Settings\LocalService\Menu Démarrer 2008-03-23 23:41 . 2008-03-23 23:41 <REP> d-------- C:\WINDOWS\ServicePackFiles 2008-03-23 23:39 . 2006-09-25 18:58 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-03-23 23:39 . 2004-07-17 12:40 19,528 --a------ C:\WINDOWS\002331_.tmp 2008-03-23 23:38 . 2008-03-23 23:43 <REP> d-------- C:\WINDOWS\EHome 2008-03-23 21:57 . 2001-08-17 22:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2008-03-23 21:56 . 2004-08-04 01:39 58,496 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2008-03-23 21:56 . 2004-08-04 01:54 21,504 --a------ C:\WINDOWS\system32\hidserv.dll 2008-03-23 21:35 . 2008-04-22 20:51 <REP> d-------- C:\WINDOWS\system32\CatRoot2 2008-03-23 21:35 . 2008-03-23 21:35 <REP> d--h----- C:\Documents and Settings\Default User\Voisinage réseau 2008-03-23 21:35 . 2008-03-23 21:35 <REP> d--h----- C:\Documents and Settings\Default User\Voisinage d'impression 2008-03-23 21:35 . 2008-03-23 22:06 <REP> d--h----- C:\Documents and Settings\Default User\Modèles 2008-03-23 21:35 . 2008-03-23 21:35 <REP> d-------- C:\Documents and Settings\Default User\Mes documents 2008-03-23 21:35 . 2008-03-23 21:35 <REP> dr------- C:\Documents and Settings\Default User\Menu Démarrer 2008-03-23 21:35 . 2008-03-23 21:35 <REP> d-------- C:\Documents and Settings\Default User\Favoris 2008-03-23 21:35 . 2008-03-23 21:35 <REP> d-------- C:\Documents and Settings\Default User\Bureau 2008-03-23 21:35 . 2008-03-23 21:35 <REP> d--h----- C:\Documents and Settings\All Users\Modèles 2008-03-23 21:35 . 2008-04-06 00:23 <REP> dr------- C:\Documents and Settings\All Users\Menu Démarrer 2008-03-23 21:35 . 2008-03-23 21:35 <REP> d-------- C:\Documents and Settings\All Users\Favoris 2008-03-23 21:35 . 2008-03-23 23:48 <REP> dr------- C:\Documents and Settings\All Users\Documents 2008-03-23 21:35 . 2008-04-20 10:17 <REP> d-------- C:\Documents and Settings\All Users\Bureau . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-14 18:45 --------- d-----w C:\Program Files\Fichiers communs\InstallShield 2008-04-10 11:03 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-03-23 20:53 --------- d-----w C:\Program Files\Intel 2008-03-23 20:18 --------- d-----w C:\Program Files\microsoft frontpage 2008-03-23 20:08 558,142 ----a-w C:\WINDOWS\java\Packages\3JP3BDVP.ZIP 2008-03-23 20:08 155,995 ----a-w C:\WINDOWS\java\Packages\0VJFHN5N.ZIP 2008-03-23 20:07 --------- d-----w C:\Program Files\Services en ligne . ((((((((((((((((((((((((((((( snapshot@2008-04-22_20.51.07.31 ))))))))))))))))))))))))))))))))))))))))) . - 2008-04-22 18:49:15 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-04-23 18:11:21 2,048 --s-a-w C:\WINDOWS\bootstat.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:54 15360] "VistaStartMenu"="C:\Program Files\Vista Start Menu\VistaStartMenu.exe" [2007-12-12 13:53 1704624] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "KMCONFIG"="C:\Program Files\Keyboard & Mouse Driver\StartAutorun.exe" [2007-03-06 14:51 212992] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [2008-02-12 10:06 262401] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:54 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.lameacm"= lameACM.acm "vidc.3iv2"= 3ivxVfWCodec.dll "VIDC.HFYU"= huffyuv.dll "VIDC.VP31"= vp31vfw.dll "msacm.ac3acm"= ac3acm.acm [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility] --a------ 2002-06-21 12:19 188416 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent] --a------ 2003-06-18 13:00 204800 C:\Program Files\Microsoft Money\System\mnyexpr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-08-04 01:55 1667584 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= R2 AntiVirMailService;Avira AntiVir Premium MailGuard;"C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe" [2008-03-26 15:35] R2 antivirwebservice;Avira AntiVir Premium WebGuard;"C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE" [2008-04-09 15:57] R2 AVEService;Avira AntiVir Premium MailGuard helper service;"C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe" [2008-02-07 10:06] R2 KMWDSERVICE;Keyboard And Mouse Communication Service;C:\Program Files\Keyboard & Mouse Driver\KMWDSrv.exe [2007-04-05 10:29] R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-04 01:55] R3 HCWBT8xx;Hauppauge WinTV 848/9 WDM Video Driver;C:\WINDOWS\system32\drivers\HCWBT8XX.sys [2005-03-02 19:44] R3 KMWDFilter;KMWDFilter;C:\WINDOWS\System32\Drivers\KMWDFilter.SYS [2007-03-29 15:00] S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-04-19 08:56] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp *Newly Created Service* - CATCHME . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2008-04-19 06:56:47 C:\WINDOWS\Tasks\Maintenance en 1 clic.job" - C:\Program Files\TuneUp Utilities 2008\OneClick.exe . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-23 20:39:31 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-04-23 20:40:00 ComboFix-quarantined-files.txt 2008-04-23 18:39:58 ComboFix2.txt 2008-04-22 18:51:20 Pre-Run: 153,007,308,800 octets libres Post-Run: 152,993,005,568 octets libres 237

bonsoir angelique voici le rapport de combo fix ComboFix 08-04-20.5 - Administrateur 2008-04-22 20:46:40.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.836 [GMT 2:00] Endroit: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Administrateur\Bureau\CFScript.txt AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !! FILE :: C:\WINDOWS\SYSTEM32\geBuRJYO.dll . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\SYSTEM32\geBuRJYO.dll C:\WINDOWS\system32\VxHPAJjl.ini C:\WINDOWS\system32\VxHPAJjl.ini2 . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-03-22 to 2008-04-22 )))))))))))))))))))))))))))))))))))) . 2008-04-22 20:46 . 2008-04-22 20:46 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG 2008-04-22 20:32 . 2008-04-22 20:33 <REP> d-------- C:\HJT 2008-04-22 20:20 . 2008-04-22 20:20 17,144 --a------ C:\Documents and Settings\Administrateur\Application Data\GDIPFONTCACHEV1.DAT 2008-04-22 18:20 . 2008-04-22 18:20 <REP> d-------- C:\VundoFix Backups 2008-04-22 18:17 . 2008-04-22 18:18 272,384 --a------ C:\WINDOWS\system32\ljJAPHxV.VIR 2008-04-21 22:08 . 2008-04-21 22:08 1,088 --a------ C:\WINDOWS\system32\ljJASmlM.dll 2008-04-21 21:59 . 2008-04-21 21:59 1,868 --a------ C:\WINDOWS\system32\tmp.reg 2008-04-21 21:58 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-04-21 21:58 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-04-21 21:58 . 2008-04-14 19:28 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-04-21 21:58 . 2008-04-21 10:01 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-04-21 21:58 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-04-21 21:58 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-04-21 21:58 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-04-21 21:08 . 2008-04-21 21:08 1,088 --a------ C:\WINDOWS\system32\ssqNDtUK.dll 2008-04-21 20:27 . 2008-04-21 20:27 1,088 --a------ C:\WINDOWS\system32\yayvuTjG.dll 2008-04-21 19:28 . 2008-04-21 19:28 1,088 --a------ C:\WINDOWS\system32\yaywtuuT.dll 2008-04-21 01:50 . 2008-04-21 03:30 1,064,662,528 --a------ C:\MeuhMeuhTV08-04-21_01-50-00_01.avi 2008-04-20 22:28 . 2008-04-20 22:28 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Avira 2008-04-20 21:49 . 2008-04-20 21:49 1,088 --a------ C:\WINDOWS\system32\yayvSiHX.dll 2008-04-20 21:42 . 2008-04-20 21:42 <REP> d-------- C:\Program Files\Avira 2008-04-20 10:17 . 2008-04-20 10:51 <REP> d-------- C:\Program Files\Spyware Doctor 2008-04-20 09:44 . 2008-04-20 09:44 <REP> d-------- C:\Documents and Settings\LocalService\Mes documents 2008-04-20 09:41 . 2008-04-20 09:41 1,024 --ah----- C:\Documents and Settings\Default User\NtUser.dat.LOG 2008-04-20 09:40 . 2008-04-20 09:40 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Nero 2008-04-20 09:36 . 2008-04-20 09:36 <REP> d-------- C:\Program Files\Nero 2008-04-20 09:36 . 2008-04-20 10:51 <REP> d-------- C:\Program Files\Fichiers communs\Nero 2008-04-20 09:36 . 2008-04-20 10:51 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero 2008-04-19 09:06 . 2008-04-19 09:06 <REP> d-------- C:\WINDOWS\Downloaded Installations 2008-04-19 09:06 . 2008-04-19 09:06 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Leadertech 2008-04-19 09:05 . 2008-04-19 09:06 <REP> d-------- C:\Program Files\Executive Software 2008-04-19 08:56 . 2008-04-19 08:56 <REP> d-------- C:\Program Files\TuneUp Utilities 2008 2008-04-19 08:56 . 2008-04-19 08:56 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software 2008-04-19 08:56 . 2008-04-19 08:56 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\TuneUp Software 2008-04-19 08:56 . 2008-04-19 08:56 306,432 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe 2008-04-19 08:56 . 2007-12-20 10:41 29,440 --a------ C:\WINDOWS\system32\uxtuneup.dll 2008-04-19 08:55 . 2008-04-19 08:55 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard 2008-04-18 21:37 . 2008-04-18 21:37 <REP> d-------- C:\Program Files\uTorrent 2008-04-18 21:36 . 2008-04-21 20:59 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\uTorrent 2008-04-16 21:08 . 2008-04-16 21:10 14,827,008 --a------ C:\MeuhMeuhTV08-04-16_21-08-58_01.avi 2008-04-16 11:19 . 2008-04-16 11:19 <REP> d-------- C:\Program Files\Driver-Soft 2008-04-16 11:19 . 2004-03-09 16:45 662,288 --a------ C:\WINDOWS\system32\MSCOMCT2.OCX 2008-04-16 11:19 . 2004-06-14 14:56 427,864 --a------ C:\WINDOWS\system32\XceedZip.dll 2008-04-16 10:07 . 2008-04-16 10:07 <REP> d-------- C:\Documents and Settings\All Users\Application Data\ATI 2008-04-16 10:01 . 2008-01-10 04:35 3,107,788 -ra------ C:\WINDOWS\system32\ativvaxx.dat 2008-04-16 10:01 . 2008-01-10 04:35 3,107,788 -ra------ C:\WINDOWS\system32\ativva5x.dat 2008-04-16 10:01 . 2008-01-10 04:35 887,724 -ra------ C:\WINDOWS\system32\ativva6x.dat 2008-04-16 10:01 . 2008-01-09 21:05 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe 2008-04-16 10:01 . 2008-01-10 05:07 368,640 -ra------ C:\WINDOWS\system32\ATIDEMGX.dll 2008-04-16 10:01 . 2008-01-10 04:58 307,200 -ra------ C:\WINDOWS\system32\atiiiexx.dll 2008-04-16 10:01 . 2008-01-07 16:43 165,782 -ra------ C:\WINDOWS\system32\atiicdxx.dat 2008-04-16 10:01 . 2007-08-31 16:20 7,167 -ra------ C:\WINDOWS\system32\atifglpf.xml 2008-04-16 10:00 . 2008-04-16 10:04 <REP> d-------- C:\Program Files\ATI Technologies 2008-04-16 09:54 . 2008-04-16 09:54 10 --a------ C:\WINDOWS\WININIT.INI 2008-04-16 09:47 . 2008-01-10 05:07 368,640 -ra------ C:\WINDOWS\system32\SET7B.tmp 2008-04-14 20:56 . 2008-04-14 20:56 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\ATI 2008-04-14 20:50 . 2008-04-14 20:50 <REP> d-------- C:\Program Files\Fichiers communs\ATI Technologies 2008-04-14 18:43 . 2007-12-04 16:44 23,600 --a------ C:\WINDOWS\system32\drivers\TVICHW32.SYS 2008-04-10 13:03 . 2008-04-10 13:03 <REP> d-------- C:\Program Files\Keyboard & Mouse Driver 2008-04-10 13:03 . 2007-03-29 15:00 17,024 --a------ C:\WINDOWS\system32\drivers\KMWDFilter.SYS 2008-04-10 12:59 . 2008-04-10 12:59 <REP> d--h----- C:\WINDOWS\PIF 2008-04-06 00:59 . 2008-04-06 02:34 1,011,906,560 --a------ C:\MeuhMeuhTV08-04-06_00-59-28_01.avi 2008-04-05 23:56 . 2008-04-06 00:28 <REP> d-------- C:\Program Files\K-Lite Codec Pack 2008-04-05 23:56 . 2004-07-29 02:23 401,408 --a------ C:\WINDOWS\system32\lameACM.acm 2008-04-05 23:56 . 2004-02-04 22:11 81,920 --a------ C:\WINDOWS\system32\ac3acm.acm 2008-04-05 23:56 . 2004-04-18 12:34 401 --a------ C:\WINDOWS\system32\lame_acm.xml 2008-04-05 20:07 . 2008-04-06 00:18 <REP> d-------- C:\Documents and Settings\All Users\Application Data\ATI(2) 2008-04-05 19:19 . 2008-04-11 21:56 <REP> d-------- C:\Program Files\Lavalys 2008-04-05 19:18 . 2008-04-05 19:19 <REP> d-------- C:\WINDOWS\system32\NtmsData 2008-04-05 19:08 . 2008-04-05 19:08 <REP> d-------- C:\ATI 2008-04-05 18:54 . 2008-04-14 17:41 <REP> d-------- C:\Program Files\ma-config.com 2008-04-05 18:54 . 2008-04-16 09:10 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\ma-config.com 2008-04-05 18:14 . 2007-11-20 10:23 11,874 -ra------ C:\WINDOWS\atiogl.xml 2008-04-05 18:14 . 2008-04-05 18:14 0 --a------ C:\WINDOWS\ativpsrm.bin 2008-04-01 11:14 . 2008-04-01 11:14 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\vlc 2008-03-31 11:27 . 2008-03-31 11:27 <REP> d-------- C:\Program Files\VideoLAN 2008-03-31 10:27 . 2008-03-31 10:28 <REP> d-------- C:\Program Files\Fichiers communs\Adobe 2008-03-31 09:50 . 2008-03-31 09:50 385 --a------ C:\WINDOWS\ODBC.INI 2008-03-31 09:49 . 2008-04-01 11:21 <REP> d-------- C:\WINDOWS\ShellNew 2008-03-30 11:31 . 2008-04-21 09:44 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Vista Start Menu 2008-03-28 23:30 . 2008-04-14 18:43 3,249 --a------ C:\WINDOWS\mozver.dat 2008-03-28 23:19 . 2008-03-28 23:19 <REP> d-------- C:\Program Files\e-Carte Bleue Banque Populaire 2008-03-28 22:44 . 2008-03-30 11:33 <REP> d-------- C:\Program Files\Vista Start Menu 2008-03-28 22:42 . 2008-03-28 22:42 <REP> d-------- C:\Program Files\AVIConverter 2008-03-28 20:45 . 2008-04-16 22:36 3,477,504 --a------ C:\Money1.mny 2008-03-28 20:26 . 2008-03-28 20:26 <REP> d-------- C:\Program Files\Microsoft Money 2008-03-28 17:18 . 2008-04-15 18:49 <REP> d-------- C:\Program Files\Dofus 2008-03-28 15:51 . 2008-03-28 15:51 <REP> d---s---- C:\Documents and Settings\Administrateur\UserData 2008-03-27 23:12 . 2008-03-27 23:38 <REP> d-------- C:\Program Files\MeuhMeuhTV 2008-03-27 22:17 . 2008-03-27 22:17 <REP> d-------- C:\Program Files\hp deskjet 3420 series 2008-03-27 22:17 . 2008-03-27 22:18 <REP> d-------- C:\Program Files\Hewlett-Packard 2008-03-27 22:17 . 2008-03-27 22:17 800 --a------ C:\WINDOWS\hpinfo.lnk 2008-03-27 22:15 . 2004-08-04 00:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-03-27 22:15 . 2004-08-04 00:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2008-03-24 02:47 . 2008-03-24 02:47 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Talkback 2008-03-24 02:14 . 2008-04-22 18:24 <REP> d-------- C:\Program Files\Mozilla Thunderbird 2008-03-24 02:14 . 2008-03-24 02:14 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Thunderbird 2008-03-24 01:46 . 2008-03-24 01:46 0 --a------ C:\WINDOWS\nsreg.dat 2008-03-24 00:41 . 2008-04-20 21:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira 2008-03-23 23:52 . 2008-03-23 23:52 <REP> d-------- C:\Program Files\Windows Media Connect 2 2008-03-23 23:52 . 2006-10-04 16:06 1,197,294 -----c--- C:\WINDOWS\system32\dllcache\sysmain.sdb 2008-03-23 23:52 . 2006-10-04 16:06 764,868 -----c--- C:\WINDOWS\system32\dllcache\apph_sp.sdb 2008-03-23 23:52 . 2006-10-04 16:06 217,118 -----c--- C:\WINDOWS\system32\dllcache\apphelp.sdb 2008-03-23 23:51 . 2008-03-23 23:51 <REP> d-------- C:\WINDOWS\system32\LogFiles 2008-03-23 23:51 . 2008-03-23 23:52 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF 2008-03-23 23:48 . 2008-03-23 23:48 <REP> d-------- C:\Documents and Settings\LocalService\Menu D‚marrer 2008-03-23 23:41 . 2008-03-23 23:41 <REP> d-------- C:\WINDOWS\ServicePackFiles 2008-03-23 23:39 . 2006-09-25 18:58 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-03-23 23:39 . 2004-07-17 12:40 19,528 --a------ C:\WINDOWS\002331_.tmp 2008-03-23 23:38 . 2008-03-23 23:43 <REP> d-------- C:\WINDOWS\EHome 2008-03-23 21:57 . 2001-08-17 22:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2008-03-23 21:56 . 2004-08-04 01:39 58,496 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2008-03-23 21:56 . 2004-08-04 01:54 21,504 --a------ C:\WINDOWS\system32\hidserv.dll 2008-03-23 21:35 . 2008-04-22 20:24 <REP> d-------- C:\WINDOWS\system32\CatRoot2 2008-03-23 21:35 . 2008-03-23 21:35 <REP> d--h----- C:\Documents and Settings\Default User\Voisinage r‚seau 2008-03-23 21:35 . 2008-03-23 21:35 <REP> d--h----- C:\Documents and Settings\Default User\Voisinage d'impression 2008-03-23 21:35 . 2008-03-23 22:06 <REP> d--h----- C:\Documents and Settings\Default User\ModŠles 2008-03-23 21:35 . 2008-03-23 21:35 <REP> d-------- C:\Documents and Settings\Default User\Mes documents 2008-03-23 21:35 . 2008-03-23 21:35 <REP> dr------- C:\Documents and Settings\Default User\Menu D‚marrer 2008-03-23 21:35 . 2008-03-23 21:35 <REP> d-------- C:\Documents and Settings\Default User\Favoris 2008-03-23 21:35 . 2008-03-23 21:35 <REP> d-------- C:\Documents and Settings\Default User\Bureau 2008-03-23 21:35 . 2008-03-23 21:35 <REP> d--h----- C:\Documents and Settings\All Users\ModŠles 2008-03-23 21:35 . 2008-04-06 00:23 <REP> dr------- C:\Documents and Settings\All Users\Menu D‚marrer 2008-03-23 21:35 . 2008-03-23 21:35 <REP> d-------- C:\Documents and Settings\All Users\Favoris 2008-03-23 21:35 . 2008-03-23 23:48 <REP> dr------- C:\Documents and Settings\All Users\Documents . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-14 18:45 --------- d-----w C:\Program Files\Fichiers communs\InstallShield 2008-04-10 11:03 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-03-23 20:53 --------- d-----w C:\Program Files\Intel 2008-03-23 20:18 --------- d-----w C:\Program Files\microsoft frontpage 2008-03-23 20:08 558,142 ----a-w C:\WINDOWS\java\Packages\3JP3BDVP.ZIP 2008-03-23 20:08 155,995 ----a-w C:\WINDOWS\java\Packages\0VJFHN5N.ZIP 2008-03-23 20:07 --------- d-----w C:\Program Files\Services en ligne . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C883D0BB-2FB3-4E89-AB9E-DA0D5006C979}] C:\WINDOWS\system32\ljJAPHxV.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:54 15360] "VistaStartMenu"="C:\Program Files\Vista Start Menu\VistaStartMenu.exe" [2007-12-12 13:53 1704624] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "KMCONFIG"="C:\Program Files\Keyboard & Mouse Driver\StartAutorun.exe" [2007-03-06 14:51 212992] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [2008-02-12 10:06 262401] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:54 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geBuRJYO] geBuRJYO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.lameacm"= lameACM.acm "vidc.3iv2"= 3ivxVfWCodec.dll "VIDC.HFYU"= huffyuv.dll "VIDC.VP31"= vp31vfw.dll "msacm.ac3acm"= ac3acm.acm [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility] --a------ 2002-06-21 12:19 188416 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent] --a------ 2003-06-18 13:00 204800 C:\Program Files\Microsoft Money\System\mnyexpr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-08-04 01:55 1667584 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= R2 AntiVirMailService;Avira AntiVir Premium MailGuard;"C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe" [2008-03-26 15:35] R2 antivirwebservice;Avira AntiVir Premium WebGuard;"C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE" [2008-04-09 15:57] R2 AVEService;Avira AntiVir Premium MailGuard helper service;"C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe" [2008-02-07 10:06] R2 KMWDSERVICE;Keyboard And Mouse Communication Service;C:\Program Files\Keyboard & Mouse Driver\KMWDSrv.exe [2007-04-05 10:29] R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-04 01:55] R3 HCWBT8xx;Hauppauge WinTV 848/9 WDM Video Driver;C:\WINDOWS\system32\drivers\HCWBT8XX.sys [2005-03-02 19:44] R3 KMWDFilter;KMWDFilter;C:\WINDOWS\System32\Drivers\KMWDFilter.SYS [2007-03-29 15:00] S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-04-19 08:56] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2008-04-19 06:56:47 C:\WINDOWS\Tasks\Maintenance en 1 clic.job" - C:\Program Files\TuneUp Utilities 2008\OneClick.exe . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-22 20:49:54 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\ati2evxx.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe C:\Program Files\Keyboard & Mouse Driver\KMCONFIG.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\Keyboard & Mouse Driver\KMProcess.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe C:\WINDOWS\system32\wscntfy.exe . ************************************************************************** . Temps d'accomplissement: 2008-04-22 20:51:20 - machine was rebooted ComboFix-quarantined-files.txt 2008-04-22 18:51:17 Pre-Run: 152,001,175,552 octets libres Post-Run: 152,847,122,432 octets libres 237

salut j'ai essayé la methode de Pear mais vundo fix ne detecte rien mais mon antivirus lui m'ouvre cette fenetre toute les 5 secondes. mais pas moyen de le supprimer ou de le mettre en quarantaine ni quoi que ce soit.

SmitFraudFix v2.315 Rapport fait à 21:59:19,01, 21/04/2008 Executé à partir de C:\Documents and Settings\Administrateur\Bureau\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT Le type du système de fichiers est NTFS Fix executé en mode normal »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe C:\Program Files\Keyboard & Mouse Driver\StartAutorun.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Vista Start Menu\VistaStartMenu.exe C:\Program Files\Keyboard & Mouse Driver\KMConfig.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe C:\Program Files\Keyboard & Mouse Driver\KMProcess.exe C:\Program Files\Keyboard & Mouse Driver\KMWDSrv.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Thunderbird\thunderbird.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\WinRAR\WinRAR.exe C:\WINDOWS\system32\cmd.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\Favoris »»»»»»»»»»»»»»»»»»»»»»»» Bureau »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Ma page d'accueil" »»»»»»»»»»»»»»»»»»»»»»»» IEDFix !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» VACFix !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"="C:\\WINDOWS\\system32\\userinit.exe," "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Rustock »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: Intel® PRO/100 VE Network Connection - Miniport d'ordonnancement de paquets DNS Server Search Order: 192.168.0.1 HKLM\SYSTEM\CCS\Services\Tcpip\..\{F792A8F9-8FCE-41A1-AAEE-B052C1ECF402}: DhcpNameServer=192.168.0.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{F792A8F9-8FCE-41A1-AAEE-B052C1ECF402}: DhcpNameServer=192.168.0.1 HKLM\SYSTEM\CS3\Services\Tcpip\..\{F792A8F9-8FCE-41A1-AAEE-B052C1ECF402}: DhcpNameServer=192.168.0.1 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll »»»»»»»»»»»»»»»»»»»»»»»» Fin

bonsoir à tous je suis infester par un troyan Logfile of HijackThis v1.99.1 Scan saved at 21:14:39, on 21/04/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe C:\Program Files\Keyboard & Mouse Driver\StartAutorun.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Vista Start Menu\VistaStartMenu.exe C:\Program Files\Keyboard & Mouse Driver\KMConfig.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe C:\Program Files\Keyboard & Mouse Driver\KMProcess.exe C:\Program Files\Keyboard & Mouse Driver\KMWDSrv.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.047\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.fr/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file) O2 - BHO: (no name) - {F3AEF888-A3E2-44EB-BD85-F0C85BA7673F} - C:\WINDOWS\system32\geBuRJYO.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [KMCONFIG] C:\Program Files\Keyboard & Mouse Driver\StartAutorun.exe KMConfig.exe O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [VistaStartMenu] "C:\Program Files\Vista Start Menu\VistaStartMenu.exe" O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'avsda.dll' missing O14 - IERESET.INF: START_PAGE_URL=http://www.google.fr/ O20 - Winlogon Notify: geBuRJYO - C:\WINDOWS\SYSTEM32\geBuRJYO.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Avira AntiVir Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe O23 - Service: Avira AntiVir Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe O23 - Service: Avira AntiVir Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe O23 - Service: Avira AntiVir Premium WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Avira AntiVir Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Keyboard & Mouse Driver\KMWDSrv.exe O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe j'ai essayé de faire fix check en cochant O2 - BHO: (no name) - {F3AEF888-A3E2-44EB-BD85-F0C85BA7673F} - C:\WINDOWS\system32\geBuRJYO.dll O20 - Winlogon Notify: geBuRJYO - C:\WINDOWS\SYSTEM32\geBuRJYO.dll mais pas moyen d'eradiquer merci pour votre aide.

Pour eradiquer mon point d'exclamation jaune devant pci device j'ai fait : panneau de configuration systéme matériel gestionnaire de périphériques clic droit sur pci device(là ou il y a le pb) mettre à jour le pilote choisir sa mise à jour selectionner moniteur et la windows installe le pilote manquant Microsoft UAA bus driver for high definition audio j'espére avoir été clair

Bon ça y est j'ai résolu mes problemes mais ma carte graphique chauffe et si je ne laisse pas mon boitier ouvert sur le coté mon ventilateur du processeur tourne comme un fou pour refroidir la tour je pense. comment puis je remedier au pb.

Bon ça y est j'ai résolu mes problemes mais ma carte graphique chauffe et si je ne laisse pas mon boitier ouvert sur le coté mon ventilateur du processeur tourne comme un fou pour refroidir la tour je pense. comment puis je remedier au pb.

premier pb resolu par contre au demarrage de windows j'ai un ecran noir jusqu'a l'ouverture de mon bureau,je n'ai plus le windows XP avec le curseur qui défile. De plus quand je fais F2 mon pc (bip à chaque fois que j'appui sur la touche) ne vas plus dans le bios mais il tourne et ne démarre pas si quelqu'un peut éclairer ma lanterne

alors revenons à nos pb initiaux afin de pas embrouiller le probléme. Merci

salut moi g une alimentation de 250w et cette carte fonctionne à merveille. pb de pci device résolu. pb de transfert tv résolu aussi.

salut à tous à force de bidouiller j'ai réussi à résoudre mon probleme. mercià tous ceux qui ont éclairer ma lanterne

ok merci pb resolu.

voici ma config Version du plugin 2.0.4.13 Système d'exploitation Windows XP Professionnel (build 2600) Service Pack 2 Navigateur web par défaut: Mozilla Firefox Client e-mail par défaut: Mozilla Thunderbird Carte mère SMBios version 2.3 Dell Computer Corp. 0U2575 Bios: Dell Computer Corporation A07 01/21/2005 taille: 512Kb Processeur Intel® Pentium® 4 CPU 2.80GHz (2793Mhz) (L1: 28ko L2: 1024ko ) Chipset Northbridge: Intel 82865G/PE/P/848P Southbridge: Intel 82801EB/ER (ICH5/R) Mémoire Barette de 1024 Mo 333 Mhz Barette de 256 Mo 333 Mhz mémoire windows (cette valeur ne correspond pas exactement à la mémoire totale physique): 1270Mo Péripheriques IDE Maxtor 6Y160P0 YAR41BW0 (ATA, 152.67 Go, tampon: 7 Mo) Lecteurs CD/DVD HL-DT-STDVD+-RW GWA4164BD108 (DVD+R/DL Recorder) LITE-ON DVD SOHD-167T 99C2 (DVD-ROM) Disque dur Maxtor 6Y160P0 (152.66Go) Cartes PCI/AGP Stockage Intel Corporation:82801EB/ER (ICH5/ICH5R) IDE Controller Intel Corporation:82801EB (ICH5) SATA Controller Réseau Intel Corporation:82562EZ 10/100 Ethernet Controller Affichage Intel Corporation:82865G Integrated Graphics Controller Materiel non reconnu (V:ATI Technologies Inc,D:0x94cc) Multimedia Intel Corporation:82801EB/ER (ICH5/ICH5R) AC97 Audio Controller Brooktree Corporation:Bt878 Video Capture: WinTV Series Brooktree Corporation:Bt878 Audio Capture: WinTV Series ATI Technologies Inc:RV610 audio device [Radeon HD 2400 PRO] Ponts Intel Corporation:82865G/PE/P DRAM Controller/Host-Hub Interface Intel Corporation:82801 PCI Bridge: 82801 PCI Bridge Intel Corporation:82801EB/ER (ICH5/ICH5R) LPC Interface Bridge: 82801EB/ER (ICH5/ICH5R) LPC Interface Bridge PLX Technology, Inc.:PEX 8111 PCI Express-to-PCI Bridge: PEX 8111 PCI Express-to-PCI Bridge Bus Series Intel Corporation:82801EB/ER (ICH5/ICH5R) USB UHCI Controller #1 Intel Corporation:82801EB/ER (ICH5/ICH5R) USB UHCI Controller #2 Intel Corporation:82801EB/ER (ICH5/ICH5R) USB UHCI Controller #4 Intel Corporation:82801EB/ER (ICH5/ICH5R) USB2 EHCI Controller Intel Corporation:82801EB/ER (ICH5/ICH5R) SMBus Controller Périphérique USB Sunplus Technology Co., Ltd PLEOMAX wireless device Hewlett-Packard DeskJet 3420c (deskjet 3420) Clavier Périphérique clavier PIH Souris Souris HID Ecran(s) Télévision standard Écran Plug-and-Play(Samsung SyncMaster) ou trouver la mise à jour du chipset de la carte mere SVP Merci.

même aprés installation des pilotes ati toujours un point d'exclamation sur pci device de plus l ' affichage est correct mais pas moyen de transferer sur la télé

il dit ceci

salut mirware tu veux parler du cd de mon sysyeme d'installation?

eh bien si mais apparemment il trouve pas le pilote là sur le cd

bonjour à tous je suis à la recherche d'un pilote pour ma nouvelle carte graphique je suppos car apres installation de celle ci voici ce que le gestionnaire de périphériques indique qu'est ce que c'est pci device

pour norton voir aussi http://forum.zebulon.fr/index.php?act=st&a...=38&t=57795

salut merci pour ton site, j'ai calculé approximativement 305W. j'ai une alimentation de 300W en stock ce serait déjà mieux non Tous mes usb sont branchés sur un port hub alimenté. Indique moi ce que tu mettrais en alimentation dans mon pc et une réference peut etre sachant Propriétés du châssis: Fabricant Dell Computer Corporation Type du châssis Mini-tour Merci.