thomascavalera

Bonjour, Je n'ai pas réussi à renommer le fichier dll même en mode sans échec. Y'a t'il un autre moyen ?

Merci Seulement je suis sous vista est-ce que le problème reste le même ? J'ai bien ce fichier en question, je ne sais pas s'il est endommagé ?

Bonjour, J'ai depuis deux jours un problème de fonctionnement windows Vista. Mon ordinateur est ralenti et j'ai un message d'erreur car windows est obligé d'arrêter un processus qui s'affiche : Nom d’événement de problème: APPCRASH Nom de l’application: svchost.exe Version de l’application: 6.0.6001.18000 Horodatage de l'application: 47918b89 Nom du module par défaut: ntdll.dll Version du module par défaut: 6.0.6002.18005 Horodateur du module par défaut: 49e03821 Code de l’exception: c000071b Décalage de l’exception: 000888f5 Version du système: 6.0.6002.2.2.0.768.3 Identificateur de paramètres régionaux: 1036 Information supplémentaire n° 1: 0e02 Information supplémentaire n° 2: b21b56b606e7544720668ce364087082 Information supplémentaire n° 3: 0e02 Information supplémentaire n° 4: b21b56b606e7544720668ce364087082 Lire notre déclaration de confidentialité : http://go.microsoft.com/fwlink/?linkid=501...mp;clcid=0x040c J'ai de plus mozilla qui m'ouvre des fenêtres intempestives... Je soupçonne un malware. J'ai nettoyé mon disc avec Ccleaner. Le scan avec Antivir + Malwarebyte + Spybot n'a rien trouvé. Mon pc tourne sous Vista sp2, antivirus = Antivir, pare-feu = windows. Pouvez-vous m'aider à decrypter mon log hijack Merci ! : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:21:55, on 12/05/2010 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.18904) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\SFR\Kit\9props.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe C:\Windows\system32\taskeng.exe C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\HiJackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sfr.fr/kit/adsl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.4.1.27.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: RoboForm BHO - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent O4 - HKCU\..\Run: [Connexion SFR 9props.exe] "C:\Program Files\SFR\Kit\9props.exe" /trayicon O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE RÉSEAU') O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O8 - Extra context menu item: Tout télécharger avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Télécharger avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: Télécharger toutes les vidéos avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.4.1.27.dll/206 (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{4053327F-B840-42E4-8A5E-44CB02D8BA2B}: NameServer = 192.168.1.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Service Google Update (gupdate1ca103df7fe3ce0) (gupdate1ca103df7fe3ce0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- End of file - 7107 bytes

Bonjour, J'ai depuis deux jours un problème de fonctionnement windows Vista. Mon ordinateur est ralenti et j'ai un message d'erreur car windows est obligé d'arrêter un processus qui s'affiche : Nom d’événement de problème: APPCRASH Nom de l’application: svchost.exe Version de l’application: 6.0.6001.18000 Horodatage de l'application: 47918b89 Nom du module par défaut: ntdll.dll Version du module par défaut: 6.0.6002.18005 Horodateur du module par défaut: 49e03821 Code de l’exception: c000071b Décalage de l’exception: 000888f5 Version du système: 6.0.6002.2.2.0.768.3 Identificateur de paramètres régionaux: 1036 Information supplémentaire n° 1: 0e02 Information supplémentaire n° 2: b21b56b606e7544720668ce364087082 Information supplémentaire n° 3: 0e02 Information supplémentaire n° 4: b21b56b606e7544720668ce364087082 Lire notre déclaration de confidentialité : http://go.microsoft.com/fwlink/?linkid=501...mp;clcid=0x040c J'ai de plus mozilla qui m'ouvre des fenêtres intempestives... Je soupçonne un malware. J'ai nettoyé mon disc avec Ccleaner. Le scan avec Antivir + Malwarebyte + Spybot n'a rien trouvé. Mon pc tourne sous Vista sp2, antivirus = Antivir, pare-feu = windows. Pouvez-vous m'aider à decrypter mon log hijack Merci ! : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:21:55, on 12/05/2010 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.18904) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\SFR\Kit\9props.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe C:\Windows\system32\taskeng.exe C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\HiJackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sfr.fr/kit/adsl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.4.1.27.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: RoboForm BHO - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent O4 - HKCU\..\Run: [Connexion SFR 9props.exe] "C:\Program Files\SFR\Kit\9props.exe" /trayicon O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE RÉSEAU') O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O8 - Extra context menu item: Tout télécharger avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Télécharger avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: Télécharger toutes les vidéos avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.4.1.27.dll/206 (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{4053327F-B840-42E4-8A5E-44CB02D8BA2B}: NameServer = 192.168.1.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Service Google Update (gupdate1ca103df7fe3ce0) (gupdate1ca103df7fe3ce0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- End of file - 7107 bytes

Bonsoir, Merci pour ta réponse SdQY J'ai essayé de restaurer le système mais là aussi problème... Je lance l'application et aucune fen^tre ne s'ouvre... Pourtant la restauration apparait dans les processus. J'ai le même problème en mode sans echec ? Comme si il ne voulait pas me laisser acceder au point de restauration. Je ne sais plus quoi faire .

Bonjour, La maj Windows Vista ne marche plus sur mon ordi. J'avais 21 maj importantes à faire que j'ai lancé, mais windows update s'est bloqué... J'ai du arreter mon ordi. Quand je relance l'update l'application se bloque ? Que puis-je faire ?

Merci pour vos conseils, Je pense que c'est à cause de bitcomet que j'ai ces problèmes, je vais m'en séparer. Bonne soirée.

Voilà manipulation effectuée. Voici mon nouveau log Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:08:00, on 19/06/2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\HiJackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU') O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\system32\msjava.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\system32\msjava.dll O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing O13 - Gopher Prefix: O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4053327F-B840-42E4-8A5E-44CB02D8BA2B}: NameServer = 147.94.113.8 O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing) O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: Samsung Update Plus - Unknown owner - C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe -- End of file - 6607 bytes

Re-bonjour, Voici mon log Hijack. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:43:49, on 19/06/2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe C:\Windows\Explorer.EXE C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\HiJackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: {de5dceeb-ea4b-b958-d9f4-e453758645b6} - {6b546857-354e-4f9d-859b-b4aebeecd5ed} - C:\Windows\system32\lfnxcatv.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O2 - BHO: (no name) - {7687F3DF-E2C1-4311-AD9C-522EA7B5F6CC} - (no file) O2 - BHO: (no name) - {A7C88428-8BE2-44CE-ACEE-B5B5C8CD5FE7} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU') O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\system32\msjava.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\system32\msjava.dll O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing O13 - Gopher Prefix: O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4053327F-B840-42E4-8A5E-44CB02D8BA2B}: NameServer = 147.94.113.8 O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing) O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: Samsung Update Plus - Unknown owner - C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe -- End of file - 6857 bytes

Salut pear, J'ai fait l'analyse avec Malwarebyte, en mode sans echec, et il a trouvé tout pleins de virus qu'il a supprimé. Voici le rapport. Dois je poster aussi un rapport hijack ? Merci Malwarebytes' Anti-Malware 1.17 Version de la base de données: 869 09:50:53 19/06/2008 mbam-log-6-19-2008 (09-50-53).txt Type de recherche: Examen complet (C:\|D:\|) Eléments examinés: 206565 Temps écoulé: 43 minute(s), 37 second(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 0 Clé(s) du Registre infectée(s): 4 Valeur(s) du Registre infectée(s): 1 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 9 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): (Aucun élément nuisible détecté) Clé(s) du Registre infectée(s): HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{e25ee903-37eb-467b-b1f0-f71063f6b8c8} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. Valeur(s) du Registre infectée(s): HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{e25ee903-37eb-467b-b1f0-f71063f6b8c8} (Trojan.Vundo) -> Quarantined and deleted successfully. Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): C:\Windows\System32\nptqkfgy.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Windows\System32\ygfkqtpn.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Windows\System32\qufvmjie.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Windows\System32\eijmvfuq.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Windows\System32\ycjldrrx.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Windows\System32\xrrdljcy.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Windows\System32\ddcaxWqn.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Windows\System32\urqPghfG.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Windows\System32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

Bonjour, Je suis infecté par un virus qui est détecté par antivir mais qui ne le supprime pas. Spybot et adaware l'identifie mais n'arrive pas non plus à le supprimer. Et il me fait vraiment ralentir ma navigation sur internet en m'ouvrant pleins de fenêtres intempestives. Je vous joint mon log hijackthis pour voir si j'ai des trucs à supprimer. Je suis sous Vista avec IE, ZA + antivir. Est-ce que quelqu'un peut m'aider ...? Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:38:03, on 18/06/2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe C:\Windows\Explorer.EXE C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Windows\System32\mobsync.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\HiJackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: {de5dceeb-ea4b-b958-d9f4-e453758645b6} - {6b546857-354e-4f9d-859b-b4aebeecd5ed} - C:\Windows\system32\lfnxcatv.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O2 - BHO: (no name) - {7687F3DF-E2C1-4311-AD9C-522EA7B5F6CC} - (no file) O2 - BHO: (no name) - {A7C88428-8BE2-44CE-ACEE-B5B5C8CD5FE7} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU') O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\system32\msjava.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\system32\msjava.dll O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing O13 - Gopher Prefix: O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4053327F-B840-42E4-8A5E-44CB02D8BA2B}: NameServer = 147.94.113.8 O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing) O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: Samsung Update Plus - Unknown owner - C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe -- End of file - 6820 bytes

Bonjour, J'ai un virus troyen qui me ralenti considérablement internet et m'ouvre des fenêtres de manière intempestive. J'ai fait plusieurs coup de spybot et adaware qui m'ont trouvé un troyen du nom de "virtumonde", mais le problème ne se résoud pas. Peut-être que mon rapport HijackThis peut aider à nettoyer tout ça. Pouvez-vous m'aider ? Je suis sous Vista avec IE 7. Merci Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:03:01, on 13/06/2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\HiJackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: {de5dceeb-ea4b-b958-d9f4-e453758645b6} - {6b546857-354e-4f9d-859b-b4aebeecd5ed} - C:\Windows\system32\lfnxcatv.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O2 - BHO: (no name) - {7687F3DF-E2C1-4311-AD9C-522EA7B5F6CC} - (no file) O2 - BHO: (no name) - {A7C88428-8BE2-44CE-ACEE-B5B5C8CD5FE7} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU') O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\system32\msjava.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\system32\msjava.dll O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing O13 - Gopher Prefix: O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4053327F-B840-42E4-8A5E-44CB02D8BA2B}: NameServer = 147.94.113.8 O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing) O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: Samsung Update Plus - Unknown owner - C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe -- End of file - 6916 bytes

Bonjour, Mon ordi tourne très mal sous vista. J'ai essayé de l'optimiser mais l'explorateur plante souvent et occupe la mémoire dès que je me balade dans mes documents. Voici ma config : Windows vista IE Antivirus :Avast Parefeu :Vista Je joint mon rapport hijack. Si quelqu'un peut m'aider pour l'analyse du rapport ? Merci Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:41:39, on 20/02/2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16575) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\explorer.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\Program Files\HiJackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU') O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\system32\msjava.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\system32\msjava.dll O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O13 - Gopher Prefix: O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqemea/downloads/sysinfo.cab O16 - DPF: {80AEEC0E-A2BE-4B8D-985F-350FE869DC40} (HPDDClientExec Class) - http://h30155.www3.hp.com/ediags/dd/instal...osticsVista.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4053327F-B840-42E4-8A5E-44CB02D8BA2B}: NameServer = 147.94.113.8 O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: Samsung Update Plus - Unknown owner - C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- End of file - 6138 bytes

Bonjour, Mon ordi tourne très mal sous vista. J'ai essayé de l'optimiser mais l'explorateur plante souvent et occupe la mémoire dès que je me balade dans mes documents. Voici ma config : Windows vista IE Antivirus :Avast Parefeu :Vista Je joint mon rapport hijack. Si quelqu'un peut m'aider pour l'analyse du rapport ? Merci Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:41:39, on 13/02/2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16575) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\explorer.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\Program Files\HiJackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU') O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\system32\msjava.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\system32\msjava.dll O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O13 - Gopher Prefix: O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqemea/downloads/sysinfo.cab O16 - DPF: {80AEEC0E-A2BE-4B8D-985F-350FE869DC40} (HPDDClientExec Class) - http://h30155.www3.hp.com/ediags/dd/instal...osticsVista.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4053327F-B840-42E4-8A5E-44CB02D8BA2B}: NameServer = 147.94.113.8 O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: Samsung Update Plus - Unknown owner - C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- End of file - 6138 bytes

Merci leminou, Je connaissais effectivement Hijackthis je vais en refaire un coup.Sinon pour mes données perso j'ai juste à les mettre sous D: Comment je fais pour mes fichiers d'échange vu que c'est déjà configuré sous vista pour etre sur C: Merci encore

Re-salut, Décidemment tes réponses m'amènent plus de questions, mais c'est tant mieux... "Question matériel": je ne comprend pas exactement ta question. En fait je ne sais pas exactement comment connaitre les données précises de mon matos voilà le peu que je sais : Portable marque Samsung processeur: Intel Core 2 duo 1,7 GHz DD : 140 Go avec 3 partitions (apparemment ) 2 de 60 (C et D) et une de 10 (je ne sais pas à quoi elle sert) Memoire vive: 1.8 Go DDR2 SODIMM Carte graphique : Ati Radeon Xpress 1250M Concernant "passer mon ordi aux anti-tout" je suppose que tu veux dire un coup de ccleaner, adaware et cie... Je le fais régulièrement et je ne pense pas que cela vienne de là. Par contre est ce le fait que mon disque est partitionné (partition initiale lors de l'achat) et que mes données se trouvent sur C: où est installé Vista ? Où est-ce que c'est parce que je me suis fait refiler un DD de mauvaise qualité (lent à la lecture) ? J'avoue je suis très perplexe ...

Salut leminou, Voici ma config Windows vista IE Antivirus :Avast Parefeu :Vista Je travaille sur office XP pro 2002 (sp3). Te faut-il plus d'infos ?

Bonjour, Je travail sous windows Vista et j'ai installé le pack office XP pro pour utiliser excel et word. Mon ordi est très lent lorsque j'ouvre des fichiers de calculs excel un peu gros (+30 MB). Pire il plante régulièrement (il se met à charger et se bloque), le disque semble saturé à chaque fois (le moniteur de ressources indique que le disque tourne à 100 % de sa capacité). De la même manière l'explorateur plante régulièrement lorsque visiblement je veux ouvrir un dossier avec des fichiers excel lourds... Mon ordi est récent (-1ans) et il est doté d'un processeur intel core duo 1.67Ghz, d'une mémoire vive de 2Go et d'un disque dur de 150Go. N'y aurai t'il pas des conflits entre office XP pro et windows Vista ? Merci d'avance

Re-bonjour, J'ai retrouvé le rapport de Combo (enfin j'éspère). J'ai l'impression que le cheval de troie a été supprimé... ComboFix 08-01-23.2 - THOMAS 2008-01-25 8:40:00.4 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.0.1252.1.1036.18.522 [GMT 1:00] Endroit: C:\Documents and Settings\THOMAS\Bureau\ComboFix.exe AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !! . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\WINDOWS\emdat.tm C:\WINDOWS\system32\kr_done1 . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\poof ((((((((((((((((((((((((((((( Fichiers créés 2007-12-25 to 2008-01-25 )))))))))))))))))))))))))))))))))))) . 2008-01-23 12:36 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe 2008-01-22 20:12 . 2008-01-22 20:51 <REP> d-------- C:\VundoFix Backups 2008-01-21 17:57 . 2008-01-21 17:57 <REP> d-------- C:\Program Files\Avira 2008-01-21 16:35 . 2008-01-21 16:35 <REP> d-------- C:\Program Files\Trend Micro . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-10 11:43 --------- d-----w C:\Program Files\a-squared Free 2008-01-10 09:53 --------- d-----w C:\Program Files\DivX 2007-12-18 15:55 1,348,608 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp 2007-12-17 21:47 --------- d-----w C:\Program Files\Free Easy Burner 2007-12-04 17:48 13,002,338 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2007_12_03_21_13_22_full.dmp.zip 2007-12-03 20:13 211,456 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp 2007-12-03 20:13 1,324,544 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp 2007-12-03 18:11 --------- d-----w C:\Program Files\eMule 2007-06-30 13:32 71,680 --sha-w C:\Program Files\Thumbs.db 2006-10-06 08:59 774,144 ----a-w C:\Program Files\RngInterstitial.dll 2005-02-04 15:58 56 -csh--r C:\WINDOWS\system32\64050CE239.sys 2005-11-30 06:39 10,856 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((( snapshot@2008-01-23_12.45.29.32 ))))))))))))))))))))))))))))))))))))))))) . + 2003-01-13 13:57:58 589,881 ----a-w C:\WINDOWS\LastGood\System32\dllcache\jscript.dll + 2003-01-13 13:57:58 589,881 ----a-w C:\WINDOWS\LastGood\System32\jscript.dll - 2008-01-23 11:41:45 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-01-25 07:35:23 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-01-23 11:41:45 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat + 2008-01-25 07:35:23 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat - 2008-01-23 11:41:45 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-01-25 07:35:23 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2008-01-23 11:37:05 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\ntuser.dat + 2008-01-25 07:39:54 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\ntuser.dat - 2008-01-10 08:39:46 52,900 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-01-23 11:43:41 52,900 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-01-10 08:39:46 63,854 ----a-w C:\WINDOWS\system32\perfc00C.dat + 2008-01-23 11:43:42 63,854 ----a-w C:\WINDOWS\system32\perfc00C.dat - 2008-01-10 08:39:46 380,486 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-01-23 11:43:42 380,486 ----a-w C:\WINDOWS\system32\perfh009.dat - 2008-01-10 08:39:46 445,434 ----a-w C:\WINDOWS\system32\perfh00C.dat + 2008-01-23 11:43:42 445,434 ----a-w C:\WINDOWS\system32\perfh00C.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-02-14 09:21 171448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 01:02 919280] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-07-17 11:57 155648] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-01-22 19:44 249896] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-08-28 13:00 13312] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoToolbarCustomize"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa] antiwpa.dll 2006-07-22 23:49 5376 C:\WINDOWS\system32\antiwpa.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, msnsspc.dll, digest.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\semd32.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\semd64.sys] @="Driver" R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys [2007-07-18 14:22] R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [2007-08-09 13:04] R1 VIAPFD;VIAPFD;C:\WINDOWS\System32\Drivers\VIAPFD.SYS [2001-12-18 14:45] R2 LogWatch;Event Log Watch;C:\WINDOWS\LogWatNT.exe [2002-06-14 14:15] R3 PALLADIA;Palladia 300/400 Usb Adsl Modem;C:\WINDOWS\System32\DRIVERS\usbiad.sys [2004-07-14 18:52] R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\System32\DRIVERS\usbscan.sys [2001-08-17 20:53] S0 ElbyVCD;ElbyVCD;C:\WINDOWS\System32\DRIVERS\ElbyVCD.sys [] S1 semd64;SE 3.0 memory driver;C:\WINDOWS\System32\semd64.sys [] S2 semd32;SE 3.2 memory driver;C:\WINDOWS\System32\semd64.sys [] S3 Aps2wmou;Cherry Power Wheel Mouse (PS/2 Port);C:\WINDOWS\System32\DRIVERS\Aps2wmou.sys [2000-12-12 12:02] S3 Mskervrnqwv;Mskervrnqwv;C:\WINDOWS\System32\drivers\diskdump.sys [2001-08-28 13:00] S3 SE2Ebus;Sony Ericsson Device 046 Driver driver (WDM);C:\WINDOWS\System32\DRIVERS\SE2Ebus.sys [2006-05-01 12:16] S3 SE2Emdfl;Sony Ericsson Device 046 USB WMC Modem Filter;C:\WINDOWS\System32\DRIVERS\SE2Emdfl.sys [2006-05-01 12:17] S3 SE2Emdm;Sony Ericsson Device 046 USB WMC Modem Driver;C:\WINDOWS\System32\DRIVERS\SE2Emdm.sys [2006-05-01 12:17] S3 SE2Eobex;Sony Ericsson Device 046 USB WMC OBEX Interface;C:\WINDOWS\System32\DRIVERS\SE2Eobex.sys [2006-05-01 12:18] S3 TPPFX;USB Storage Adapter FX (TPP);C:\WINDOWS\System32\DRIVERS\TPPFX.SYS [2002-06-24 04:20] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E4066320-E4AE-11CF-B1B0-00AA00BBAD66}] rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\fpxpress.inf,PerUserRemove . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2006-06-01 01:55:00 C:\WINDOWS\Tasks\Nettoyage de disque.job" - C:\WINDOWS\system32\cleanmgr.exe "2007-07-02 00:53:00 C:\WINDOWS\Tasks\Realtime Monitor.job" - C:\PROGRA~1\CA\eTrust\INOCUL~1\Realmon.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-25 08:42:07 Windows 5.1.2600 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** .

Salut Gof, J'ai fait l'analyse combofix m'ai il ne m'a pas crée de rapport ? Il n'ya rien directement à la racine. Où est ce qu'il est censé le mettre ?

Bonjour, Merci pour tes conseils Voici les rapports de Vundo : VundoFix V6.7.7 Checking Java version... Java version is 1.5.0.6 Old versions of java are exploitable and should be removed. Scan started at 20:12:34 22/01/2008 Listing files found while scanning.... C:\WINDOWS\system32\AudFile.dll C:\WINDOWS\system32\ssqoopm.dll C:\WINDOWS\system32\WMAFile.dll Beginning removal... Attempting to delete C:\WINDOWS\system32\AudFile.dll C:\WINDOWS\system32\AudFile.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\ssqoopm.dll C:\WINDOWS\system32\ssqoopm.dll Could not be deleted. Attempting to delete C:\WINDOWS\system32\WMAFile.dll C:\WINDOWS\system32\WMAFile.dll Has been deleted! Performing Repairs to the registry. Done! Beginning removal... de Diaghelp : DiagHelp version v1.4 - http://www.malekal.com excute le 22/01/2008 à 21:05:10,51 Liste des derniers fichies modifies/crees dans windir\system32 et prefetch C:\WINDOWS\prefetch\CMD.EXE-087B4001.pf -->22/01/2008 21:04:39 C:\WINDOWS\prefetch\NOTEPAD.EXE-336351A9.pf -->22/01/2008 21:00:17 C:\WINDOWS\prefetch\IEXPLORE.EXE-27122324.pf -->22/01/2008 20:59:00 C:\WINDOWS\prefetch\WUAUCLT.EXE-399A8E72.pf -->22/01/2008 20:56:48 C:\WINDOWS\prefetch\WMIPRVSE.EXE-28F301A9.pf -->22/01/2008 20:56:48 C:\WINDOWS\prefetch\NTOSBOOT-B00DFAAD.pf -->22/01/2008 20:56:48 C:\WINDOWS\prefetch\LOGONUI.EXE-0AF22957.pf -->22/01/2008 20:53:59 C:\WINDOWS\prefetch\GOOGLETOOLBARNOTIFIER.EXE-022A647B.pf -->22/01/2008 20:51:26 C:\WINDOWS\prefetch\ZLCLIENT.EXE-1C550EB2.pf -->22/01/2008 20:51:17 C:\WINDOWS\prefetch\AVGNT.EXE-11EBE658.pf -->22/01/2008 20:51:17 C:\WINDOWS\System32\drivers\avipbb.sys -->22/01/2008 19:44:01 C:\WINDOWS\System32\drivers\avgntdd.sys -->09/08/2007 13:04:11 C:\WINDOWS\System32\drivers\avgntmgr.sys -->18/07/2007 14:22:19 C:\WINDOWS\System32\drivers\ssmdrv.sys -->01/03/2007 10:34:36 C:\WINDOWS\System32\drivers\AvgAsCln.sys -->05/09/2006 17:03:16 C:\WINDOWS\System32\drivers\SE2Eobex.sys -->01/05/2006 12:18:54 C:\WINDOWS\System32\drivers\SE2Ecmnt.sys -->01/05/2006 12:18:50 C:\WINDOWS\System32\vsconfig.xml -->22/01/2008 20:55:40 C:\WINDOWS\System32\wpa.dbl -->22/01/2008 19:41:00 C:\WINDOWS\System32\CONFIG.NT -->21/01/2008 17:47:33 C:\WINDOWS\System32\PerfStringBackup.INI -->10/01/2008 09:39:46 C:\WINDOWS\System32\perfh00C.dat -->10/01/2008 09:39:46 C:\WINDOWS\System32\perfh009.dat -->10/01/2008 09:39:46 C:\WINDOWS\System32\perfc00C.dat -->10/01/2008 09:39:46 C:\WINDOWS\System32\perfc009.dat -->10/01/2008 09:39:46 C:\WINDOWS\System32\MRT.exe -->02/01/2008 19:21:36 C:\WINDOWS\System32\zllictbl.dat -->16/11/2007 19:04:50 C:\WINDOWS\System32\mucltui.dll -->30/07/2007 19:19:10 C:\WINDOWS\System32\muweb.dll -->30/07/2007 19:19:04 C:\WINDOWS\System32\mucltui.dll.mui -->30/07/2007 19:18:58 C:\WINDOWS\System32\wuaucpl.cpl.mui -->30/07/2007 18:20:06 C:\WINDOWS\System32\wuapi.dll.mui -->30/07/2007 18:19:52 C:\WINDOWS\System32\wuaueng.dll -->30/07/2007 18:19:42 C:\WINDOWS\System32\wuapi.dll -->30/07/2007 18:19:36 C:\WINDOWS\System32\wucltui.dll -->30/07/2007 18:19:32 C:\WINDOWS\System32\wuweb.dll -->30/07/2007 18:19:28 C:\WINDOWS\System32\wuaucpl.cpl -->30/07/2007 18:19:28 C:\WINDOWS\System32\cdm.dll -->30/07/2007 18:19:20 C:\WINDOWS\System32\wuauclt.exe -->30/07/2007 18:19:16 C:\WINDOWS\System32\wups2.dll -->30/07/2007 18:19:12 C:\WINDOWS\System32\wucltui.dll.mui -->30/07/2007 18:19:04 C:\WINDOWS\System32\wuaueng.dll.mui -->30/07/2007 18:18:48 C:\WINDOWS\setupapi.log -->22/01/2008 20:56:01 C:\WINDOWS.log -->22/01/2008 20:55:54 C:\WINDOWS\WindowsUpdate.log -->22/01/2008 20:55:31 C:\WINDOWS\wiadebug.log -->22/01/2008 20:55:29 C:\WINDOWS\wiaservc.log -->22/01/2008 20:55:14 C:\WINDOWS\bootstat.dat -->22/01/2008 20:55:05 C:\WINDOWS\SchedLgU.Txt -->22/01/2008 20:54:00 C:\WINDOWS\EPISMF00.SWB -->09/01/2008 10:46:52 C:\WINDOWS\WMSysPr9.prx -->17/12/2007 22:47:02 C:\WINDOWS\mapimagery.INI -->06/08/2007 14:15:36 C:\WINDOWS\mngui.INI -->30/07/2007 19:23:09 C:\WINDOWS\WININIT.INI -->26/06/2007 14:48:46 C:\WINDOWS\tmpdelis.bat -->26/06/2007 14:48:46 C:\WINDOWS\tmpcpyis.bat -->26/06/2007 14:48:46 C:\WINDOWS\SIERRA.INI -->26/06/2007 14:44:25 winlogon.exe Verified: Signed svchost.exe Verified: Signed ws2_32.dll Verified: Signed user32.dll Verified: Signed tcpip.sys Verified: Signed ndis.sys Verified: Signed null.sys Verified: Signed ListDLLs v2.25 - DLL lister for Win9x/NT Copyright © 1997-2004 Mark Russinovich Sysinternals - www.sysinternals.com ------------------------------------------------------------------------------ explorer.exe pid: 1436 Command line: C:\WINDOWS\Explorer.EXE Base Size Version Path 0x01000000 0xf8000 6.00.2600.0000 C:\WINDOWS\Explorer.EXE 0x77be0000 0x53000 7.00.2600.0000 C:\WINDOWS\system32\msvcrt.dll 0x77290000 0x69000 6.00.2800.1584 C:\WINDOWS\system32\SHLWAPI.dll 0x77390000 0x7fd000 6.00.2750.0166 C:\WINDOWS\system32\SHELL32.dll 0x770e0000 0x8b000 3.50.5014.0000 C:\WINDOWS\system32\OLEAUT32.dll 0x71500000 0xfd000 6.00.2800.1584 C:\WINDOWS\System32\BROWSEUI.dll 0x71700000 0x149000 6.00.2800.1584 C:\WINDOWS\System32\SHDOCVW.dll 0x5b090000 0x34000 6.00.2600.0000 C:\WINDOWS\System32\UxTheme.dll 0x71950000 0xe4000 6.00.2600.0000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll 0x77300000 0x8b000 5.82.2600.0000 C:\WINDOWS\system32\comctl32.dll 0x7c620000 0x81000 2001.12.4414.0053 C:\WINDOWS\System32\CLBCATQ.DLL 0x77000000 0xd4000 2001.12.4414.0042 C:\WINDOWS\System32\COMRes.dll 0x5b950000 0x71000 6.00.2600.0000 C:\WINDOWS\System32\themeui.dll 0x703d0000 0x1b000 6.00.2800.1106 C:\WINDOWS\System32\ACTXPRXY.DLL 0x07610000 0x17000 9.00.0000.2980 C:\PROGRA~1\WINDOW~3\wmpband.dll 0x76ac0000 0x15000 3.00.9238.0000 C:\WINDOWS\System32\ATL.DLL 0x74a60000 0x9000 6.00.2600.0000 C:\WINDOWS\System32\BatMeter.dll 0x74a40000 0x7000 6.00.2600.0000 C:\WINDOWS\System32\POWRPROF.dll 0x70340000 0x43000 6.00.2800.1106 C:\WINDOWS\System32\webcheck.dll 0x76250000 0x8a000 5.131.2600.1123 C:\WINDOWS\system32\CRYPT32.dll 0x76390000 0x1fb000 2.00.2600.0000 C:\WINDOWS\System32\msi.dll 0x63000000 0x97000 6.00.2800.1468 C:\WINDOWS\system32\WININET.dll 0x10000000 0x13000 7.05.0001.0036 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll 0x017e0000 0x13000 6.00.2800.1106 C:\WINDOWS\System32\browselc.dll 0x01690000 0xc000 6.00.0001.1091 C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll 0x6d600000 0x2d000 5.00.0060.0005 C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll 0x5f140000 0x1a000 5.00.5014.0000 C:\WINDOWS\System32\OLEPRO32.DLL 0x1a400000 0x7b000 6.00.2800.1474 C:\WINDOWS\system32\urlmon.dll 0x70440000 0x8f000 6.00.2800.1106 C:\WINDOWS\System32\MLANG.dll 0x32520000 0x12000 10.00.2609.0000 C:\Program Files\Microsoft Office\Office10\msohev.dll 0x5ce30000 0x69000 6.00.2600.0000 C:\WINDOWS\System32\shimgvw.dll 0x70d00000 0x191000 5.01.3102.1360 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.1360_x-ww_24a2ed47\gdiplus.dll 0x5a500000 0x4e000 8.01.0178.0000 C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll 0x78130000 0x9b000 8.00.50727.0163 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\MSVCR80.dll 0x718c0000 0x8b000 6.00.2800.1106 C:\WINDOWS\System32\shdoclc.dll 0x026b0000 0x32000 3.520.9002.0000 C:\WINDOWS\System32\ODBC32.dll 0x76340000 0x46000 6.00.2600.0000 C:\WINDOWS\system32\comdlg32.dll 0x1f850000 0x18000 3.520.7713.0000 C:\WINDOWS\System32\odbcint.dll 0x01ad0000 0x1b000 7.02.0001.2009 C:\WINDOWS\Twain_32\QuickCam\lvWIAext.dll 0x01b00000 0xe000 7.03.0000.1113 C:\Program Files\Logitech\ImageStudio\NameSpc.dll 0x73d20000 0xf2000 6.00.8665.0000 C:\WINDOWS\System32\MFC42.DLL 0x61d70000 0xe000 6.00.8665.0000 C:\WINDOWS\System32\MFC42LOC.DLL 0x01cd0000 0x55000 7.03.0000.1113 C:\Program Files\Logitech\ImageStudio\AlbumUI.dll 0x01f60000 0x60000 7.03.0000.1113 C:\Program Files\Logitech\ImageStudio\QCUI.dll 0x01fc0000 0xd6000 12.01.0000.0011 C:\Program Files\Logitech\ImageStudio\LTWVC12n.dll 0x1ffc0000 0x24000 12.01.0000.0011 C:\Program Files\Logitech\ImageStudio\LTFIL12n.DLL 0x1fff0000 0x69000 12.01.0000.0011 C:\Program Files\Logitech\ImageStudio\LTKRN12n.dll 0x01b30000 0x9000 7.03.0000.1113 C:\Program Files\Logitech\ImageStudio\LQCUI.dll 0x024a0000 0x31000 7.03.0000.1113 C:\Program Files\Logitech\ImageStudio\LAlbumUI.dll 0x1ff70000 0x4a000 12.01.0000.0011 C:\WINDOWS\System32\LTDIS12N.DLL 0x024e0000 0x2c000 12.01.0000.0011 C:\WINDOWS\System32\LTIMG12N.DLL 0x1fc40000 0x3c000 12.01.0000.0011 C:\WINDOWS\System32\LTEFX12N.DLL 0x732d0000 0x52000 6.00.2750.0167 C:\WINDOWS\System32\zipfldr.dll 0x76be0000 0x2b000 5.131.2600.0000 C:\WINDOWS\System32\WINTRUST.dll 0x0ffd0000 0x22000 5.01.2518.0000 C:\WINDOWS\System32\rsaenh.dll 0x76010000 0x61000 6.00.8972.0000 C:\WINDOWS\System32\MSVCP60.DLL 0x02580000 0x2a000 7.05.0001.0036 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll 0x040d0000 0x9e000 6.00.0000.0091 C:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.dll 0x52200000 0xb000 7.00.0337.0000 C:\Program Files\Zone Labs\ZoneAlarm\zlavscan.dll 0x00de0000 0x4000 5.03.0017.0000 C:\Program Files\Zone Labs\ZoneAlarm\zlavscan_Loc040c.dll 0x025b0000 0x29000 C:\Program Files\WinRAR\rarext.dll 0x025e0000 0x11000 7.00.0000.0010 C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll 0x7c250000 0x102000 7.10.3077.0000 C:\Program Files\Avira\AntiVir PersonalEdition Classic\MFC71U.DLL 0x03f50000 0x56000 7.10.3052.0004 C:\Program Files\Avira\AntiVir PersonalEdition Classic\MSVCR71.dll 0x03df0000 0x38000 3.00.0000.0058 C:\PROGRA~1\A-SQUA~1\A2FREE~1.DLL 0x73cc0000 0x12000 6.00.2600.0000 C:\WINDOWS\System32\shgina.dll 0x70ee0000 0x7000 1.01.0000.3917 C:\WINDOWS\System32\asfsipc.dll 0x60990000 0xd000 2.00.2600.0000 C:\WINDOWS\System32\MSISIP.DLL 0x00d10000 0x10000 5.06.0000.6626 C:\WINDOWS\System32\wshext.dll 0x00d20000 0xe000 5.06.0000.6626 C:\WINDOWS\System32\wshFR.DLL 0x365a0000 0x15000 10.00.2625.0000 C:\PROGRA~1\MICROS~3\Office10\MCPS.DLL ListDLLs v2.25 - DLL lister for Win9x/NT Copyright © 1997-2004 Mark Russinovich Sysinternals - www.sysinternals.com ------------------------------------------------------------------------------ winlogon.exe pid: 832 Command line: winlogon.exe Base Size Version Path 0x01000000 0x6f000 \??\C:\WINDOWS\system32\winlogon.exe 0x77be0000 0x53000 7.00.2600.0000 C:\WINDOWS\system32\msvcrt.dll 0x76250000 0x8a000 5.131.2600.1123 C:\WINDOWS\system32\CRYPT32.dll 0x77390000 0x7fd000 6.00.2750.0166 C:\WINDOWS\system32\SHELL32.dll 0x77290000 0x69000 6.00.2800.1584 C:\WINDOWS\system32\SHLWAPI.dll 0x77300000 0x8b000 5.82.2600.0000 C:\WINDOWS\system32\COMCTL32.dll 0x007a0000 0x32000 3.520.9002.0000 C:\WINDOWS\system32\ODBC32.dll 0x76340000 0x46000 6.00.2600.0000 C:\WINDOWS\system32\comdlg32.dll 0x007e0000 0xe4000 6.00.2600.0000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll 0x1f850000 0x18000 3.520.7713.0000 C:\WINDOWS\system32\odbcint.dll 0x76b70000 0x1f000 6.00.2600.0000 C:\WINDOWS\system32\SHSVCS.dll 0x76be0000 0x2b000 5.131.2600.0000 C:\WINDOWS\system32\WINTRUST.dll 0x5b090000 0x34000 6.00.2600.0000 C:\WINDOWS\system32\uxtheme.dll 0x0ffd0000 0x22000 5.01.2518.0000 C:\WINDOWS\System32\rsaenh.dll 0x01320000 0xae000 1.05.0540.0000 C:\WINDOWS\system32\WgaLogon.dll 0x770e0000 0x8b000 3.50.5014.0000 C:\WINDOWS\system32\OLEAUT32.dll 0x7c620000 0x81000 2001.12.4414.0053 C:\WINDOWS\system32\CLBCATQ.DLL 0x77000000 0xd4000 2001.12.4414.0042 C:\WINDOWS\system32\COMRes.dll 0x05000000 0x1500 3.05.0000.0000 C:\WINDOWS\system32\antiwpa.dll Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 8CC7-5EB8 Répertoire de C:\WINDOWS\system32 28/08/2001 13:00 4 096 csrss.exe 1 fichier(s) 4 096 octets 0 Rép(s) 19 615 117 312 octets libres Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 8CC7-5EB8 Répertoire de C:\WINDOWS\system32 31/08/2002 00:06 278 528 dmcpl.exe 1 fichier(s) 278 528 octets 0 Rép(s) 19 615 117 312 octets libres Contenu de Downloaded Program Files Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 8CC7-5EB8 Répertoire de C:\WINDOWS\Downloaded Program Files 10/01/2008 09:34 <REP> . 10/01/2008 09:34 <REP> .. 11/04/2006 16:10 135 168 asinst.dll 03/04/2006 10:00 537 asinst.inf 16/03/2006 15:58 231 072 avsniff.dll 16/03/2006 15:56 878 avsniff.inf 16/03/2006 15:58 198 304 avsniffdlgs.dll 16/03/2006 15:52 537 704 AXXPEE.dll 21/03/2002 14:26 815 bitdefender.inf 30/01/2003 15:52 348 160 bitdefender.ocx 16/03/2006 15:56 241 CabSA.inf 12/04/2006 00:00 2 390 catalog.dat 25/01/2003 15:29 65 desktop.ini 28/11/2007 13:52 214 DivXPlugin.inf 12/04/2006 00:00 6 899 ecbootil.vxd 16/03/2006 15:52 42 112 ecmldr32.dll 12/04/2006 00:00 288 424 ecmsvr32.dll 08/06/2006 11:15 546 Ephoto.inf 08/06/2006 11:16 529 960 EphotoAx.dll 08/06/2006 11:16 321 064 EphotoAxRes.dll 12/07/2000 01:02 36 864 fxfileop.dll 05/09/2002 11:23 458 752 googlenav.dll 24/03/2006 17:40 1 455 864 ICSScan.dll 24/03/2006 09:03 470 ICSScanner.inf 02/09/2005 09:05 578 kavwebscan.inf 11/12/2006 16:44 367 LegitCheckControl.inf 20/01/2000 14:25 1 162 Microsoft XML Parser for Java.osd 14/03/2005 12:39 227 MsnMessengerSetupDownloader.inf 17/03/2005 13:48 113 152 MsnMessengerSetupDownloader.ocx 16/03/2006 15:54 6 850 navapi.vxd 16/03/2006 15:54 201 896 navapi32.dll 12/04/2006 00:00 124 584 naveng32.dll 12/04/2006 00:00 837 288 navex32a.dll 17/05/2004 15:26 35 584 ProductIDGatherer.dll 25/05/2004 10:05 2 735 ProductIDGatherer.INF 13/09/2002 10:56 144 QTPlugin.inf 22/03/2003 00:19 5 210 364 QuickTimeInstallCache.qdat 16/03/2006 15:58 161 480 rufsi.dll 12/04/2006 00:00 97 440 scrauth.dat 02/12/2005 10:55 5 101 swflash.inf 12/04/2006 00:00 8 145 symaveng.cat 12/04/2006 00:00 901 symaveng.inf 12/04/2006 00:00 45 988 tcdefs.dat 12/04/2006 00:00 706 379 tcscan7.dat 12/04/2006 00:00 286 186 tcscan8.dat 12/04/2006 00:00 564 664 tcscan9.dat 21/10/2004 16:55 1 390 teleir_cert.osd 12/04/2006 00:00 453 tinf.dat 12/04/2006 00:00 148 tinfidx.dat 12/04/2006 00:00 1 957 tinfl.dat 12/04/2006 00:00 53 297 tscan1.dat 12/04/2006 00:00 1 237 tscan1hd.dat 31/10/2001 09:37 118 uninst.bat 12/04/2006 00:00 5 516 v.grd 12/04/2006 00:00 2 256 v.sig 12/04/2006 00:00 106 244 virscan.inf 12/04/2006 00:00 948 450 virscan1.dat 12/04/2006 00:00 561 178 virscan2.dat 12/04/2006 00:00 145 676 virscan3.dat 12/04/2006 00:00 320 086 virscan4.dat 12/04/2006 00:00 2 294 934 virscan5.dat 12/04/2006 00:00 388 320 virscan6.dat 12/04/2006 00:00 3 351 418 virscan7.dat 12/04/2006 00:00 1 521 327 virscan8.dat 12/04/2006 00:00 3 163 397 virscan9.dat 12/04/2006 00:00 32 virscant.dat 18/04/2006 19:00 2 072 vscanmsx.dat 09/09/2003 17:39 323 yinst.inf 09/09/2003 17:39 124 352 yinsthelper.dll 12/04/2006 00:00 224 zdone.dat 68 fichier(s) 26 002 123 octets Total des fichiers listés : 68 fichier(s) 26 002 123 octets 2 Rép(s) 19 615 113 216 octets libres Recherche de rootkit! (Merci S!Ri) Recherche d'infections connues Export des clefs sensibles.. Liste des fichiers en exception sur le pare-feu XP SP2 Export de la clef SharedTaskScheduler [sharedTaskScheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant" "{62eb0924-19d2-4226-b4b9-8ad1f70904c1}"="bronchovascular" exports des policies REGEDIT4 [system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 Export des clefs sensibles.. Rechercher adresses sensibles dans le fichier HOSTS... catchme 0.3.1319 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-22 21:05:57 Windows 5.1.2600 NTFS scanning hidden services & system hive ... IPC error: 2 Le fichier spécifié est introuvable. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden services: 0 hidden files: 0 KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg) Process list by traversal of KiWaitListHead 4 - System 208 - vsmon.exe 292 - avgnt.exe 304 - GoogleToolbarNo 636 - csrss.exe 832 - winlogon.exe 876 - services.exe 888 - lsass.exe 1072 - svchost.exe 1152 - svchost.exe 1328 - svchost.exe 1436 - explorer.exe 1520 - spoolsv.exe 1556 - avguard.exe 1732 - zlclient.exe 1780 - guard.exe 1804 - CDAC11BA.EXE 1832 - SAgent2.exe 1956 - svchost.exe 2360 - IEXPLORE.EXE 2732 - cmd.exe Total number of processes = 21 NOTE: Under WinXP, this will not show all processes. KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg) Driver/Module list by traversal of PsLoadedModuleList 804D0000 - \WINDOWS\system32\ntoskrnl.exe 8069D000 - \WINDOWS\system32\hal.dll F7A2F000 - \WINDOWS\system32\KDCOM.DLL F793F000 - \WINDOWS\system32\BOOTVID.dll F74E2000 - ACPI.sys F7A31000 - \WINDOWS\System32\DRIVERS\WMILIB.SYS F752F000 - pci.sys F753F000 - isapnp.sys F7A33000 - viaide.sys F77AF000 - \WINDOWS\System32\DRIVERS\PCIIDEX.SYS F754F000 - MountMgr.sys F74C3000 - ftdisk.sys F7A35000 - dmload.sys F749F000 - dmio.sys F77B7000 - PartMgr.sys F755F000 - VolSnap.sys F7489000 - atapi.sys F756F000 - disk.sys F757F000 - \WINDOWS\System32\DRIVERS\CLASSPNP.SYS F7477000 - sr.sys F758F000 - avgntmgr.sys F77BF000 - PxHelp20.sys F7463000 - KSecDD.sys F73E4000 - Ntfs.sys F73BC000 - NDIS.sys F77C7000 - viaagp1.sys F73A8000 - srescan.sys F738F000 - Mup.sys F771F000 - \SystemRoot\System32\DRIVERS\processr.sys F725F000 - \SystemRoot\System32\DRIVERS\nv4_mini.sys F772F000 - \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS F7A5B000 - \SystemRoot\System32\Drivers\vulfnth.sys F7897000 - \SystemRoot\System32\DRIVERS\usbuhci.sys F7240000 - \SystemRoot\System32\DRIVERS\USBPORT.SYS F789F000 - \SystemRoot\System32\DRIVERS\usbehci.sys F79FB000 - \SystemRoot\system32\drivers\pfc.sys F773F000 - \SystemRoot\System32\DRIVERS\cdrom.sys F774F000 - \SystemRoot\System32\DRIVERS\redbook.sys F7220000 - \SystemRoot\System32\DRIVERS\ks.sys F775F000 - \SystemRoot\System32\Drivers\Imapi.SYS F7183000 - \SystemRoot\system32\drivers\ALCXWDM.SYS F7162000 - \SystemRoot\system32\drivers\portcls.sys F776F000 - \SystemRoot\system32\drivers\drmk.sys F78A7000 - \SystemRoot\System32\DRIVERS\fdc.sys F777F000 - \SystemRoot\System32\DRIVERS\serial.sys F7A07000 - \SystemRoot\System32\DRIVERS\serenum.sys F714F000 - \SystemRoot\System32\DRIVERS\parport.sys F778F000 - \SystemRoot\System32\DRIVERS\i8042prt.sys F78AF000 - \SystemRoot\System32\DRIVERS\kbdclass.sys F7B2F000 - \SystemRoot\system32\drivers\msmpu401.sys F7A0B000 - \SystemRoot\System32\DRIVERS\gameenum.sys F7B30000 - \SystemRoot\System32\DRIVERS\audstub.sys F779F000 - \SystemRoot\System32\DRIVERS\rasl2tp.sys F7A0F000 - \SystemRoot\System32\DRIVERS\ndistapi.sys F7139000 - \SystemRoot\System32\DRIVERS\ndiswan.sys F75BF000 - \SystemRoot\System32\DRIVERS\raspppoe.sys F75CF000 - \SystemRoot\System32\DRIVERS\raspptp.sys F7A13000 - \SystemRoot\System32\DRIVERS\TDI.SYS F7128000 - \SystemRoot\System32\DRIVERS\psched.sys F75DF000 - \SystemRoot\System32\DRIVERS\msgpc.sys F78B7000 - \SystemRoot\System32\DRIVERS\ptilink.sys F78BF000 - \SystemRoot\System32\DRIVERS\raspti.sys F7033000 - \SystemRoot\System32\DRIVERS\rdpdr.sys F75EF000 - \SystemRoot\System32\DRIVERS\termdd.sys F78C7000 - \SystemRoot\System32\DRIVERS\mouclass.sys F7B38000 - \SystemRoot\System32\DRIVERS\swenum.sys F7011000 - \SystemRoot\System32\DRIVERS\update.sys F75FF000 - \SystemRoot\System32\Drivers\NDProxy.SYS F79D3000 - \SystemRoot\System32\Drivers\vulfntr.sys F760F000 - \SystemRoot\System32\DRIVERS\usbhub.sys F7A65000 - \SystemRoot\System32\DRIVERS\USBD.SYS F78F7000 - \SystemRoot\System32\DRIVERS\HIDPARSE.SYS F791F000 - \SystemRoot\System32\DRIVERS\flpydisk.sys F767F000 - \SystemRoot\SYSTEM32\DRIVERS\avgntdd.sys F7A73000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS F7C55000 - \SystemRoot\System32\Drivers\Null.SYS F7A75000 - \SystemRoot\System32\Drivers\Beep.SYS F7C56000 - \SystemRoot\System32\DRIVERS\AvgAsCln.sys F7C57000 - \SystemRoot\System32\Drivers\VIAPFD.SYS F792F000 - \SystemRoot\System32\drivers\vga.sys F7A77000 - \SystemRoot\System32\Drivers\mnmdd.SYS F7A79000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys F7937000 - \SystemRoot\System32\Drivers\Msfs.SYS F77DF000 - \SystemRoot\System32\Drivers\Npfs.SYS F7074000 - \SystemRoot\System32\DRIVERS\rasacd.sys F768F000 - \SystemRoot\System32\DRIVERS\ipsec.sys F17C6000 - \SystemRoot\System32\DRIVERS\tcpip.sys F17A1000 - \SystemRoot\System32\DRIVERS\netbt.sys F1742000 - \SystemRoot\System32\vsdatant.sys F769F000 - \SystemRoot\System32\DRIVERS\netbios.sys F77E7000 - \SystemRoot\System32\DRIVERS\ssmdrv.sys F167A000 - \SystemRoot\System32\DRIVERS\rdbss.sys F161A000 - \SystemRoot\System32\DRIVERS\mrxsmb.sys F76AF000 - \SystemRoot\System32\Drivers\Fips.SYS F76BF000 - \SystemRoot\System32\DRIVERS\wanarp.sys F76CF000 - \SystemRoot\System32\DRIVERS\avipbb.sys F7C66000 - \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys F76DF000 - \SystemRoot\System32\Drivers\Cdfs.SYS F15DC000 - \SystemRoot\System32\Drivers\dump_atapi.sys F7A89000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS BF800000 - \??\C:\WINDOWS\system32\win32k.sys F1F4D000 - \??\C:\WINDOWS\system32\watchdog.sys BFF80000 - \SystemRoot\System32\drivers\dxg.sys F7B4E000 - \SystemRoot\System32\drivers\dxgthk.sys F1F45000 - \SystemRoot\System32\DRIVERS\hidusb.sys F7118000 - \SystemRoot\System32\DRIVERS\HIDCLASS.SYS F1F41000 - \SystemRoot\System32\DRIVERS\usbscan.sys F7807000 - \SystemRoot\System32\DRIVERS\usbiad.sys F7817000 - \SystemRoot\System32\DRIVERS\usbccgp.sys F1F3D000 - \SystemRoot\System32\DRIVERS\mouhid.sys F1548000 - \SystemRoot\System32\DRIVERS\LVCM.sys F7108000 - \SystemRoot\System32\DRIVERS\STREAM.SYS F70F8000 - \SystemRoot\system32\drivers\usbaudio.sys BF993000 - \SystemRoot\System32\nv4_disp.dll F1347000 - \SystemRoot\System32\drivers\afd.sys F13C3000 - \SystemRoot\System32\DRIVERS\ndisuio.sys F113C000 - \SystemRoot\System32\DRIVERS\mrxdav.sys F12C7000 - \??\C:\WINDOWS\System32\drivers\Haspnt.sys F1086000 - \SystemRoot\system32\drivers\hardlock.sys F7ABF000 - \SystemRoot\System32\Drivers\ParVdm.SYS F7847000 - \SystemRoot\System32\drivers\aspi32.sys F1108000 - \??\C:\WINDOWS\System32\drivers\CdaC15BA.SYS F0F77000 - \SystemRoot\System32\DRIVERS\HSF_FALL.sys F0F5A000 - \SystemRoot\System32\DRIVERS\HSF_FSKS.sys F0EFA000 - \SystemRoot\System32\DRIVERS\HSF_K56K.sys F784F000 - \SystemRoot\System32\DRIVERS\secdrv.sys F0EA1000 - \SystemRoot\System32\DRIVERS\HSF_FAXX.sys F0E52000 - \SystemRoot\System32\DRIVERS\srv.sys F11D7000 - \SystemRoot\System32\DRIVERS\HSF_TONE.sys F0D8A000 - \SystemRoot\System32\DRIVERS\HSF_V124.sys F0ACE000 - \SystemRoot\system32\drivers\wdmaud.sys F0BAA000 - \SystemRoot\system32\drivers\sysaudio.sys F04C0000 - \SystemRoot\System32\Drivers\Fastfat.SYS F0499000 - \SystemRoot\system32\drivers\kmixer.sys F7BCD000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys Total number of drivers = 135 Liste des programmes installes a-squared Free 2.1 Ad-Aware SE Personal Adobe Acrobat - Reader 6.0.2 Update Adobe Acrobat 6.0.1 Professional Adobe Acrobat and Reader 6.0.3 Update Adobe Acrobat and Reader 6.0.4 Update Adobe Acrobat and Reader 6.0.5 Update Adobe Acrobat and Reader 6.0.6 Update Adobe Atmosphere Player for Acrobat and Adobe Reader Adobe Flash Player 9 ActiveX Adobe InDesign CS Adobe Photoshop CS ArcSoft PhotoBase 3 ArcSoft PhotoStudio 5 Avance AC'97 Audio AVG Anti-Spyware 7.5 Avira AntiVir PersonalEdition Classic Caesar 3 Canon Utilities PhotoStitch 3.1 CanoScan LiDE20,30 Manual CanoScan Toolbox 4.1 CCleaner (remove only) Cherry Power Wheel Mouse Correctif pour le Lecteur Windows Media [Voir wm828026 pour plus d'informations] dBpowerAMP Music Converter dBpowerAMP WMA V9 Codec eMule Enable S3 for USB Device Encore 4.5.3 EndNote EndNote EPSON Logiciel imprimante Free Easy Burner V 2.0 Google Toolbar for Firefox Google Toolbar for Internet Explorer HijackThis 2.0.2 Internet Fax J2SE Runtime Environment 5.0 Update 6 Kaspersky On-line Scanner Kit de connexion ADSL L&H TTS3000 Français Language Pack for Ad-aware 6 Language pack for Ad-Aware SE Logitech Desktop Messenger Logitech IM Video Companion Logitech ImageStudio MapImagery MapInfo Professional 7.0 Messenger-Control plug-in for Ad-Aware SE Microsoft .NET Framework 1.1 Microsoft Data Access Components KB870669 Microsoft Internet Explorer 6 SP1 Microsoft Office XP Media Content Microsoft Office XP Professional Mozilla Firefox (2.0.0.9) Musicmatch® Jukebox Native Instruments Traktor DJ Player NVIDIA Windows 2000/XP Display Drivers OmniPage SE Outlook Express Q823353 Package du correctif Windows XP [voir Q329115 pour plus de détails] Panda ActiveScan PDFCreator PhotoStitch PowerDVD QuickTime QuickTime RealPlayer SafeCast Shared Components Shockwave Skype 3.1 Skype Plugin Manager Spybot - Search & Destroy 1.4 Steinberg Cubase VST32 5.0 R4 USB MODEM Driver USB Storage Adapter FX (TPP) Utilitaires Sierra VideoLAN VLC media player 0.8.4 VX2 Cleaner plug-in for Ad-Aware SE WebFldrs XP Windows Genuine Advantage Notifications (KB905474) Windows Live Messenger Windows Media Format Runtime Windows XP Application Compatibility Update[Q319580] Windows XP Hotfix (SP1) [see Q309521 for more information] Windows XP Hotfix (SP1) [see Q311889 for more information] Windows XP Hotfix (SP1) [see Q311967 for more information] Windows XP Hotfix (SP1) [see Q313450 for more information] Windows XP Hotfix (SP1) [see Q314147 for more information] Windows XP Hotfix (SP1) [see Q314862 for more information] Windows XP Hotfix (SP1) [see Q315000 for more information] Windows XP Hotfix (SP1) [see Q315403 for more information] Windows XP Hotfix (SP1) [see Q317277 for more information] Windows XP Hotfix (SP1) [see Q318138 for more information] Windows XP Hotfix (SP1) [see Q323172 for more information] Windows XP Hotfix (SP1) [see Q324096 for more information] Windows XP Hotfix (SP1) [see Q324380 for more information] Windows XP Hotfix (SP1) [see Q326830 for more information] Windows XP Hotfix (SP1) [see Q328940 for more information] Windows XP Hotfix (SP1) [see Q329048 for more information] Windows XP Hotfix (SP1) [see Q329390 for more information] Windows XP Hotfix (SP1) [see Q329441 for more information] Windows XP Hotfix (SP1) [see Q329834 for more information] Windows XP Hotfix (SP1) Q328310 Windows XP Hotfix (SP1) Q329170 Windows XP Hotfix (SP1) Q331953 Windows XP Hotfix (SP1) Q810577 Windows XP Hotfix (SP1) Q810833 Windows XP Hotfix (SP1) Q811493 Windows XP Hotfix (SP1) Q815021 Windows XP Hotfix (SP1) Q817606 Windows XP Hotfix (SP1) Q819696 WinRAR Archiveur ZoneAlarm Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 8CC7-5EB8 Répertoire de C:\Program Files 21/01/2008 17:57 <REP> . 21/01/2008 17:57 <REP> .. 22/01/2007 10:16 <REP> Adobe 13/05/2005 07:02 <REP> ahead 21/03/2007 12:58 <REP> Alliance MCA 22/01/2005 23:03 <REP> Alwil Software 15/11/2003 14:01 <REP> ArcSoft 10/01/2008 12:43 <REP> a-squared Free 21/01/2008 17:57 <REP> Avira 30/06/2006 07:45 <REP> Bridgewell 11/11/2005 16:45 <REP> Canon 27/06/2007 06:57 <REP> CCleaner 03/01/2003 15:00 <REP> Cherry 06/12/2003 15:46 <REP> Common Files 26/12/2002 11:04 <REP> ComPlus Applications 06/01/2006 23:04 <REP> CWShredder 26/12/2002 12:00 <REP> CyberLink 14/04/2004 23:10 <REP> dBpowerAMP 05/01/2004 19:59 <REP> directx 10/01/2008 10:53 <REP> DivX 26/12/2002 14:00 <REP> EA GAMES 26/12/2002 12:03 <REP> Elaborate Bytes 06/02/2007 13:55 <REP> Emperors Mahjong 03/12/2007 19:11 <REP> eMule 05/06/2006 00:11 <REP> Encore 4.5.3 15/05/2007 11:43 <REP> EndNote 11/01/2006 22:39 <REP> EPSON 26/03/2006 15:18 <REP> Example Files 25/06/2007 11:17 <REP> Fichiers communs 17/12/2007 22:47 <REP> Free Easy Burner 18/05/2007 10:07 <REP> GID 26/12/2002 11:27 <REP> Gigabyte 15/02/2007 13:36 <REP> Google 30/11/2006 20:48 <REP> Grisoft 14/04/2004 23:08 <REP> Illustrate 05/06/2006 13:32 <REP> Internet Explorer 28/02/2006 17:26 <REP> Java 09/01/2005 19:04 <REP> Kit ADSL 15/12/2004 00:05 <REP> Lavasoft 15/02/2006 20:57 <REP> Logitech 19/12/2006 15:52 <REP> Mahjong Towers II 18/05/2007 10:07 <REP> MapImagery 18/05/2007 10:04 <REP> MapInfo 28/10/2003 20:40 <REP> microsoft frontpage 27/07/2003 21:20 <REP> Microsoft FrontPage Express 11/07/2006 19:56 <REP> Microsoft Office 02/03/2007 00:36 <REP> Movie Maker 21/01/2008 17:56 <REP> Mozilla Firefox 26/12/2002 11:03 <REP> MSN Gaming Zone 30/10/2007 20:11 <REP> MSN Messenger 27/01/2004 21:45 <REP> MUSICMATCH 20/05/2006 17:58 <REP> Native Instruments 17/04/2004 12:04 <REP> NetMeeting 09/11/2004 23:41 <REP> Outlook Express 09/10/2007 00:57 <REP> PDFCreator 17/07/2006 11:57 <REP> QuickTime 10/10/2006 10:06 <REP> Real 10/10/2006 12:51 <REP> ReflexiveArcade 06/10/2006 09:59 774 144 RngInterstitial.dll 13/06/2003 22:22 <REP> ScanSoft 18/05/2007 10:05 <REP> Seagate Software 26/12/2002 11:05 <REP> Services en ligne 26/06/2007 14:43 <REP> Sierra On-Line 19/03/2007 19:44 <REP> Skype 26/05/2005 06:51 <REP> SlySoft 18/10/2007 16:49 <REP> Spybot - Search & Destroy 29/10/2005 15:51 <REP> Steinberg 27/10/2005 17:01 <REP> ToniArts 21/01/2008 16:35 <REP> Trend Micro 09/01/2005 17:49 <REP> USB Driver-Express 26/12/2002 11:28 <REP> VIA Technologies, INC 30/11/2005 18:50 <REP> VideoLAN 22/01/2007 10:16 <REP> Viewpoint 22/03/2006 19:35 <REP> Visicom Media 24/11/2005 17:20 <REP> VSO 16/09/2007 20:52 <REP> Weezo 01/11/2007 13:09 <REP> Windows Live Toolbar 05/01/2004 19:57 <REP> Windows Media Components 17/12/2007 22:46 <REP> Windows Media Player 26/12/2002 11:03 <REP> Windows NT 30/05/2006 22:10 <REP> WinRAR 26/12/2002 11:07 <REP> xerox 05/01/2007 10:05 <REP> Yahoo! 18/10/2007 22:09 <REP> Zone Labs 1 fichier(s) 774 144 octets 83 Rép(s) 19 604 930 560 octets libres Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 8CC7-5EB8 Répertoire de C:\Program Files\fichiers communs 25/06/2007 11:17 <REP> . 25/06/2007 11:17 <REP> .. 19/12/2006 08:35 <REP> Adobe 18/01/2005 12:44 <REP> Adobe Systems Shared 06/01/2003 23:51 <REP> Designer 15/01/2006 10:45 <REP> EPSON 22/01/2005 23:18 <REP> InstallShield 28/02/2006 17:25 <REP> Java 15/02/2006 20:43 <REP> Logitech 26/01/2004 14:57 <REP> Macromedia 12/01/2004 20:18 <REP> Macrovision Shared 10/01/2008 10:52 <REP> Microsoft Shared 26/12/2002 11:04 <REP> MSSoap 26/12/2002 10:56 <REP> ODBC 06/10/2006 09:58 <REP> Real 13/06/2003 22:23 <REP> ScanSoft Shared 25/01/2003 15:27 <REP> Services 19/03/2007 19:44 <REP> Skype 26/12/2002 10:56 <REP> SpeechEngines 27/10/2005 18:47 <REP> Symantec Shared 16/07/2004 22:30 <REP> System 31/07/2007 12:45 <REP> Teleca Shared 05/10/2006 09:15 <REP> xing shared 0 fichier(s) 0 octets 23 Rép(s) 19 604 934 656 octets libres Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 8CC7-5EB8 Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders 06/01/2003 23:51 <REP> . 06/01/2003 23:51 <REP> .. 06/01/2003 23:51 <REP> 1033 06/01/2003 23:51 <REP> 1036 15/02/2001 05:45 1 318 912 MSONSEXT.DLL 13/02/2001 08:23 58 784 MSOSV.DLL 03/06/1999 14:09 122 937 MSOWS409.DLL 07/03/2001 09:00 127 033 MSOWS40c.DLL 06/08/2000 09:04 401 462 MSVCP60.DLL 22/01/2001 03:25 69 632 PKMAXCTL.DLL 22/01/2001 03:25 872 448 PKMCDO.DLL 22/01/2001 03:25 159 744 PKMCORE.DLL 07/02/2001 09:59 106 496 PKMFORMS.DLL 12/02/2001 04:03 684 032 PKMRES.DLL 22/01/2001 03:25 28 672 PKMSSTLB.DLL 22/01/2001 03:25 40 960 PKMTEMPL.DLL 22/01/2001 03:25 24 576 PKMTRACE.DLL 22/01/2001 03:25 86 016 PKMWS.DLL 22/01/2001 03:25 237 568 PROMDEMO.DLL 22/01/2001 03:25 184 320 SECMGR.DLL 22/01/2001 03:25 323 584 VAIDDMGR.DLL 22/01/2001 03:25 32 768 VAIMEM.DLL 18 fichier(s) 4 879 944 octets 4 Rép(s) 19 604 934 656 octets libres Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 8CC7-5EB8 Répertoire de C:\Program Files\common files 06/12/2003 15:46 <REP> . 06/12/2003 15:46 <REP> .. 17/08/2004 22:54 <REP> System 0 fichier(s) 0 octets 3 Rép(s) 19 604 934 656 octets libres c:\Documents and Settings\Administrateur\Bureau\HijackThis.exe c:\Documents and Settings\THOMAS\.housecall\getMac.exe c:\Documents and Settings\THOMAS\.housecall\patch.exe c:\Documents and Settings\THOMAS\.housecall\tsc.exe c:\Documents and Settings\THOMAS\Application Data\Microsoft\Installer\{532EFE70-19BC-4F0F-8F50-D5F15C243133}\NewShortcut1_8315396A5EA1419DBEC4978284BDF556.exe c:\Documents and Settings\THOMAS\Application Data\Microsoft\Installer\{8DD86BF7-28B3-4CE9-88AE-E6EC790CAECA}\NewShortcut1_8315396A5EA1419DBEC4978284BDF556.exe c:\Documents and Settings\THOMAS\Bureau\VundoFix.exe c:\Documents and Settings\THOMAS\Bureau\DiagHelp\DiagHelp\catchme.exe c:\Documents and Settings\THOMAS\Bureau\DiagHelp\DiagHelp\diff.exe c:\Documents and Settings\THOMAS\Bureau\DiagHelp\DiagHelp\dumphive.exe c:\Documents and Settings\THOMAS\Bureau\DiagHelp\DiagHelp\FilesInfoCmd.exe c:\Documents and Settings\THOMAS\Bureau\DiagHelp\DiagHelp\find2.exe c:\Documents and Settings\THOMAS\Bureau\DiagHelp\DiagHelp\Fport.exe c:\Documents and Settings\THOMAS\Bureau\DiagHelp\DiagHelp\grep.exe c:\Documents and Settings\THOMAS\Bureau\DiagHelp\DiagHelp\gzip.exe c:\Documents and Settings\THOMAS\Bureau\DiagHelp\DiagHelp\KProcCheck.exe c:\Documents and Settings\THOMAS\Bureau\DiagHelp\DiagHelp\LFiles.exe c:\Documents and Settings\THOMAS\Bureau\DiagHelp\DiagHelp\LISTDLLS.exe c:\Documents and Settings\THOMAS\Bureau\DiagHelp\DiagHelp\md5sums.exe c:\Documents and Settings\THOMAS\Bureau\DiagHelp\DiagHelp\pslist.exe c:\Documents and Settings\THOMAS\Bureau\DiagHelp\DiagHelp\sigcheck.exe c:\Documents and Settings\THOMAS\Bureau\DiagHelp\DiagHelp\streams.exe c:\Documents and Settings\THOMAS\Bureau\DiagHelp\DiagHelp\swreg.exe c:\Documents and Settings\THOMAS\Bureau\DiagHelp\DiagHelp\tar.exe c:\Documents and Settings\THOMAS\Bureau\Doc tom\Shaddok\Setup.exe c:\Documents and Settings\THOMAS\Bureau\Nettoyage ordi\Procédure nettoyage\antivir_workstation_win7u_en_h.exe c:\Documents and Settings\THOMAS\Bureau\Nettoyage ordi\Procédure nettoyage\haxfix.exe c:\Documents and Settings\THOMAS\Local Settings\Temp\RarSFX0\basic\preupd.exe c:\Documents and Settings\THOMAS\Local Settings\Temp\RarSFX0\basic\sched.exe c:\Documents and Settings\THOMAS\Local Settings\Temp\RarSFX0\basic\setup.exe c:\Documents and Settings\THOMAS\Local Settings\Temp\RarSFX0\basic\update.exe c:\Documents and Settings\THOMAS\Local Settings\Temp\RarSFX0\basic\wsctool.exe c:\Documents and Settings\THOMAS\Mes documents\software\mmsetup_8000126b_FRA.exe c:\Documents and Settings\Violaine\.housecall\getMac.exe c:\Documents and Settings\Violaine\.housecall\patch.exe c:\Documents and Settings\Violaine\.housecall\tsc.exe c:\Documents and Settings\Violaine\Application Data\Microsoft\Installer\{333BECA0-DED8-4139-A516-8D9E44E22669}\ARPPRODUCTICON.exe c:\Documents and Settings\Violaine\Application Data\Microsoft\Installer\{333BECA0-DED8-4139-A516-8D9E44E22669}\NewShortcut2_8315396A5EA1419DBEC4978284BDF556.exe c:\Documents and Settings\Violaine\Application Data\Microsoft\Installer\{333BECA0-DED8-4139-A516-8D9E44E22669}\NewShortcut3_8315396A5EA1419DBEC4978284BDF556.exe c:\Documents and Settings\Violaine\Application Data\Microsoft\Installer\{AC76BA86-0000-0000-0000-6028747ADE01}\ARPPRODUCTICON.exe c:\Documents and Settings\Violaine\Application Data\Mozilla\Firefox\Profiles\tbpybcet.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\ffti.exe c:\Documents and Settings\Violaine\Bureau\SafeFax-current-FR.exe c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll c:\Documents and Settings\THOMAS\Application Data\Creative\Media Database\JetFileBackup\Expsrv.dll c:\Documents and Settings\THOMAS\Application Data\Creative\Media Database\JetFileBackup\Msado15.dll c:\Documents and Settings\THOMAS\Application Data\Creative\Media Database\JetFileBackup\Msadox.dll c:\Documents and Settings\THOMAS\Application Data\Creative\Media Database\JetFileBackup\Msadrh15.dll c:\Documents and Settings\THOMAS\Application Data\Creative\Media Database\JetFileBackup\Msjet40.dll c:\Documents and Settings\THOMAS\Application Data\Creative\Media Database\JetFileBackup\Msjetoledb40.dll c:\Documents and Settings\THOMAS\Application Data\Creative\Media Database\JetFileBackup\Msjint40.dll c:\Documents and Settings\THOMAS\Application Data\Creative\Media Database\JetFileBackup\Msjro.dll c:\Documents and Settings\THOMAS\Application Data\Creative\Media Database\JetFileBackup\Msjter40.dll c:\Documents and Settings\THOMAS\Application Data\Creative\Media Database\JetFileBackup\Msjtes40.dll c:\Documents and Settings\THOMAS\Application Data\Creative\Media Database\JetFileBackup\Mswstr10.dll c:\Documents and Settings\THOMAS\Application Data\Creative\Media Database\JetFileBackup\vbajet32.dll c:\Documents and Settings\THOMAS\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll c:\Documents and Settings\Violaine\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll c:\Documents and Settings\Violaine\Application Data\Mozilla\Firefox\Profiles\tbpybcet.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll c:\Documents and Settings\Violaine\Application Data\Mozilla\Firefox\Profiles\tbpybcet.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll ****** Fin du rapport DiagHelp Veuillez svp envoyer le fichier C:\upload_moi_THOMAS-N5FGCPED.tar.gz a l'adresse http://upload.malekal.com

Bonjour, Je suis infecté par un cheval de troie dont je n'arrive pas à me défaire. Pouvez-vous m'aider ? Voici mon log hijack. Merci Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:36:56, on 21/01/2008 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\a-squared Free\a2service.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe C:\WINDOWS\LogWatNT.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\System32\WgaTray.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Alwil Software\Avast4\ashLogV.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: (no name) - {E1759A31-E627-4758-9562-6899DF36C9C2} - C:\WINDOWS\System32\ssqoopm.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-21-1123561945-616249376-725345543-1004\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'Violaine') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure...teleir_cert.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.zebulon.fr/outils/antivirus/kav...can_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://go.divx.com/plugin/DivXBrowserPlugin.cab O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/fr/big/1.1....g/GoogleNav.cab O16 - DPF: {7DA181BB-EF8D-4A7E-8C53-7BFC718EF71D} (Upload Class) - http://photos.orange.fr/al/presentation/pc...ivex/Ephoto.cab O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion...canner37710.cab O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse...pdownloader.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll O20 - Winlogon Notify: ssqoopm - C:\WINDOWS\SYSTEM32\ssqoopm.dll O22 - SharedTaskScheduler: bronchovascular - {62eb0924-19d2-4226-b4b9-8ad1f70904c1} - (no file) O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Event Log Watch (LogWatch) - Unknown owner - C:\WINDOWS\LogWatNT.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 8067 bytes

Bonjour, Je n'ai pas de problème mis à part que maintenant j'ai toujours msn en page d'accueil. (cela ne le fait que pour ie sur ma session car quand je change de session je n'ai pas ce pb) Et cela depuis que j'ai fait les manips que tu me conseillais. J'ai essayé de voir si c'était un spyware avec adaware et spybot mais ils n'ont rien trouvés de spécial ? Voici l'adresse qu' IE me charge à chaque fois même si je change ma page d'accueil : http://www.microsoft.com/isapi/redir.dll?p...&ar=msnhome Bizarre c'est une adresse microsoft redirigée ? Je n'y comprends pas grand chose.

Re-bonjour, J'ai refait la manip avec fixwareout. Exactement comme tu me l'avais expliqué (comme la première fois d'ailleurs) à part que je n'ai pas du supprimer les éléments avec hijack puisuqe je l'avais déjà fait. Apparemment l ça a donné la même chose au niveau du fix. Et au redémarrage d'internet ma page d'acceuil google avait éte virée pour http://www.microsoft.com/isapi/redir.dll?p...&ar=msnhome Voici les logs : Fixwareout ver 1.003 Last edited 04/26/2006 Post this report in the forums please Reg Entries that were deleted ... Microsoft ® Windows Script Host Version 5.6 Random Runs removed from HKLM ... PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. Example ipsec6.exe is lagitamate »»»»» Search by size and names... »»»»» Misc files »»»»» Checking for older varients covered by the Rem3 tool »»»»» Search five digit cs, dm and jb files This WILL/CAN also list Legit Files, Submit them at Virustotal C:\WINDOWS\SYSTEM32\DMCPL.EXE 278 528 2002-08-31 Logfile of HijackThis v1.99.1 Scan saved at 20:38:57, on 28/06/2006 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\WINDOWS\LogWatNT.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\hijackthis\HijackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O12 - Plugin for .m4a: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin6.dll O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure...teleir_cert.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.zebulon.fr/outils/antivirus/kav...can_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/fr/big/1.1....g/GoogleNav.cab O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab O16 - DPF: {7DA181BB-EF8D-4A7E-8C53-7BFC718EF71D} (Upload Class) - http://photos.wanadoo.fr/al/presentation/p...ivex/Ephoto.cab O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion...canner37710.cab O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse...pdownloader.cab O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Event Log Watch (LogWatch) - Unknown owner - C:\WINDOWS\LogWatNT.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe A bientôt

Salut Bruce Lee, Voici le log de fixwareout (que j'ai enfin pu télécharger!) a Fixwareout ver 1.003 Last edited 04/26/2006 Post this report in the forums please Reg Entries that were deleted ... Microsoft ® Windows Script Host Version 5.6 Random Runs removed from HKLM ... PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. Example ipsec6.exe is lagitamate »»»»» Search by size and names... »»»»» Misc files »»»»» Checking for older varients covered by the Rem3 tool »»»»» Search five digit cs, dm and jb files This WILL/CAN also list Legit Files, Submit them at Virustotal C:\WINDOWS\SYSTEM32\DMCPL.EXE 278 528 2002-08-31 Et voici mon nouveau log Hijack Logfile of HijackThis v1.99.1 Scan saved at 19:14:48, on 26/06/2006 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\WINDOWS\LogWatNT.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\hijackthis\HijackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O12 - Plugin for .m4a: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin6.dll O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure...teleir_cert.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.zebulon.fr/outils/antivirus/kav...can_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/fr/big/1.1....g/GoogleNav.cab O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab O16 - DPF: {7DA181BB-EF8D-4A7E-8C53-7BFC718EF71D} (Upload Class) - http://photos.wanadoo.fr/al/presentation/p...ivex/Ephoto.cab O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion...canner37710.cab O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse...pdownloader.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0EEC1819-E098-43D7-83B4-6ACF6D02B0E1}: NameServer = 85.255.113.149,85.255.112.218 O17 - HKLM\System\CCS\Services\Tcpip\..\{1308FF24-5F30-45AE-B491-28ED8A610178}: NameServer = 85.255.113.149,85.255.112.218 O17 - HKLM\System\CCS\Services\Tcpip\..\{7B044DED-BBB4-4656-A62D-50797FF6860A}: NameServer = 85.255.113.149,85.255.112.218 O17 - HKLM\System\CCS\Services\Tcpip\..\{FDD6565E-8E2B-48E1-8A6E-3C60E33023C7}: NameServer = 85.255.113.149 85.255.112.218 O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Event Log Watch (LogWatch) - Unknown owner - C:\WINDOWS\LogWatNT.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe Question quand j'ai rallumé mon pc après fixwareout je me suis connecté et ma page d'accueil habituellement google a été sur msn.com. C'est normal ? A Plus