Ladysun

J'ai essayé avec le lien et le message suivant s'affiche : la branche d'installation nécessaire était introuvable dans le fichier INF. Donc voilà je ne sais pas comment faire. Si vous pouviez éclairer ma lanterne. Merci

Bonjour, Je me tourne à nouveau vers vous car lorsque windows me signale qu'il y a des mises à jour possible,celle relative à la sécurité ne peut pas s'installer. En effet, cela ma met : la mise à jour sécurité (KB 946648) n'a pas pu être installée Je sollicite donc votre aide, qui auparavant m'avait été précieuse et bien utile. D'autant que mon pc a tendance à planté quelques fois et à s'éteindre tout simple ou afficher un écran noir. En attendant vos conseils je vous souhaite une bonne journée.

Coucou, A vrai dire je ne saurais comment t'expliquer comment j'ai fait Et malheureusement je ne possède pas le cd de windows c'est ça le hik...

Coucou Thanos, Ecoutes hier j'ai bidouillé Mozilla et ô miracle tout est redevenu normal nikel. Le seul truc embêtant maintenant c'est que je n'arrive pas à installer la console de récup...Si tu as une autre méthode... Merci pour ton aide en tout cas ! Bonne journée

Bonjour, J'ai suivi tes instructions à la lettre et je n'arrive toujours pas, étrangement, à installer la console de récupération. Il y a plein d'autres fonctions que je ne peux plus utiliser depuis ATF Cleaner. J'utilise Mozilla Firefox et d'ailleurs j'ai souci qu'avec Mozilla pas Internet explorer. Par exemple sur le forum, à part le fait que je ne vois plus les lignes blanches séparatrices de chaque post ainsi que les encadrés bleus, lorsque je clique sur le smiley, ou pour mettre un mot en gras, ça ne fonctionne pas. De plus il y a plusieurs vidéos que je n'arrive pas à voir sur le net à cause de ça. J'ai pourtant la dernière version de Firefox donc je ne comprends et c'est parfois très enquiquinant. Si tu pouvais éclairer ma lanterne...

Bonjour, J'ai suivi tes instructions à la lettre et je n'arrive toujours pas, étrangement, à installer la console de récupération. Il y a plein d'autres fonctions que je ne peux plus utiliser depuis ATF Cleaner. J'utilise Mozilla Firefox et d'ailleurs j'ai souci qu'avec Mozilla pas Internet explorer. Par exemple sur le forum, à part le fait que je ne vois plus les lignes blanches séparatrices de chaque post ainsi que les encadrés bleus, lorsque je clique sur le smiley, ou pour mettre un mot en gras, ça ne fonctionne pas. De plus il y a plusieurs vidéos que je n'arrive pas à voir sur le net à cause de ça. J'ai pourtant la dernière version de Firefox donc je ne comprends et c'est parfois très enquiquinant. Si tu pouvais éclairer ma lanterne...

Bonjour, Je crois que je n'ai toujours pas réussi à installer la console de récupération...En fait quand je clique sur le lien vers microsoft après le téléchargement on me demande vers quelle disquette le transférer...ce à quoi j'ai mis C mais après rien ne s'est produit. Sinon depuis que j'ai utilisé ATF Cleaner, par exemple sur ce forum je ne vois plus les lignes qui séparent chaque poste. Sinon RAS. Bonne après midi

Bonjour, En fait j'ai supprimé ce fichier de mon ordinateur > C:\Logiciels\vista\Transparency Donnez à vos fenêtres un petit air de Vista en .exe > et ce bien avant de lire ton message car je n'en voyais plus l'utilité. Est ce que je dois malgré tout faire la suite des manip' indiquées ? Merci pour ton aide et vive le printemps

Merci beaucoup pour tes explications. Voici le rapport du scan : ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Thursday, May 01, 2008 8:02:50 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 1/05/2008 Kaspersky Anti-Virus database records: 734176 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ I:\ J:\ K:\ L:\ Scan Statistics: Total number of scanned objects: 100539 Number of viruses found: 8 Number of infected objects: 23 Number of suspicious objects: 0 Duration of the scan process: 02:01:50 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Sophie\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Sophie\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Sophie\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Sophie\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Sophie\Local Settings\Historique\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Sophie\Local Settings\Historique\History.IE5\MSHist012008050120080502\index.dat Object is locked skipped C:\Documents and Settings\Sophie\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Sophie\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Sophie\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Sophie\UserData\index.dat Object is locked skipped C:\QooBox\Quarantine\C\Documents and Settings\Sophie\Bureau\SDFix\backups\backups.zip.vir/backups/b155.exe Infected: Trojan.Win32.BHO.bhg skipped C:\QooBox\Quarantine\C\Documents and Settings\Sophie\Bureau\SDFix\backups\backups.zip.vir/backups/b156.exe Infected: not-a-virus:AdWare.Win32.Insider.f skipped C:\QooBox\Quarantine\C\Documents and Settings\Sophie\Bureau\SDFix\backups\backups.zip.vir/backups/b157.exe Infected: Trojan-Downloader.Win32.Agent.jih skipped C:\QooBox\Quarantine\C\Documents and Settings\Sophie\Bureau\SDFix\backups\backups.zip.vir/backups/SpeedRunner.exe Infected: Trojan-Downloader.Win32.Agent.ndt skipped C:\QooBox\Quarantine\C\Documents and Settings\Sophie\Bureau\SDFix\backups\backups.zip.vir/backups/^%%% % ^ ^^ %^ %^ % ^ ^%^% ^%^^^%^^ %.exe Infected: Backdoor.Win32.IRCBot.cow skipped C:\QooBox\Quarantine\C\Documents and Settings\Sophie\Bureau\SDFix\backups\backups.zip.vir/backups/^^%%%% %^ ^^ %^^^ %%^ %^% ^^^ %^%^%%%.exe Infected: Backdoor.Win32.IRCBot.cow skipped C:\QooBox\Quarantine\C\Documents and Settings\Sophie\Bureau\SDFix\backups\backups.zip.vir ZIP: infected - 6 skipped C:\QooBox\Quarantine\C\WINDOWS\system32\bntpme.exe.vir Infected: Trojan-Downloader.Win32.Small.tnt skipped C:\QooBox\Quarantine\C\WINDOWS\system32\kewgwh.exe.vir Infected: Trojan-Downloader.Win32.Small.tnt skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP876\A0093029.exe Infected: not-a-virus:AdWare.Win32.NewDotNet.e skipped C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP876\A0093030.dll Infected: not-a-virus:AdWare.Win32.PowerSearch.c skipped C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP932\A0141270.exe Infected: Trojan-Downloader.Win32.Agent.ndt skipped C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP932\A0141274.exe Infected: Trojan.Win32.BHO.bhg skipped C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP932\A0141275.exe Infected: not-a-virus:AdWare.Win32.Insider.f skipped C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP932\A0141276.exe Infected: Trojan-Downloader.Win32.Agent.jih skipped C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP932\A0141282.exe Infected: Trojan.Win32.BHO.bhg skipped C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP932\A0141283.exe Infected: not-a-virus:AdWare.Win32.Insider.f skipped C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP932\A0141284.exe Infected: Trojan-Downloader.Win32.Agent.jih skipped C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP932\A0141288.exe Infected: Trojan-Downloader.Win32.Agent.ndt skipped C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP932\A0141293.exe Infected: Backdoor.Win32.IRCBot.cow skipped C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP932\A0141294.exe Infected: Backdoor.Win32.IRCBot.cow skipped C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP937\A0141896.exe Infected: Trojan-Downloader.Win32.Small.tnt skipped C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP937\A0141898.exe Infected: Trojan-Downloader.Win32.Small.tnt skipped C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP937\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped Bon ça craint j'ai encore 8 virus et 23 fichiers infectés Penses tu que je devrais changer d'antivirus ?

Bonjour, Voici le premier rapport : ComboFix 08-04-24.1 - Sophie 2008-05-01 12:08:07.3 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.493 [GMT 2:00] Endroit: C:\Documents and Settings\Sophie\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Sophie\Bureau\WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe * Création d'un nouveau point de restauration AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !! . ((((((((((((((((((((((((((((( Fichiers créés 2008-04-01 to 2008-05-01 )))))))))))))))))))))))))))))))))))) . 2008-04-24 13:26 . 2008-04-24 13:26 <REP> d-------- C:\WINDOWS\ERUNT 2008-04-24 13:11 . 2008-04-24 13:11 244 --ah----- C:\sqmnoopt07.sqm 2008-04-24 13:11 . 2008-04-24 13:11 232 --ah----- C:\sqmdata07.sqm 2008-04-22 17:35 . 2008-04-22 17:35 244 --ah----- C:\sqmnoopt06.sqm 2008-04-22 17:35 . 2008-04-22 17:35 232 --ah----- C:\sqmdata06.sqm 2008-04-22 17:10 . 2008-04-22 17:10 244 --ah----- C:\sqmnoopt05.sqm 2008-04-22 17:10 . 2008-04-22 17:10 232 --ah----- C:\sqmdata05.sqm 2008-04-21 18:15 . 2008-04-21 18:15 244 --ah----- C:\sqmnoopt04.sqm 2008-04-21 18:15 . 2008-04-21 18:15 232 --ah----- C:\sqmdata04.sqm 2008-04-17 23:15 . 2008-04-17 23:15 8,272 --a------ C:\WINDOWS\system32\efbrdv.exe 2008-04-17 23:15 . 2008-04-17 23:15 244 --ah----- C:\sqmnoopt03.sqm 2008-04-17 23:15 . 2008-04-17 23:15 232 --ah----- C:\sqmdata03.sqm 2008-04-17 15:49 . 2008-04-17 15:49 244 --ah----- C:\sqmnoopt02.sqm 2008-04-17 15:49 . 2008-04-17 15:49 232 --ah----- C:\sqmdata02.sqm 2008-04-16 22:07 . 2008-04-16 22:07 8,272 --a------ C:\WINDOWS\system32\miierc.exe 2008-04-16 22:07 . 2008-04-16 22:07 244 --ah----- C:\sqmnoopt01.sqm 2008-04-16 22:07 . 2008-04-16 22:07 232 --ah----- C:\sqmdata01.sqm 2008-04-14 21:40 . 2008-04-14 21:40 9,296 --a------ C:\WINDOWS\system32\bntpme.exe 2008-04-14 19:34 . 2008-04-14 19:34 9,296 --a------ C:\WINDOWS\system32\kewgwh.exe 2008-04-14 19:34 . 2008-04-14 19:34 244 --ah----- C:\sqmnoopt00.sqm 2008-04-14 19:34 . 2008-04-14 19:34 232 --ah----- C:\sqmdata00.sqm . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-25 17:46 --------- d-----w C:\Program Files\Microsoft ActiveSync 2008-04-14 16:35 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-13 14:59 --------- d-----w C:\Program Files\PixDiscount 2008-04-07 17:22 --------- d-----w C:\Program Files\Téléchargement PHOTOWAYS 2008-04-02 10:37 --------- d-----w C:\Program Files\Java 2008-03-31 10:45 --------- d-----w C:\Program Files\Messenger Plus! Live 2008-03-30 17:07 36,368 ----a-w C:\windows\system32\drivers\tmpreflt.sys 2008-03-30 17:07 204,816 ----a-w C:\windows\system32\drivers\tmxpflt.sys 2008-03-30 16:50 1,169,240 ----a-w C:\windows\system32\drivers\VsapiNT.sys 2008-03-20 08:09 1,845,376 ----a-w C:\windows\system32\win32k.sys 2008-03-20 08:09 1,845,376 ------w C:\windows\system32\dllcache\win32k.sys 2008-03-01 16:28 3,591,680 ----a-w C:\windows\system32\dllcache\mshtml.dll 2008-02-29 08:57 625,664 ----a-w C:\windows\system32\dllcache\iexplore.exe 2008-02-29 08:56 70,656 ------w C:\windows\system32\dllcache\ie4uinit.exe 2008-02-22 10:00 13,824 ------w C:\windows\system32\dllcache\ieudinit.exe 2008-02-20 06:51 282,624 ----a-w C:\windows\system32\gdi32.dll 2008-02-20 06:51 282,624 ------w C:\windows\system32\dllcache\gdi32.dll 2008-02-20 05:35 45,568 ----a-w C:\windows\system32\dnsrslvr.dll 2008-02-20 05:35 45,568 ------w C:\windows\system32\dllcache\dnsrslvr.dll 2008-02-20 05:35 148,992 ------w C:\windows\system32\dllcache\dnsapi.dll 2008-02-15 05:44 161,792 ------w C:\windows\system32\dllcache\ieakui.dll 2007-09-23 13:20 48,856 ----a-w C:\Documents and Settings\Sophie\Application Data\GDIPFONTCACHEV1.DAT 2005-06-06 15:32 284 -c--a-w C:\Documents and Settings\Sophie\Application Data\ViewerApp.dat 2005-05-02 12:12 56 --sh--r C:\windows\system32\006FA882FA.sys 2005-05-02 12:12 1,682 -csha-w C:\windows\system32\KGyGaAvL.sys . <pre> ----a-w 238,401 2006-07-06 13:42:50 C:\Logiciels\vista\Transparency Donnez à vos fenêtres un petit air de Vista en .exe </pre> ((((((((((((((((((((((((((((( snapshot@2008-04-27_11.49.28,06 ))))))))))))))))))))))))))))))))))))))))) . - 2008-04-27 09:26:32 2,048 --s-a-w C:\windows\bootstat.dat + 2008-05-01 09:29:08 2,048 --s-a-w C:\windows\bootstat.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ares"="C:\Program Files\Ares\Ares.exe" [ ] "ctfmon.exe"="C:\windows\system32\ctfmon.exe" [2004-08-05 15:00 15360] "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-10-08 12:06 196608] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208] "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 15:00 208952] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 15:00 455168] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 15:00 455168] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-07-12 17:50 4112384] "nwiz"="nwiz.exe" [2004-07-12 17:50 843776 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-07-12 17:50 81920] "ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 11:31 24576] "VCSPlayer"="C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe" [2004-03-04 15:08 299008] "CleanEasyImg"="c:\apps\easydvd\cleanall.exe" [ ] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 11:52 221184] "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-10-08 12:31 458752] "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-10-08 12:24 217088] "pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" [2004-10-27 11:05 823361] "MySight 2006 BS Check&Random"="C:\Program Files\MySight 2006\quickbs.exe" [2006-11-11 19:37 409088] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 21:16 286720] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15:00 15360] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ OFFICE One Clock v6.5.lnk - C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe [2006-04-09 00:47:23 257536] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.HFYU"= huffyuv.dll "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.divxa32"= DivXa32.acm "vidc.CDVC"= cdvccodc.dll "vidc.dvsd"= mcdvd_32.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk backup=C:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent] --a------ 2004-08-05 15:00 110592 C:\WINDOWS\system32\bthprops.cpl [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2005-02-17 00:11 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail] --a------ 2006-10-18 13:31 204843 C:\PROGRA~1\INCRED~1\bin\IncMail.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2007-11-02 19:36 267048 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] -ra------ 2001-07-09 12:50 155648 C:\windows\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService] --a------ 2004-10-08 04:14 81920 c:\Apps\Powercinema\PCMService.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2005-12-24 18:49 180269 C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2007-10-10 07:28 36352 C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YeppStudioAgent] C:\Program Files\Samsung\SamsungMediaStudio4.1\SamsungMediaStudioAgent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "AOL ACS"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%ProgramFiles%\\AOL 9.0\\aol.exe"= "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"= "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\APPS\\Inventime\\my.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"= "C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"= "C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= R1 vcsmpdrv;vcsmpdrv;C:\windows\system32\DRIVERS\vcsmpdrv.sys [2003-06-16 17:07] R2 Vcs;Vcs support;C:\WINDOWS\system32\Drivers\Vcs.sys [2002-12-10 10:11] R2 VCSSecS;Virtual CD v4 Security service (SDK - Version);C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe [2002-05-16 12:17] R3 USBSTOR;Pilote de stockage de masse USB;C:\windows\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08] S3 ids00026;ids00026;C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00026.sys [] S3 memsysdrv;Memory System;C:\WINDOWS\system32\drivers\memsysdrv.sys [2005-08-20 13:53] S3 usbscan;Pilote de scanneur USB;C:\windows\system32\DRIVERS\usbscan.sys [2004-08-03 23:58] *Newly Created Service* - CATCHME . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2008-04-26 15:29:11 C:\windows\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-05-01 10:00:05 C:\windows\Tasks\HPpromotions journeysoftware.job" - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-01 12:12:38 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet002\Services\MysqlInventime] "ImagePath"="c:\mysql\bin\mysqld-nt MysqlInventime" . Temps d'accomplissement: 2008-05-01 12:18:33 ComboFix-quarantined-files.txt 2008-05-01 10:17:29 ComboFix2.txt 2008-04-29 16:59:34 ComboFix3.txt 2008-04-27 09:50:14 Pre-Run: 108,648,108,032 octets libres Post-Run: 108,630,380,544 octets libres 187 --- E O F --- 2008-04-08 21:07:55 Second rapport : ComboFix 08-04-24.1 - Sophie 2008-05-01 12:44:24.4 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.625 [GMT 2:00] Endroit: C:\Documents and Settings\Sophie\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Sophie\Bureau\CFScript.txt * Création d'un nouveau point de restauration AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !! FILE :: C:\windows\mrofinu1423.exe C:\WINDOWS\system32\bntpme.exe C:\WINDOWS\system32\efbrdv.exe C:\WINDOWS\system32\kewgwh.exe C:\WINDOWS\system32\miierc.exe C:\WINDOWS\system32\wxpmin.dll . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Sophie\Application Data\BOLTBA~1 C:\Documents and Settings\Sophie\Application Data\BOLTBA~1\891FF6BF C:\Documents and Settings\Sophie\Application Data\ONEFRA~1 C:\WINDOWS\system32\bntpme.exe C:\WINDOWS\system32\efbrdv.exe C:\WINDOWS\system32\kewgwh.exe C:\WINDOWS\system32\miierc.exe C:\WINDOWS\system32\wxpmin.dll . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-01 to 2008-05-01 )))))))))))))))))))))))))))))))))))) . 2008-04-24 13:26 . 2008-04-24 13:26 <REP> d-------- C:\WINDOWS\ERUNT 2008-04-24 13:11 . 2008-04-24 13:11 244 --ah----- C:\sqmnoopt07.sqm 2008-04-24 13:11 . 2008-04-24 13:11 232 --ah----- C:\sqmdata07.sqm 2008-04-22 17:35 . 2008-04-22 17:35 244 --ah----- C:\sqmnoopt06.sqm 2008-04-22 17:35 . 2008-04-22 17:35 232 --ah----- C:\sqmdata06.sqm 2008-04-22 17:10 . 2008-04-22 17:10 244 --ah----- C:\sqmnoopt05.sqm 2008-04-22 17:10 . 2008-04-22 17:10 232 --ah----- C:\sqmdata05.sqm 2008-04-21 18:15 . 2008-04-21 18:15 244 --ah----- C:\sqmnoopt04.sqm 2008-04-21 18:15 . 2008-04-21 18:15 232 --ah----- C:\sqmdata04.sqm 2008-04-17 23:15 . 2008-04-17 23:15 244 --ah----- C:\sqmnoopt03.sqm 2008-04-17 23:15 . 2008-04-17 23:15 232 --ah----- C:\sqmdata03.sqm 2008-04-17 15:49 . 2008-04-17 15:49 244 --ah----- C:\sqmnoopt02.sqm 2008-04-17 15:49 . 2008-04-17 15:49 232 --ah----- C:\sqmdata02.sqm 2008-04-16 22:07 . 2008-04-16 22:07 244 --ah----- C:\sqmnoopt01.sqm 2008-04-16 22:07 . 2008-04-16 22:07 232 --ah----- C:\sqmdata01.sqm 2008-04-14 19:34 . 2008-04-14 19:34 244 --ah----- C:\sqmnoopt00.sqm 2008-04-14 19:34 . 2008-04-14 19:34 232 --ah----- C:\sqmdata00.sqm . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-25 17:46 --------- d-----w C:\Program Files\Microsoft ActiveSync 2008-04-14 16:35 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-13 14:59 --------- d-----w C:\Program Files\PixDiscount 2008-04-07 17:22 --------- d-----w C:\Program Files\Téléchargement PHOTOWAYS 2008-04-02 10:37 --------- d-----w C:\Program Files\Java 2008-03-31 10:45 --------- d-----w C:\Program Files\Messenger Plus! Live 2008-03-30 17:07 36,368 ----a-w C:\windows\system32\drivers\tmpreflt.sys 2008-03-30 17:07 204,816 ----a-w C:\windows\system32\drivers\tmxpflt.sys 2008-03-30 16:50 1,169,240 ----a-w C:\windows\system32\drivers\VsapiNT.sys 2007-09-23 13:20 48,856 ----a-w C:\Documents and Settings\Sophie\Application Data\GDIPFONTCACHEV1.DAT 2005-06-06 15:32 284 -c--a-w C:\Documents and Settings\Sophie\Application Data\ViewerApp.dat 2005-05-02 12:12 56 --sh--r C:\windows\system32\006FA882FA.sys 2005-05-02 12:12 1,682 -csha-w C:\windows\system32\KGyGaAvL.sys . <pre> ----a-w 238,401 2006-07-06 13:42:50 C:\Logiciels\vista\Transparency Donnez à vos fenêtres un petit air de Vista en .exe </pre> ((((((((((((((((((((((((((((( snapshot@2008-04-27_11.49.28,06 ))))))))))))))))))))))))))))))))))))))))) . - 2008-04-27 09:26:32 2,048 --s-a-w C:\windows\bootstat.dat + 2008-05-01 10:45:58 2,048 --s-a-w C:\windows\bootstat.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ares"="C:\Program Files\Ares\Ares.exe" [ ] "ctfmon.exe"="C:\windows\system32\ctfmon.exe" [2004-08-05 15:00 15360] "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-10-08 12:06 196608] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208] "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 15:00 208952] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 15:00 455168] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 15:00 455168] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-07-12 17:50 4112384] "nwiz"="nwiz.exe" [2004-07-12 17:50 843776 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-07-12 17:50 81920] "ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 11:31 24576] "VCSPlayer"="C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe" [2004-03-04 15:08 299008] "CleanEasyImg"="c:\apps\easydvd\cleanall.exe" [ ] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 11:52 221184] "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-10-08 12:31 458752] "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-10-08 12:24 217088] "pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" [2004-10-27 11:05 823361] "MySight 2006 BS Check&Random"="C:\Program Files\MySight 2006\quickbs.exe" [2006-11-11 19:37 409088] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 21:16 286720] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15:00 15360] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.HFYU"= huffyuv.dll "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.divxa32"= DivXa32.acm "vidc.CDVC"= cdvccodc.dll "vidc.dvsd"= mcdvd_32.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk backup=C:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent] --a------ 2004-08-05 15:00 110592 C:\WINDOWS\system32\bthprops.cpl [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2005-02-17 00:11 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail] --a------ 2006-10-18 13:31 204843 C:\PROGRA~1\INCRED~1\bin\IncMail.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2007-11-02 19:36 267048 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] -ra------ 2001-07-09 12:50 155648 C:\windows\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService] --a------ 2004-10-08 04:14 81920 c:\Apps\Powercinema\PCMService.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2005-12-24 18:49 180269 C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2007-10-10 07:28 36352 C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YeppStudioAgent] C:\Program Files\Samsung\SamsungMediaStudio4.1\SamsungMediaStudioAgent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "AOL ACS"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%ProgramFiles%\\AOL 9.0\\aol.exe"= "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"= "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\APPS\\Inventime\\my.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"= "C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"= "C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= R1 vcsmpdrv;vcsmpdrv;C:\windows\system32\DRIVERS\vcsmpdrv.sys [2003-06-16 17:07] R2 Vcs;Vcs support;C:\WINDOWS\system32\Drivers\Vcs.sys [2002-12-10 10:11] R2 VCSSecS;Virtual CD v4 Security service (SDK - Version);C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe [2002-05-16 12:17] R3 USBSTOR;Pilote de stockage de masse USB;C:\windows\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08] S3 ids00026;ids00026;C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00026.sys [] S3 memsysdrv;Memory System;C:\WINDOWS\system32\drivers\memsysdrv.sys [2005-08-20 13:53] S3 usbscan;Pilote de scanneur USB;C:\windows\system32\DRIVERS\usbscan.sys [2004-08-03 23:58] . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2008-04-26 15:29:11 C:\windows\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-05-01 10:00:05 C:\windows\Tasks\HPpromotions journeysoftware.job" - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-01 12:46:44 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 1385 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\MysqlInventime] "ImagePath"="c:\mysql\bin\mysqld-nt MysqlInventime" . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe C:\WINDOWS\system32\HPZipm12.exe C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe C:\Program Files\Fichiers communs\Symantec Shared\Security Center\symwsc.exe C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe C:\PROGRA~1\TRENDM~1\INTERN~1\pccguide.exe C:\APPS\ABOARD\AOSD.EXE C:\WINDOWS\system32\rundll32.exe C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe C:\Program Files\Logitech\Video\FxSvr2.exe . ************************************************************************** . Temps d'accomplissement: 2008-05-01 13:06:41 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-01 11:06:17 ComboFix2.txt 2008-05-01 10:18:35 ComboFix3.txt 2008-04-29 16:59:34 ComboFix4.txt 2008-04-27 09:50:14 Pre-Run: 108,612,726,784 octets libres Post-Run: 108,647,309,312 octets libres 210 --- E O F --- 2008-04-08 21:07:55 Voili voilou en attendant l'analyse complète de Kaspersky. J'ai pas tout compris sur la console de récupération excuses moi. Mais dans quels cas devrais je lancer la console lors du démarrage ? J'espère que jvous embêterez plus pour très longtemps. Mais c'est fou comment des virus à la noix peuvent vous pourir un pc voire la vie Pour une personne comme moi qui ne fait qu'une utilisation basique de son pc grâce à vous et à ce formidable forum je suis un peu moins blonde ! Même si j'avoue que j'ai pas vraiment à réfléchir car je suis à la lettre vos instructions. Bon j'arrête ici le racontage de ma Blondy's life Je vous souhaite à tous un bon 1er mai

Et voici l'analyse dudit fichier, apparemment il est infesté par aucun virus : Antivirus Version Dernière mise à jour Résultat AhnLab-V3 2008.4.30.0 2008.04.29 - AntiVir 7.8.0.10 2008.04.29 - Authentium 4.93.8 2008.04.27 - Avast 4.8.1169.0 2008.04.29 - AVG 7.5.0.516 2008.04.29 - BitDefender 7.2 2008.04.29 - CAT-QuickHeal 9.50 2008.04.29 - ClamAV 0.92.1 2008.04.29 - DrWeb 4.44.0.09170 2008.04.29 - eSafe 7.0.15.0 2008.04.28 - eTrust-Vet 31.3.5744 2008.04.29 - Ewido 4.0 2008.04.29 - F-Prot 4.4.2.54 2008.04.28 - F-Secure 6.70.13260.0 2008.04.29 - FileAdvisor 1 2008.04.29 - Fortinet 3.14.0.0 2008.04.29 - Ikarus T3.1.1.26.0 2008.04.29 - Kaspersky 7.0.0.125 2008.04.29 - McAfee 5284 2008.04.29 - Microsoft 1.3408 2008.04.22 - NOD32v2 3063 2008.04.29 - Norman 5.80.02 2008.04.29 - Panda 9.0.0.4 2008.04.29 - Prevx1 V2 2008.04.29 - Rising 20.42.12.00 2008.04.29 - Sophos 4.28.0 2008.04.29 - Sunbelt 3.0.1056.0 2008.04.17 - Symantec 10 2008.04.29 - TheHacker 6.2.92.297 2008.04.29 - VBA32 3.12.6.5 2008.04.29 - VirusBuster 4.3.26:9 2008.04.29 - Webwasher-Gateway 6.6.2 2008.04.29 - Information additionnelle File size: 56 bytes MD5...: 4b2454871317dc3ffcb2543b0585d559 SHA1..: 350ce7416f73262812f5aa0f152da9bf6e788f34 SHA256: 334a69047121108ae7b263239863f719d13158bff455dd5bac07de36f83f745c SHA512: 10f6b73418601b8d2d1ff4f8ff8daa4af70f81c14ac234c758f64f846a1e81a8 1f4769190f46e3dd989d1d6ff0ff219f5de3528466834d6724dffca2622e8e42 PEiD..: - PEInfo: - Jle dirais jamais assez mais je vous remercie de prendre de votre temps pour m'aider. Bonne soirée Amicalement votre Ladysun

Bonjour, Voici le premier rapport : ComboFix 08-04-24.1 - Sophie 2008-04-29 18:35:12.2 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.627 [GMT 2:00] Endroit: C:\Documents and Settings\Sophie\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Sophie\Bureau\CFScript.txt * Création d'un nouveau point de restauration AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !! FILE :: C:\WINDOWS\system32\usmt :#: . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\DOCUME~1\Sophie\Bureau\SDFix C:\DOCUME~1\Sophie\Bureau\SDFix\apps\assosfix.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\cliptext.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\download.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\dummy.sys C:\DOCUME~1\Sophie\Bureau\SDFix\apps\Enable_Command_Prompt.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\ERDNT.E_E C:\DOCUME~1\Sophie\Bureau\SDFix\apps\ERDNTDOS.LOC C:\DOCUME~1\Sophie\Bureau\SDFix\apps\ERDNTWIN.LOC C:\DOCUME~1\Sophie\Bureau\SDFix\apps\ERUNT.EXE C:\DOCUME~1\Sophie\Bureau\SDFix\apps\ERUNT.LOC C:\DOCUME~1\Sophie\Bureau\SDFix\apps\fix.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\FixBH.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\FixComponents.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\FIXCU.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\FIXLM.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\FixPath.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\FixRedir.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\FixSchedule.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\FixWebCheck.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\fixXP.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\FixXPsp2.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\grep.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\HPFix.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\HPFix2.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\HPFix3.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\HPFix4.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\HPFix5.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\HPFix6.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\HPFix7.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\isadmin.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\leg2.txt C:\DOCUME~1\Sophie\Bureau\SDFix\apps\legacy.txt C:\DOCUME~1\Sophie\Bureau\SDFix\apps\legacybk.txt C:\DOCUME~1\Sophie\Bureau\SDFix\apps\locate.com C:\DOCUME~1\Sophie\Bureau\SDFix\apps\LS.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\MD5File.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\MyGcpvFix.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\MyGkFix2.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\Process.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\procs.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\psservice.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\Rem.txt C:\DOCUME~1\Sophie\Bureau\SDFix\apps\Rem2.txt C:\DOCUME~1\Sophie\Bureau\SDFix\apps\Replace\regedit.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\Replace\W2K.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\Replace\w2k\beep.sys C:\DOCUME~1\Sophie\Bureau\SDFix\apps\Replace\w2k\null.sys C:\DOCUME~1\Sophie\Bureau\SDFix\apps\Replace\XP.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\Replace\xp\beep.sys C:\DOCUME~1\Sophie\Bureau\SDFix\apps\Replace\xp\null.sys C:\DOCUME~1\Sophie\Bureau\SDFix\apps\Reset_AppInit_DLLs.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\RestartIt!.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\Restore_SecurityCenter.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\Restore_SharedAccess.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\sc.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\sed.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\SF.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\shutdown.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\srv2.txt C:\DOCUME~1\Sophie\Bureau\SDFix\apps\srv2bk.txt C:\DOCUME~1\Sophie\Bureau\SDFix\apps\svc.txt C:\DOCUME~1\Sophie\Bureau\SDFix\apps\svcbk.txt C:\DOCUME~1\Sophie\Bureau\SDFix\apps\swreg.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\swsc.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\unzip.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\vfind.exe C:\DOCUME~1\Sophie\Bureau\SDFix\apps\WINMSG.EXE C:\DOCUME~1\Sophie\Bureau\SDFix\apps\winsec.reg C:\DOCUME~1\Sophie\Bureau\SDFix\apps\zip.exe C:\DOCUME~1\Sophie\Bureau\SDFix\backups\backupreg.zip C:\DOCUME~1\Sophie\Bureau\SDFix\backups\backups.zip C:\DOCUME~1\Sophie\Bureau\SDFix\backups\HOSTS C:\DOCUME~1\Sophie\Bureau\SDFix\catchme.exe C:\DOCUME~1\Sophie\Bureau\SDFix\dummy.sys C:\DOCUME~1\Sophie\Bureau\SDFix\Report.txt C:\DOCUME~1\Sophie\Bureau\SDFix\RunThis.bat C:\DOCUME~1\Sophie\Bureau\SDFix\SDFIX_ReadMe_Online.url C:\Documents and Settings\Sophie\Bureau\BTFix C:\Documents and Settings\Sophie\Bureau\BTFix\BTFix.exe C:\Documents and Settings\Sophie\Bureau\BTFix\BTFix.txt C:\Documents and Settings\Sophie\Bureau\BTFix\LISEZMOI.TXT C:\Documents and Settings\Sophie\Bureau\BTFix\Restart.txt C:\Program Files\Inet_Get_2 . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-03-28 to 2008-04-29 )))))))))))))))))))))))))))))))))))) . 2008-04-24 13:26 . 2008-04-24 13:26 <REP> d-------- C:\WINDOWS\ERUNT 2008-04-24 13:11 . 2008-04-24 13:11 244 --ah----- C:\sqmnoopt07.sqm 2008-04-24 13:11 . 2008-04-24 13:11 232 --ah----- C:\sqmdata07.sqm 2008-04-22 17:35 . 2008-04-22 17:35 244 --ah----- C:\sqmnoopt06.sqm 2008-04-22 17:35 . 2008-04-22 17:35 232 --ah----- C:\sqmdata06.sqm 2008-04-22 17:10 . 2008-04-22 17:10 244 --ah----- C:\sqmnoopt05.sqm 2008-04-22 17:10 . 2008-04-22 17:10 232 --ah----- C:\sqmdata05.sqm 2008-04-21 18:15 . 2008-04-21 18:15 244 --ah----- C:\sqmnoopt04.sqm 2008-04-21 18:15 . 2008-04-21 18:15 232 --ah----- C:\sqmdata04.sqm 2008-04-17 23:15 . 2008-04-17 23:15 8,272 --a------ C:\WINDOWS\system32\efbrdv.exe 2008-04-17 23:15 . 2008-04-17 23:15 244 --ah----- C:\sqmnoopt03.sqm 2008-04-17 23:15 . 2008-04-17 23:15 232 --ah----- C:\sqmdata03.sqm 2008-04-17 15:49 . 2008-04-17 15:49 244 --ah----- C:\sqmnoopt02.sqm 2008-04-17 15:49 . 2008-04-17 15:49 232 --ah----- C:\sqmdata02.sqm 2008-04-16 22:07 . 2008-04-16 22:07 8,272 --a------ C:\WINDOWS\system32\miierc.exe 2008-04-16 22:07 . 2008-04-16 22:07 244 --ah----- C:\sqmnoopt01.sqm 2008-04-16 22:07 . 2008-04-16 22:07 232 --ah----- C:\sqmdata01.sqm 2008-04-14 21:40 . 2008-04-14 21:40 9,296 --a------ C:\WINDOWS\system32\bntpme.exe 2008-04-14 19:34 . 2008-04-14 19:34 9,296 --a------ C:\WINDOWS\system32\kewgwh.exe 2008-04-14 19:34 . 2008-04-14 19:34 244 --ah----- C:\sqmnoopt00.sqm 2008-04-14 19:34 . 2008-04-14 19:34 232 --ah----- C:\sqmdata00.sqm . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-25 17:46 --------- d-----w C:\Program Files\Microsoft ActiveSync 2008-04-14 16:35 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-13 14:59 --------- d-----w C:\Program Files\PixDiscount 2008-04-07 17:22 --------- d-----w C:\Program Files\Téléchargement PHOTOWAYS 2008-04-02 10:37 --------- d-----w C:\Program Files\Java 2008-03-31 10:45 --------- d-----w C:\Program Files\Messenger Plus! Live 2008-03-30 17:07 36,368 ----a-w C:\windows\system32\drivers\tmpreflt.sys 2008-03-30 17:07 204,816 ----a-w C:\windows\system32\drivers\tmxpflt.sys 2008-03-30 16:50 1,169,240 ----a-w C:\windows\system32\drivers\VsapiNT.sys 2007-09-23 13:20 48,856 ----a-w C:\Documents and Settings\Sophie\Application Data\GDIPFONTCACHEV1.DAT 2005-06-06 15:32 284 -c--a-w C:\Documents and Settings\Sophie\Application Data\ViewerApp.dat 2005-05-02 12:12 56 --sh--r C:\windows\system32\006FA882FA.sys 2005-05-02 12:12 1,682 -csha-w C:\windows\system32\KGyGaAvL.sys . <pre> ----a-w 238,401 2006-07-06 13:42:50 C:\Logiciels\vista\Transparency Donnez à vos fenêtres un petit air de Vista en .exe </pre> ((((((((((((((((((((((((((((( snapshot@2008-04-27_11.49.28,06 ))))))))))))))))))))))))))))))))))))))))) . - 2008-04-27 09:26:32 2,048 --s-a-w C:\windows\bootstat.dat + 2008-04-29 16:38:42 2,048 --s-a-w C:\windows\bootstat.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ares"="C:\Program Files\Ares\Ares.exe" [ ] "ctfmon.exe"="C:\windows\system32\ctfmon.exe" [2004-08-05 15:00 15360] "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-10-08 12:06 196608] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208] "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 15:00 208952] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 15:00 455168] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 15:00 455168] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-07-12 17:50 4112384] "nwiz"="nwiz.exe" [2004-07-12 17:50 843776 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-07-12 17:50 81920] "ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 11:31 24576] "VCSPlayer"="C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe" [2004-03-04 15:08 299008] "CleanEasyImg"="c:\apps\easydvd\cleanall.exe" [ ] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 11:52 221184] "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-10-08 12:31 458752] "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-10-08 12:24 217088] "pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" [2004-10-27 11:05 823361] "MySight 2006 BS Check&Random"="C:\Program Files\MySight 2006\quickbs.exe" [2006-11-11 19:37 409088] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 21:16 286720] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15:00 15360] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.HFYU"= huffyuv.dll "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.divxa32"= DivXa32.acm "vidc.CDVC"= cdvccodc.dll "vidc.dvsd"= mcdvd_32.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk backup=C:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent] --a------ 2004-08-05 15:00 110592 C:\WINDOWS\system32\bthprops.cpl [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2005-02-17 00:11 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail] --a------ 2006-10-18 13:31 204843 C:\PROGRA~1\INCRED~1\bin\IncMail.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2007-11-02 19:36 267048 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] -ra------ 2001-07-09 12:50 155648 C:\windows\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService] --a------ 2004-10-08 04:14 81920 c:\Apps\Powercinema\PCMService.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2005-12-24 18:49 180269 C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2007-10-10 07:28 36352 C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YeppStudioAgent] C:\Program Files\Samsung\SamsungMediaStudio4.1\SamsungMediaStudioAgent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "AOL ACS"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%ProgramFiles%\\AOL 9.0\\aol.exe"= "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"= "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\APPS\\Inventime\\my.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"= "C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"= "C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= R1 vcsmpdrv;vcsmpdrv;C:\windows\system32\DRIVERS\vcsmpdrv.sys [2003-06-16 17:07] R2 Vcs;Vcs support;C:\WINDOWS\system32\Drivers\Vcs.sys [2002-12-10 10:11] R2 VCSSecS;Virtual CD v4 Security service (SDK - Version);C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe [2002-05-16 12:17] R3 USBSTOR;Pilote de stockage de masse USB;C:\windows\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08] S3 ids00026;ids00026;C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00026.sys [] S3 memsysdrv;Memory System;C:\WINDOWS\system32\drivers\memsysdrv.sys [2005-08-20 13:53] S3 usbscan;Pilote de scanneur USB;C:\windows\system32\DRIVERS\usbscan.sys [2004-08-03 23:58] . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2008-04-26 15:29:11 C:\windows\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-04-29 14:00:05 C:\windows\Tasks\HPpromotions journeysoftware.job" - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-29 18:39:31 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 1385 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\MysqlInventime] "ImagePath"="c:\mysql\bin\mysqld-nt MysqlInventime" . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe C:\WINDOWS\system32\HPZipm12.exe C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe C:\Program Files\Fichiers communs\Symantec Shared\Security Center\symwsc.exe C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe C:\PROGRA~1\TRENDM~1\INTERN~1\pccguide.exe C:\APPS\ABOARD\AOSD.EXE C:\WINDOWS\system32\rundll32.exe C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe C:\Program Files\Logitech\Video\FxSvr2.exe . ************************************************************************** . Temps d'accomplissement: 2008-04-29 18:59:32 - machine was rebooted ComboFix-quarantined-files.txt 2008-04-29 16:59:10 ComboFix2.txt 2008-04-27 09:50:14 Pre-Run: 108,746,211,328 octets libres Post-Run: 108,768,350,208 octets libres 283 --- E O F --- 2008-04-08 21:07:55

Et voici le rapport de Combofix : ComboFix 08-04-24.1 - Sophie 2008-04-27 11:45:22.1 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.481 [GMT 2:00] Endroit: C:\Documents and Settings\Sophie\Bureau\ComboFix.exe * Création d'un nouveau point de restauration AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !! . ADS - svchost.exe: deleted 68 bytes in 1 streams. (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Sophie\Local Settings\Temporary Internet Files\bestwiner.stt . ((((((((((((((((((((((((((((( Fichiers créés 2008-03-27 to 2008-04-27 )))))))))))))))))))))))))))))))))))) . 2008-04-24 13:26 . 2008-04-24 13:26 <REP> d-------- C:\WINDOWS\ERUNT 2008-04-24 13:11 . 2008-04-24 13:11 244 --ah----- C:\sqmnoopt07.sqm 2008-04-24 13:11 . 2008-04-24 13:11 232 --ah----- C:\sqmdata07.sqm 2008-04-22 17:35 . 2008-04-22 17:35 244 --ah----- C:\sqmnoopt06.sqm 2008-04-22 17:35 . 2008-04-22 17:35 232 --ah----- C:\sqmdata06.sqm 2008-04-22 17:10 . 2008-04-22 17:10 244 --ah----- C:\sqmnoopt05.sqm 2008-04-22 17:10 . 2008-04-22 17:10 232 --ah----- C:\sqmdata05.sqm 2008-04-21 18:15 . 2008-04-21 18:15 244 --ah----- C:\sqmnoopt04.sqm 2008-04-21 18:15 . 2008-04-21 18:15 232 --ah----- C:\sqmdata04.sqm 2008-04-17 23:15 . 2008-04-17 23:15 8,272 --a------ C:\WINDOWS\system32\efbrdv.exe 2008-04-17 23:15 . 2008-04-17 23:15 244 --ah----- C:\sqmnoopt03.sqm 2008-04-17 23:15 . 2008-04-17 23:15 232 --ah----- C:\sqmdata03.sqm 2008-04-17 20:55 . 2008-04-17 20:58 <REP> d-------- C:\Program Files\Inet_Get_2 2008-04-17 15:49 . 2008-04-17 15:49 244 --ah----- C:\sqmnoopt02.sqm 2008-04-17 15:49 . 2008-04-17 15:49 232 --ah----- C:\sqmdata02.sqm 2008-04-16 22:07 . 2008-04-16 22:07 8,272 --a------ C:\WINDOWS\system32\miierc.exe 2008-04-16 22:07 . 2008-04-16 22:07 244 --ah----- C:\sqmnoopt01.sqm 2008-04-16 22:07 . 2008-04-16 22:07 232 --ah----- C:\sqmdata01.sqm 2008-04-14 21:40 . 2008-04-14 21:40 9,296 --a------ C:\WINDOWS\system32\bntpme.exe 2008-04-14 19:34 . 2008-04-14 19:34 9,296 --a------ C:\WINDOWS\system32\kewgwh.exe 2008-04-14 19:34 . 2008-04-14 19:34 244 --ah----- C:\sqmnoopt00.sqm 2008-04-14 19:34 . 2008-04-14 19:34 232 --ah----- C:\sqmdata00.sqm . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-25 17:46 --------- d-----w C:\Program Files\Microsoft ActiveSync 2008-04-14 16:35 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-13 14:59 --------- d-----w C:\Program Files\PixDiscount 2008-04-07 17:22 --------- d-----w C:\Program Files\Téléchargement PHOTOWAYS 2008-04-02 10:37 --------- d-----w C:\Program Files\Java 2008-03-31 10:45 --------- d-----w C:\Program Files\Messenger Plus! Live 2008-03-20 08:09 1,845,376 ----a-w C:\windows\system32\win32k.sys 2008-03-20 08:09 1,845,376 ------w C:\windows\system32\dllcache\win32k.sys 2008-03-01 16:28 3,591,680 ----a-w C:\windows\system32\dllcache\mshtml.dll 2008-02-29 08:57 625,664 ----a-w C:\windows\system32\dllcache\iexplore.exe 2008-02-29 08:56 70,656 ------w C:\windows\system32\dllcache\ie4uinit.exe 2008-02-22 10:00 13,824 ------w C:\windows\system32\dllcache\ieudinit.exe 2008-02-20 06:51 282,624 ----a-w C:\windows\system32\gdi32.dll 2008-02-20 06:51 282,624 ------w C:\windows\system32\dllcache\gdi32.dll 2008-02-20 05:35 45,568 ----a-w C:\windows\system32\dnsrslvr.dll 2008-02-20 05:35 45,568 ------w C:\windows\system32\dllcache\dnsrslvr.dll 2008-02-20 05:35 148,992 ------w C:\windows\system32\dllcache\dnsapi.dll 2008-02-15 05:44 161,792 ------w C:\windows\system32\dllcache\ieakui.dll 2007-09-23 13:20 48,856 ----a-w C:\Documents and Settings\Sophie\Application Data\GDIPFONTCACHEV1.DAT 2005-06-06 15:32 284 -c--a-w C:\Documents and Settings\Sophie\Application Data\ViewerApp.dat 2005-05-02 12:12 56 --sh--r C:\windows\system32\006FA882FA.sys 2005-05-02 12:12 1,682 -csha-w C:\windows\system32\KGyGaAvL.sys . <pre> ----a-w 238,401 2006-07-06 13:42:50 C:\Logiciels\vista\Transparency Donnez à vos fenêtres un petit air de Vista en .exe </pre> ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DFF8F707-940F-D11F-C413-BE6B54588758}] C:\DOCUME~1\Sophie\APPLIC~1\ONEFRA~1\Ping Barb.exe [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ares"="C:\Program Files\Ares\Ares.exe" [ ] "ctfmon.exe"="C:\windows\system32\ctfmon.exe" [2004-08-05 15:00 15360] "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-10-08 12:06 196608] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208] "Bin Cdrom"="C:\DOCUME~1\Sophie\APPLIC~1\BOLTBA~1\Size Heart Sign.exe" [ ] "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 15:00 208952] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 15:00 455168] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 15:00 455168] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-07-12 17:50 4112384] "nwiz"="nwiz.exe" [2004-07-12 17:50 843776 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-07-12 17:50 81920] "ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 11:31 24576] "VCSPlayer"="C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe" [2004-03-04 15:08 299008] "CleanEasyImg"="c:\apps\easydvd\cleanall.exe" [ ] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 11:52 221184] "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-10-08 12:31 458752] "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-10-08 12:24 217088] "pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" [2004-10-27 11:05 823361] "MySight 2006 BS Check&Random"="C:\Program Files\MySight 2006\quickbs.exe" [2006-11-11 19:37 409088] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 21:16 286720] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15:00 15360] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ OFFICE One Clock v6.5.lnk - C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe [2006-04-09 00:47:23 257536] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.HFYU"= huffyuv.dll "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.divxa32"= DivXa32.acm "vidc.CDVC"= cdvccodc.dll "vidc.dvsd"= mcdvd_32.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk backup=C:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent] --a------ 2004-08-05 15:00 110592 C:\WINDOWS\system32\bthprops.cpl [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2005-02-17 00:11 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail] --a------ 2006-10-18 13:31 204843 C:\PROGRA~1\INCRED~1\bin\IncMail.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2007-11-02 19:36 267048 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] -ra------ 2001-07-09 12:50 155648 C:\windows\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService] --a------ 2004-10-08 04:14 81920 c:\Apps\Powercinema\PCMService.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runner1] C:\windows\mrofinu1423.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2005-12-24 18:49 180269 C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Twain] C:\Program Files\Twain\Twain.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2007-10-10 07:28 36352 C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YeppStudioAgent] C:\Program Files\Samsung\SamsungMediaStudio4.1\SamsungMediaStudioAgent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "AOL ACS"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%ProgramFiles%\\AOL 9.0\\aol.exe"= "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"= "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\APPS\\Inventime\\my.exe"= "C:\\WINDOWS\\system32\\usmt\\migwiz.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"= "C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"= "C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= R1 vcsmpdrv;vcsmpdrv;C:\windows\system32\DRIVERS\vcsmpdrv.sys [2003-06-16 17:07] R2 Vcs;Vcs support;C:\WINDOWS\system32\Drivers\Vcs.sys [2002-12-10 10:11] R2 VCSSecS;Virtual CD v4 Security service (SDK - Version);C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe [2002-05-16 12:17] R3 USBSTOR;Pilote de stockage de masse USB;C:\windows\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08] S3 ids00026;ids00026;C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00026.sys [] S3 memsysdrv;Memory System;C:\WINDOWS\system32\drivers\memsysdrv.sys [2005-08-20 13:53] S3 usbscan;Pilote de scanneur USB;C:\windows\system32\DRIVERS\usbscan.sys [2004-08-03 23:58] . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2008-04-26 15:29:11 C:\windows\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-04-26 18:00:06 C:\windows\Tasks\HPpromotions journeysoftware.job" - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-27 11:47:55 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet002\Services\MysqlInventime] "ImagePath"="c:\mysql\bin\mysqld-nt MysqlInventime" . Temps d'accomplissement: 2008-04-27 11:50:12 ComboFix-quarantined-files.txt 2008-04-27 09:49:53 Pre-Run: 109,026,230,272 octets libres Post-Run: 109,091,672,064 octets libres 191 --- E O F --- 2008-04-08 21:07:55

Bonjour, Voici mon rapport BTFix après nettoyage en mode sans échec : BTFix 1.098 (par bibi26) - 27/04/2008 11:24:26 - Nettoyage - Mode sans échec Lancé depuis C:\Documents and Settings\Sophie\Bureau\BTFix\BTFix.exe ---> Fichiers/dossiers supprimés (Première passe) - Fichiers temporaires effacés ---> Nettoyage terminé le 27/04/2008 11:24:30 Mon nouveau log Hijackthis : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:38:17, on 27/04/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\windows\System32\smss.exe C:\windows\system32\winlogon.exe C:\windows\system32\services.exe C:\windows\system32\lsass.exe C:\windows\system32\svchost.exe C:\windows\System32\svchost.exe C:\windows\system32\svchost.exe C:\windows\system32\spoolsv.exe C:\windows\Explorer.EXE C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe C:\windows\system32\nvsvc32.exe C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe C:\WINDOWS\system32\HPZipm12.exe C:\windows\system32\slserv.exe C:\windows\system32\svchost.exe C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe C:\apps\ABoard\ABoard.exe C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe C:\apps\ABoard\AOSD.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\windows\system32\rundll32.exe C:\windows\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\DOCUME~1\Sophie\LOCALS~1\Temp\Rar$EX01.672\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: {1A03F196-9617-4CA0-842B-A83CEECB022B} - - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {DFF8F707-940F-D11F-C413-BE6B54588758} - C:\DOCUME~1\Sophie\APPLIC~1\ONEFRA~1\Ping Barb.exe (file missing) O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe" O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" O4 - HKLM\..\Run: [MySight 2006 BS Check&Random] C:\Program Files\MySight 2006\quickbs.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [bin Cdrom] C:\DOCUME~1\Sophie\APPLIC~1\BOLTBA~1\Size Heart Sign.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: OFFICE One Clock v6.5.lnk = C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppD...ap/PhtPkMSN.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SmartLinkService (SLService) - - C:\windows\SYSTEM32\slserv.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe -- End of file - 8994 bytes Voili voilou alors Docteur c'est grave ?

Bonsoir, Voici mon analyse BTfix après nettoyage BTFix 1.098 (par bibi26) - 24/04/2008 20:16:55 - Nettoyage - Mode normal Lancé depuis C:\Documents and Settings\Sophie\Bureau\BTFix\BTFix.exe ---> Fichiers/dossiers supprimés (Première passe) - Fichiers temporaires effacés - C:\Program Files\MyWebSearch\bar\History\ - C:\Program Files\MyWebSearch\bar\Settings\ - C:\Program Files\MyWebSearch\bar\ - C:\Program Files\MyWebSearch\ ---> Nettoyage terminé le 24/04/2008 20:17:02 Encore une question de blonde et après une rude journée de boulot j'ai plus vraiment les yeux en face des trous Mais lorsque je met mon ordi en mode sans échec je fais l'analyse avec mon propre antivirus ? Bon week end Apollo