elotane

Bonsoir Angélique, Je trouve votre post plutot hard : Tu arretes de creer des nouveaux sujets , le helper ne va pas s'y retrouver !!! Utilise l'onglet "repondre" en bas de la derniere réponse de ton sujet d'origine là: http://forum.zebulon.fr/trojans-impossible...er-t148233.html closed! Je n'ai créer qu'un nouveau sujet !Et j'explique pourquoi à la fin de mon post. Ne sachant pas si je devais créer ou pas un nouveau post pour donner mes réponses, dans le doute j'ai créer un nouveau post. Je vous prie d'accepter mes excuses pour mon manque de connaissances sur les pratiques de votre forum Loin de moi l'idée d'embrouiller le helper, puisque je suis sur votre forum pour demander de l'aide.

Bonjour à tous, Suite à mon post "Trojans impossible à supprimer, Trojan.StartPage.fz et Trojan.StartPage.ig", j'ai donc suivi les conseils. Vous trouverez ci dessous les différents rapports : Voici le rapport d'antivir : Avira AntiVir Personal Report file date: mercredi 23 juillet 2008 13:01 Scanning for 1492302 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 3) [5.1.2600] Boot mode: Save mode Username: Mme SCANZY Computer name: M-AB2AB9FO78954 Version information: BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00 AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:58 AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:38 LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:24 LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:42 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34 ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 10:20:22 ANTIVIR2.VDF : 7.0.5.144 1690624 Bytes 21/07/2008 10:21:08 ANTIVIR3.VDF : 7.0.5.155 108032 Bytes 23/07/2008 10:21:14 Engineversion : 8.1.1.11 AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:22 AESCRIPT.DLL : 8.1.0.59 307579 Bytes 23/07/2008 10:22:18 AESCN.DLL : 8.1.0.23 119156 Bytes 23/07/2008 10:22:14 AERDL.DLL : 8.1.0.20 418165 Bytes 23/07/2008 10:22:10 AEPACK.DLL : 8.1.2.1 364917 Bytes 23/07/2008 10:22:04 AEOFFICE.DLL : 8.1.0.21 192891 Bytes 23/07/2008 10:21:58 AEHEUR.DLL : 8.1.0.43 1339767 Bytes 23/07/2008 10:21:52 AEHELP.DLL : 8.1.0.15 115063 Bytes 23/07/2008 10:21:34 AEGEN.DLL : 8.1.0.29 307573 Bytes 23/07/2008 10:21:28 AEEMU.DLL : 8.1.0.6 430451 Bytes 23/07/2008 10:21:24 AECORE.DLL : 8.1.1.6 172405 Bytes 23/07/2008 10:21:20 AEBB.DLL : 8.1.0.1 53617 Bytes 23/07/2008 10:21:16 AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:54 AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:52 AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:26:48 AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:50 AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:24 AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:32 SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:04 SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:40 NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:12 RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:26 RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:12 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: repair Secondary action.................: delete Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: on Scan all files...................: All files Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: mercredi 23 juillet 2008 13:01 Starting search for hidden objects. The driver could not be initialized. The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'Explorer.EXE' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 11 processes with 11 modules were scanned Starting master boot sector scan: Master boot sector HD0 [iNFO] No virus was found! Master boot sector HD1 [iNFO] No virus was found! [WARNING] Le périphérique n'est pas prêt. Master boot sector HD2 [iNFO] No virus was found! [WARNING] Le périphérique n'est pas prêt. Master boot sector HD3 [iNFO] No virus was found! [WARNING] Le périphérique n'est pas prêt. Master boot sector HD4 [iNFO] No virus was found! [WARNING] Le périphérique n'est pas prêt. Master boot sector HD5 [iNFO] No virus was found! [WARNING] Le périphérique n'est pas prêt. Start scanning boot sectors: Boot sector 'C:\' [iNFO] No virus was found! Starting to scan the registry. The registry was scanned ( '37' files ). Starting the file scan: Begin scan in 'C:\' <ACER> C:\pagefile.sys [WARNING] The file could not be opened! C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4EDE77A3.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4EDE77A3.exe [DETECTION] Contains detection pattern of the dropper DR/CASClient.M [NOTE] A backup was created as '48cb1646.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4EEF4991.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4EEF4991.exe [DETECTION] Contains detection pattern of the dropper DR/CASClient.M [NOTE] A backup was created as '48cc1647.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4EFC7183.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4EFC7183.exe [DETECTION] Contains detection pattern of the dropper DR/Cmapp.A.1 [NOTE] A backup was created as '48cd1647.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1B9D206D.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1B9D206D.exe [DETECTION] Contains detection pattern of the dropper DR/Cmapp.A.1 [NOTE] A backup was created as '48c01644.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Documents and Settings\acer\Mes documents\Manon\Mes documents\Logiciels\Divine Intervention III\DIVHIST.DOC [DETECTION] Contains detection pattern of the Windows virus W32/ThrBack-Silly.4 [NOTE] A backup was created as '48dd19ee.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Documents and Settings\acer\Mes documents\Downloads\Compressed\divint3.zip [0] Archive type: ZIP --> DIVHIST.DOC [DETECTION] Contains detection pattern of the Windows virus W32/ThrBack-Silly.4 [NOTE] A backup was created as '48fd1d4d.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Documents and Settings\acer\Mes documents\Downloads\Compressed\divint3\DIVHIST.DOC [DETECTION] Contains detection pattern of the Windows virus W32/ThrBack-Silly.4 [NOTE] A backup was created as '48dd1d2d.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy\Recovery\Yazzle.zip [DETECTION] Contains suspicious code GEN/PwdZIP [NOTE] The fund was classified as suspicious. [NOTE] A backup was created as '49011ec4.qua' ( QUARANTINE ) C:\Documents and Settings\Mme SCANZY\Mes documents\Elodie\programmes telec\adobePhotoshopCS2-fr.zip [0] Archive type: ZIP --> Adobe Photoshop CS2 fr/keygen.exe [DETECTION] Contains detection pattern of the worm WORM/Autorun.cxl [WARNING] The file could not be copied to the quarantine directory. [WARNING] [NOTE] The file was deleted! C:\Documents and Settings\Mme SCANZY\Mes documents\Elodie\programmes telec\mes drivers\77.72_win2kxp_international_whql.exe [WARNING] No further files can be extracted from this archive. The archive will be closed C:\Documents and Settings\Mme SCANZY\Mes documents\Elodie\programmes telec\adobePhotoshopCS2-fr\Adobe Photoshop CS2 fr\keygen.exe [DETECTION] Contains detection pattern of the worm WORM/Autorun.cxl [NOTE] A backup was created as '490028f7.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Program Files\AskSBar\bar\2.bin\A2PLUGIN.DLL [DETECTION] Contains detection pattern of a probably damaged sample CC/Agent.CS [NOTE] A backup was created as '48d73578.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043301.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043301.exe [DETECTION] Contains detection pattern of the dropper DR/CASClient.M [NOTE] A backup was created as '48b73b8c.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043302.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043302.exe [DETECTION] Contains detection pattern of the dropper DR/CASClient.M [NOTE] A backup was created as '48b73b8d.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043303.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043303.exe [DETECTION] Contains detection pattern of the dropper DR/Cmapp.A.1 [NOTE] A backup was created as '4915cba6.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043304.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043304.exe [DETECTION] Contains detection pattern of the dropper DR/Cmapp.A.1 [NOTE] A backup was created as '48b73b8f.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043305.DLL [DETECTION] Contains detection pattern of a probably damaged sample CC/Agent.CS [NOTE] A backup was created as '48b73b8e.qua' ( QUARANTINE ) [NOTE] The file was deleted! End of the scan: mercredi 23 juillet 2008 16:12 Used time: 3:11:12 min The scan has been done completely. 13656 Scanning directories 874629 Files were scanned 15 viruses and/or unwanted programs were found 1 Files were classified as suspicious: 15 files were deleted 0 files were repaired 15 files were moved to quarantine 0 files were renamed 2 Files cannot be scanned 874614 Files not concerned 12285 Archives were scanned 8 Warnings 16 Notes Voici le rapport de MBAM : Malwarebytes' Anti-Malware 1.22 Version de la base de données: 984 Windows 5.1.2600 Service Pack 3 07:12:36 24/07/2008 mbam-log-7-24-2008 (07-12-36).txt Type de recherche: Examen complet (C:\|) Eléments examinés: 223597 Temps écoulé: 5 hour(s), 22 minute(s), 40 second(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 0 Clé(s) du Registre infectée(s): 0 Valeur(s) du Registre infectée(s): 0 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 1 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): (Aucun élément nuisible détecté) Clé(s) du Registre infectée(s): (Aucun élément nuisible détecté) Valeur(s) du Registre infectée(s): (Aucun élément nuisible détecté) Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP324\A0036822.dll (Adware.Shopper) -> Quarantined and deleted successfully. Et pour finir Voici le rapport Hijackthis : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 07:52:07, on 24/07/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RunDll32.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Babylon\Babylon-Pro\Babylon.exe C:\Program Files\ONSPEED\onspeedcore.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\ONSPEED\onspeedgui.exe C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Raxco\PerfectDisk\PDSched.exe C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\DAP\DAP.EXE C:\WINDOWS\system32\drwtsn32.exe C:\WINDOWS\system32\drwtsn32.exe C:\Documents and Settings\Mme SCANZY\Mes documents\Elodie\programmes telec\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://192.168.1.1/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5405 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing) O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\ONSPEED\PBHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: NOW!Imaging - {9AA2F14F-E956-44B8-8694-A5B615CDF341} - C:\Program Files\ONSPEED\components\NOWImaging.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: ONSPEED - {8B79EE88-E62D-4AA8-B530-CC357BA112B7} - C:\Program Files\ONSPEED\Toolband.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [OutpostMonitor] C:\PROGRA~1\Agnitum\OUTPOS~1\op_mon.exe /tray /noservice O4 - HKLM\..\Run: [OutpostFeedBack] "C:\Program Files\Agnitum\Outpost Firewall Pro\feedback.exe" /dump:os_startup O4 - HKLM\..\Run: [babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart O4 - HKLM\..\Run: [slipStream] "C:\Program Files\ONSPEED\onspeedcore.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [RegistryBooster 2 d’Uniblue ] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [uniblue SpeedUpMyPC] C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s O4 - HKCU\..\Run: [uniblue SpyEraser] "C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" -m O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: ONSPEED.lnk = C:\Program Files\ONSPEED\onspeedgui.exe O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm O8 - Extra context menu item: Montrer l'Image Originale - res://C:\Program Files\ONSPEED\gui_resource.dll/328 O8 - Extra context menu item: Montrer toutes les Images originales - res://C:\Program Files\ONSPEED\gui_resource.dll/327 O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute 2008\vrie.dll O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute 2008\vrie.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Réglage rapide de Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall Pro\ie_bar.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/co...ex/qtplugin.cab O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab O16 - DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} (VoxsyncCtrl Class) - http://contacts.orange.fr/wfr_webab/VoxsyncX.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com/fichier...on_2_0_4_13.cab O16 - DPF: {B9907873-6560-4A36-B76B-9DADE84A7F55} (FnacmusicDnl.DnlManager) - http://www.fnacmusic.com/telechargementFna...nacmusicDnl.CAB O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab O16 - DPF: {E1E73B44-2D20-47A9-9CA2-B534CEBBF856} (F-Secure Health Check 1.0) - http://orange.securitoo.com/pchc/fscax.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab O20 - AppInit_DLLs: c:\progra~1\agnitum\outpos~1\wl_hook.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd. - C:\PROGRA~1\Agnitum\OUTPOS~1\acs.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe -- End of file - 11466 bytes J'ai suivi la procédure que vous m'avez indiqué, j'espère que mon ordi n'est pas trop malade. Il ya "des trucs" comme O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe je me demande ce que c'est mais bon je vous laisse me dire la marche à suivre. En attendant vos réponse je vous souhaite une bonne journée et merci encore. P.S : J'avais posté tous ces rapports dans mon premier post, mais dans le doute j'ai créer un nouveau post.

Bonjour à tous, Suite à mon post "Trojans impossible à supprimer, Trojan.StartPage.fz et Trojan.StartPage.ig", j'ai donc suivi les conseils. Vous trouverez ci dessous les différents rapports : Voici le rapport d'antivir : Avira AntiVir Personal Report file date: mercredi 23 juillet 2008 13:01 Scanning for 1492302 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 3) [5.1.2600] Boot mode: Save mode Username: Mme SCANZY Computer name: M-AB2AB9FO78954 Version information: BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00 AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:58 AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:38 LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:24 LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:42 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34 ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 10:20:22 ANTIVIR2.VDF : 7.0.5.144 1690624 Bytes 21/07/2008 10:21:08 ANTIVIR3.VDF : 7.0.5.155 108032 Bytes 23/07/2008 10:21:14 Engineversion : 8.1.1.11 AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:22 AESCRIPT.DLL : 8.1.0.59 307579 Bytes 23/07/2008 10:22:18 AESCN.DLL : 8.1.0.23 119156 Bytes 23/07/2008 10:22:14 AERDL.DLL : 8.1.0.20 418165 Bytes 23/07/2008 10:22:10 AEPACK.DLL : 8.1.2.1 364917 Bytes 23/07/2008 10:22:04 AEOFFICE.DLL : 8.1.0.21 192891 Bytes 23/07/2008 10:21:58 AEHEUR.DLL : 8.1.0.43 1339767 Bytes 23/07/2008 10:21:52 AEHELP.DLL : 8.1.0.15 115063 Bytes 23/07/2008 10:21:34 AEGEN.DLL : 8.1.0.29 307573 Bytes 23/07/2008 10:21:28 AEEMU.DLL : 8.1.0.6 430451 Bytes 23/07/2008 10:21:24 AECORE.DLL : 8.1.1.6 172405 Bytes 23/07/2008 10:21:20 AEBB.DLL : 8.1.0.1 53617 Bytes 23/07/2008 10:21:16 AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:54 AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:52 AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:26:48 AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:50 AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:24 AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:32 SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:04 SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:40 NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:12 RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:26 RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:12 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: repair Secondary action.................: delete Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: on Scan all files...................: All files Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: mercredi 23 juillet 2008 13:01 Starting search for hidden objects. The driver could not be initialized. The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'Explorer.EXE' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 11 processes with 11 modules were scanned Starting master boot sector scan: Master boot sector HD0 [iNFO] No virus was found! Master boot sector HD1 [iNFO] No virus was found! [WARNING] Le périphérique n'est pas prêt. Master boot sector HD2 [iNFO] No virus was found! [WARNING] Le périphérique n'est pas prêt. Master boot sector HD3 [iNFO] No virus was found! [WARNING] Le périphérique n'est pas prêt. Master boot sector HD4 [iNFO] No virus was found! [WARNING] Le périphérique n'est pas prêt. Master boot sector HD5 [iNFO] No virus was found! [WARNING] Le périphérique n'est pas prêt. Start scanning boot sectors: Boot sector 'C:\' [iNFO] No virus was found! Starting to scan the registry. The registry was scanned ( '37' files ). Starting the file scan: Begin scan in 'C:\' <ACER> C:\pagefile.sys [WARNING] The file could not be opened! C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4EDE77A3.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4EDE77A3.exe [DETECTION] Contains detection pattern of the dropper DR/CASClient.M [NOTE] A backup was created as '48cb1646.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4EEF4991.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4EEF4991.exe [DETECTION] Contains detection pattern of the dropper DR/CASClient.M [NOTE] A backup was created as '48cc1647.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4EFC7183.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4EFC7183.exe [DETECTION] Contains detection pattern of the dropper DR/Cmapp.A.1 [NOTE] A backup was created as '48cd1647.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1B9D206D.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1B9D206D.exe [DETECTION] Contains detection pattern of the dropper DR/Cmapp.A.1 [NOTE] A backup was created as '48c01644.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Documents and Settings\acer\Mes documents\Manon\Mes documents\Logiciels\Divine Intervention III\DIVHIST.DOC [DETECTION] Contains detection pattern of the Windows virus W32/ThrBack-Silly.4 [NOTE] A backup was created as '48dd19ee.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Documents and Settings\acer\Mes documents\Downloads\Compressed\divint3.zip [0] Archive type: ZIP --> DIVHIST.DOC [DETECTION] Contains detection pattern of the Windows virus W32/ThrBack-Silly.4 [NOTE] A backup was created as '48fd1d4d.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Documents and Settings\acer\Mes documents\Downloads\Compressed\divint3\DIVHIST.DOC [DETECTION] Contains detection pattern of the Windows virus W32/ThrBack-Silly.4 [NOTE] A backup was created as '48dd1d2d.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy\Recovery\Yazzle.zip [DETECTION] Contains suspicious code GEN/PwdZIP [NOTE] The fund was classified as suspicious. [NOTE] A backup was created as '49011ec4.qua' ( QUARANTINE ) C:\Documents and Settings\Mme SCANZY\Mes documents\Elodie\programmes telec\adobePhotoshopCS2-fr.zip [0] Archive type: ZIP --> Adobe Photoshop CS2 fr/keygen.exe [DETECTION] Contains detection pattern of the worm WORM/Autorun.cxl [WARNING] The file could not be copied to the quarantine directory. [WARNING] [NOTE] The file was deleted! C:\Documents and Settings\Mme SCANZY\Mes documents\Elodie\programmes telec\mes drivers\77.72_win2kxp_international_whql.exe [WARNING] No further files can be extracted from this archive. The archive will be closed C:\Documents and Settings\Mme SCANZY\Mes documents\Elodie\programmes telec\adobePhotoshopCS2-fr\Adobe Photoshop CS2 fr\keygen.exe [DETECTION] Contains detection pattern of the worm WORM/Autorun.cxl [NOTE] A backup was created as '490028f7.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Program Files\AskSBar\bar\2.bin\A2PLUGIN.DLL [DETECTION] Contains detection pattern of a probably damaged sample CC/Agent.CS [NOTE] A backup was created as '48d73578.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043301.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043301.exe [DETECTION] Contains detection pattern of the dropper DR/CASClient.M [NOTE] A backup was created as '48b73b8c.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043302.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043302.exe [DETECTION] Contains detection pattern of the dropper DR/CASClient.M [NOTE] A backup was created as '48b73b8d.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043303.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043303.exe [DETECTION] Contains detection pattern of the dropper DR/Cmapp.A.1 [NOTE] A backup was created as '4915cba6.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043304.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043304.exe [DETECTION] Contains detection pattern of the dropper DR/Cmapp.A.1 [NOTE] A backup was created as '48b73b8f.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043305.DLL [DETECTION] Contains detection pattern of a probably damaged sample CC/Agent.CS [NOTE] A backup was created as '48b73b8e.qua' ( QUARANTINE ) [NOTE] The file was deleted! End of the scan: mercredi 23 juillet 2008 16:12 Used time: 3:11:12 min The scan has been done completely. 13656 Scanning directories 874629 Files were scanned 15 viruses and/or unwanted programs were found 1 Files were classified as suspicious: 15 files were deleted 0 files were repaired 15 files were moved to quarantine 0 files were renamed 2 Files cannot be scanned 874614 Files not concerned 12285 Archives were scanned 8 Warnings 16 Notes Voici le rapport de MBAM : Malwarebytes' Anti-Malware 1.22 Version de la base de données: 984 Windows 5.1.2600 Service Pack 3 07:12:36 24/07/2008 mbam-log-7-24-2008 (07-12-36).txt Type de recherche: Examen complet (C:\|) Eléments examinés: 223597 Temps écoulé: 5 hour(s), 22 minute(s), 40 second(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 0 Clé(s) du Registre infectée(s): 0 Valeur(s) du Registre infectée(s): 0 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 1 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): (Aucun élément nuisible détecté) Clé(s) du Registre infectée(s): (Aucun élément nuisible détecté) Valeur(s) du Registre infectée(s): (Aucun élément nuisible détecté) Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP324\A0036822.dll (Adware.Shopper) -> Quarantined and deleted successfully. Et pour finir Voici le rapport Hijackthis : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 07:52:07, on 24/07/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RunDll32.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Babylon\Babylon-Pro\Babylon.exe C:\Program Files\ONSPEED\onspeedcore.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\ONSPEED\onspeedgui.exe C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Raxco\PerfectDisk\PDSched.exe C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\DAP\DAP.EXE C:\WINDOWS\system32\drwtsn32.exe C:\WINDOWS\system32\drwtsn32.exe C:\Documents and Settings\Mme SCANZY\Mes documents\Elodie\programmes telec\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://192.168.1.1/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5405 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing) O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\ONSPEED\PBHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: NOW!Imaging - {9AA2F14F-E956-44B8-8694-A5B615CDF341} - C:\Program Files\ONSPEED\components\NOWImaging.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: ONSPEED - {8B79EE88-E62D-4AA8-B530-CC357BA112B7} - C:\Program Files\ONSPEED\Toolband.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [OutpostMonitor] C:\PROGRA~1\Agnitum\OUTPOS~1\op_mon.exe /tray /noservice O4 - HKLM\..\Run: [OutpostFeedBack] "C:\Program Files\Agnitum\Outpost Firewall Pro\feedback.exe" /dump:os_startup O4 - HKLM\..\Run: [babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart O4 - HKLM\..\Run: [slipStream] "C:\Program Files\ONSPEED\onspeedcore.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [RegistryBooster 2 d’Uniblue ] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [uniblue SpeedUpMyPC] C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s O4 - HKCU\..\Run: [uniblue SpyEraser] "C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" -m O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: ONSPEED.lnk = C:\Program Files\ONSPEED\onspeedgui.exe O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm O8 - Extra context menu item: Montrer l'Image Originale - res://C:\Program Files\ONSPEED\gui_resource.dll/328 O8 - Extra context menu item: Montrer toutes les Images originales - res://C:\Program Files\ONSPEED\gui_resource.dll/327 O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute 2008\vrie.dll O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute 2008\vrie.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Réglage rapide de Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall Pro\ie_bar.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/co...ex/qtplugin.cab O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab O16 - DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} (VoxsyncCtrl Class) - http://contacts.orange.fr/wfr_webab/VoxsyncX.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com/fichier...on_2_0_4_13.cab O16 - DPF: {B9907873-6560-4A36-B76B-9DADE84A7F55} (FnacmusicDnl.DnlManager) - http://www.fnacmusic.com/telechargementFna...nacmusicDnl.CAB O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab O16 - DPF: {E1E73B44-2D20-47A9-9CA2-B534CEBBF856} (F-Secure Health Check 1.0) - http://orange.securitoo.com/pchc/fscax.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab O20 - AppInit_DLLs: c:\progra~1\agnitum\outpos~1\wl_hook.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd. - C:\PROGRA~1\Agnitum\OUTPOS~1\acs.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe -- End of file - 11466 bytes J'ai suivi la procédure que vous m'avez indiqué, j'espère que mon ordi n'est pas trop malade. Il ya "des trucs" comme O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe je me demande ce que c'est mais bon je vous laisse me dire la marche à suivre. En attendant vos réponse je vous souhaite une bonne journée et merci encore. P.S : J'avais posté tous ces rapports dans mon premier post, mais dans le doute j'ai créer un nouveau post.

Voici le rapport Hijackthis : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 07:52:07, on 24/07/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RunDll32.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Babylon\Babylon-Pro\Babylon.exe C:\Program Files\ONSPEED\onspeedcore.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\ONSPEED\onspeedgui.exe C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Raxco\PerfectDisk\PDSched.exe C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\DAP\DAP.EXE C:\WINDOWS\system32\drwtsn32.exe C:\WINDOWS\system32\drwtsn32.exe C:\Documents and Settings\Mme SCANZY\Mes documents\Elodie\programmes telec\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://192.168.1.1/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5405 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing) O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\ONSPEED\PBHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: NOW!Imaging - {9AA2F14F-E956-44B8-8694-A5B615CDF341} - C:\Program Files\ONSPEED\components\NOWImaging.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: ONSPEED - {8B79EE88-E62D-4AA8-B530-CC357BA112B7} - C:\Program Files\ONSPEED\Toolband.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [OutpostMonitor] C:\PROGRA~1\Agnitum\OUTPOS~1\op_mon.exe /tray /noservice O4 - HKLM\..\Run: [OutpostFeedBack] "C:\Program Files\Agnitum\Outpost Firewall Pro\feedback.exe" /dump:os_startup O4 - HKLM\..\Run: [babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart O4 - HKLM\..\Run: [slipStream] "C:\Program Files\ONSPEED\onspeedcore.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [RegistryBooster 2 d’Uniblue ] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [uniblue SpeedUpMyPC] C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s O4 - HKCU\..\Run: [uniblue SpyEraser] "C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" -m O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: ONSPEED.lnk = C:\Program Files\ONSPEED\onspeedgui.exe O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm O8 - Extra context menu item: Montrer l'Image Originale - res://C:\Program Files\ONSPEED\gui_resource.dll/328 O8 - Extra context menu item: Montrer toutes les Images originales - res://C:\Program Files\ONSPEED\gui_resource.dll/327 O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute 2008\vrie.dll O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute 2008\vrie.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Réglage rapide de Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall Pro\ie_bar.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/co...ex/qtplugin.cab O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab O16 - DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} (VoxsyncCtrl Class) - http://contacts.orange.fr/wfr_webab/VoxsyncX.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com/fichier...on_2_0_4_13.cab O16 - DPF: {B9907873-6560-4A36-B76B-9DADE84A7F55} (FnacmusicDnl.DnlManager) - http://www.fnacmusic.com/telechargementFna...nacmusicDnl.CAB O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab O16 - DPF: {E1E73B44-2D20-47A9-9CA2-B534CEBBF856} (F-Secure Health Check 1.0) - http://orange.securitoo.com/pchc/fscax.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab O20 - AppInit_DLLs: c:\progra~1\agnitum\outpos~1\wl_hook.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd. - C:\PROGRA~1\Agnitum\OUTPOS~1\acs.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe -- End of file - 11466 bytes J'ai suivi la procédure que vous m'avez indiqué, j'espère que mon ordi n'est pas trop malade. Il ya "des trucs" comme O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe je me demande ce que c'est mais bon je vous laisse me dire la marche à suivre. En attendant vos réponse je vous souhaite une bonne journée et merci encore.

Bonjour à tous, Voici le rapport de MBAM : Malwarebytes' Anti-Malware 1.22 Version de la base de données: 984 Windows 5.1.2600 Service Pack 3 07:12:36 24/07/2008 mbam-log-7-24-2008 (07-12-36).txt Type de recherche: Examen complet (C:\|) Eléments examinés: 223597 Temps écoulé: 5 hour(s), 22 minute(s), 40 second(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 0 Clé(s) du Registre infectée(s): 0 Valeur(s) du Registre infectée(s): 0 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 1 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): (Aucun élément nuisible détecté) Clé(s) du Registre infectée(s): (Aucun élément nuisible détecté) Valeur(s) du Registre infectée(s): (Aucun élément nuisible détecté) Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP324\A0036822.dll (Adware.Shopper) -> Quarantined and deleted successfully. Maintnant je vais lancer le fichier Hijackthis.exe est vous envoie son rapport. A bientôt

Re bonjour et merci pour la rapidité de votre réponse. Voici le rapport d'antivir : Avira AntiVir Personal Report file date: mercredi 23 juillet 2008 13:01 Scanning for 1492302 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 3) [5.1.2600] Boot mode: Save mode Username: Mme SCANZY Computer name: M-AB2AB9FO78954 Version information: BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00 AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:58 AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:38 LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:24 LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:42 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34 ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 10:20:22 ANTIVIR2.VDF : 7.0.5.144 1690624 Bytes 21/07/2008 10:21:08 ANTIVIR3.VDF : 7.0.5.155 108032 Bytes 23/07/2008 10:21:14 Engineversion : 8.1.1.11 AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:22 AESCRIPT.DLL : 8.1.0.59 307579 Bytes 23/07/2008 10:22:18 AESCN.DLL : 8.1.0.23 119156 Bytes 23/07/2008 10:22:14 AERDL.DLL : 8.1.0.20 418165 Bytes 23/07/2008 10:22:10 AEPACK.DLL : 8.1.2.1 364917 Bytes 23/07/2008 10:22:04 AEOFFICE.DLL : 8.1.0.21 192891 Bytes 23/07/2008 10:21:58 AEHEUR.DLL : 8.1.0.43 1339767 Bytes 23/07/2008 10:21:52 AEHELP.DLL : 8.1.0.15 115063 Bytes 23/07/2008 10:21:34 AEGEN.DLL : 8.1.0.29 307573 Bytes 23/07/2008 10:21:28 AEEMU.DLL : 8.1.0.6 430451 Bytes 23/07/2008 10:21:24 AECORE.DLL : 8.1.1.6 172405 Bytes 23/07/2008 10:21:20 AEBB.DLL : 8.1.0.1 53617 Bytes 23/07/2008 10:21:16 AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:54 AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:52 AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:26:48 AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:50 AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:24 AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:32 SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:04 SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:40 NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:12 RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:26 RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:12 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: repair Secondary action.................: delete Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: on Scan all files...................: All files Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: mercredi 23 juillet 2008 13:01 Starting search for hidden objects. The driver could not be initialized. The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'Explorer.EXE' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 11 processes with 11 modules were scanned Starting master boot sector scan: Master boot sector HD0 [iNFO] No virus was found! Master boot sector HD1 [iNFO] No virus was found! [WARNING] Le périphérique n'est pas prêt. Master boot sector HD2 [iNFO] No virus was found! [WARNING] Le périphérique n'est pas prêt. Master boot sector HD3 [iNFO] No virus was found! [WARNING] Le périphérique n'est pas prêt. Master boot sector HD4 [iNFO] No virus was found! [WARNING] Le périphérique n'est pas prêt. Master boot sector HD5 [iNFO] No virus was found! [WARNING] Le périphérique n'est pas prêt. Start scanning boot sectors: Boot sector 'C:\' [iNFO] No virus was found! Starting to scan the registry. The registry was scanned ( '37' files ). Starting the file scan: Begin scan in 'C:\' <ACER> C:\pagefile.sys [WARNING] The file could not be opened! C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4EDE77A3.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4EDE77A3.exe [DETECTION] Contains detection pattern of the dropper DR/CASClient.M [NOTE] A backup was created as '48cb1646.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4EEF4991.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4EEF4991.exe [DETECTION] Contains detection pattern of the dropper DR/CASClient.M [NOTE] A backup was created as '48cc1647.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4EFC7183.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4EFC7183.exe [DETECTION] Contains detection pattern of the dropper DR/Cmapp.A.1 [NOTE] A backup was created as '48cd1647.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1B9D206D.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1B9D206D.exe [DETECTION] Contains detection pattern of the dropper DR/Cmapp.A.1 [NOTE] A backup was created as '48c01644.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Documents and Settings\acer\Mes documents\Manon\Mes documents\Logiciels\Divine Intervention III\DIVHIST.DOC [DETECTION] Contains detection pattern of the Windows virus W32/ThrBack-Silly.4 [NOTE] A backup was created as '48dd19ee.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Documents and Settings\acer\Mes documents\Downloads\Compressed\divint3.zip [0] Archive type: ZIP --> DIVHIST.DOC [DETECTION] Contains detection pattern of the Windows virus W32/ThrBack-Silly.4 [NOTE] A backup was created as '48fd1d4d.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Documents and Settings\acer\Mes documents\Downloads\Compressed\divint3\DIVHIST.DOC [DETECTION] Contains detection pattern of the Windows virus W32/ThrBack-Silly.4 [NOTE] A backup was created as '48dd1d2d.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy\Recovery\Yazzle.zip [DETECTION] Contains suspicious code GEN/PwdZIP [NOTE] The fund was classified as suspicious. [NOTE] A backup was created as '49011ec4.qua' ( QUARANTINE ) C:\Documents and Settings\Mme SCANZY\Mes documents\Elodie\programmes telec\adobePhotoshopCS2-fr.zip [0] Archive type: ZIP --> Adobe Photoshop CS2 fr/keygen.exe [DETECTION] Contains detection pattern of the worm WORM/Autorun.cxl [WARNING] The file could not be copied to the quarantine directory. [WARNING] [NOTE] The file was deleted! C:\Documents and Settings\Mme SCANZY\Mes documents\Elodie\programmes telec\mes drivers\77.72_win2kxp_international_whql.exe [WARNING] No further files can be extracted from this archive. The archive will be closed C:\Documents and Settings\Mme SCANZY\Mes documents\Elodie\programmes telec\adobePhotoshopCS2-fr\Adobe Photoshop CS2 fr\keygen.exe [DETECTION] Contains detection pattern of the worm WORM/Autorun.cxl [NOTE] A backup was created as '490028f7.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\Program Files\AskSBar\bar\2.bin\A2PLUGIN.DLL [DETECTION] Contains detection pattern of a probably damaged sample CC/Agent.CS [NOTE] A backup was created as '48d73578.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043301.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043301.exe [DETECTION] Contains detection pattern of the dropper DR/CASClient.M [NOTE] A backup was created as '48b73b8c.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043302.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043302.exe [DETECTION] Contains detection pattern of the dropper DR/CASClient.M [NOTE] A backup was created as '48b73b8d.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043303.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043303.exe [DETECTION] Contains detection pattern of the dropper DR/Cmapp.A.1 [NOTE] A backup was created as '4915cba6.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043304.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043304.exe [DETECTION] Contains detection pattern of the dropper DR/Cmapp.A.1 [NOTE] A backup was created as '48b73b8f.qua' ( QUARANTINE ) [NOTE] The file was deleted! C:\System Volume Information\_restore{DEB3B852-13CD-45B6-A948-2A495D59BD4F}\RP370\A0043305.DLL [DETECTION] Contains detection pattern of a probably damaged sample CC/Agent.CS [NOTE] A backup was created as '48b73b8e.qua' ( QUARANTINE ) [NOTE] The file was deleted! End of the scan: mercredi 23 juillet 2008 16:12 Used time: 3:11:12 min The scan has been done completely. 13656 Scanning directories 874629 Files were scanned 15 viruses and/or unwanted programs were found 1 Files were classified as suspicious: 15 files were deleted 0 files were repaired 15 files were moved to quarantine 0 files were renamed 2 Files cannot be scanned 874614 Files not concerned 12285 Archives were scanned 8 Warnings 16 Notes Mon PC était il infecté ? Je vais maintenant executer Malwarebytes' Anti-Malware (MBAM) et vous poste le rapport dès que possible. Merci encore pour votre aide.

Bonjour à tous et félicitations pour votre site. Voilà mon soucis. Mon anti spyware (Uniblue SpyEraser) me trouve 2 Trojans dans le registre(Trojan.StartPage.fz et Trojan.StartPage.ig) mais il n'arrive pas à les supprimer. A la fin du scan je lui demande de les mettre en quarantaine ou de les supprimer il me dit le faire,mais si je refait un scan ils sont toujours là. J'ai essayé en mode sans echec et idem, ils sont toujours dans la base de registre. Celui là Trojan.StartPage.fz il me dit qu'il est dans : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main/search bar/http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch Effectivement dans le regitre je le trouve. L'autre Trojan.StartPage.ig il me dit qu'il est dans : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main/search bar Par contre cette clé je la trouve pas. Mais comme vous pouvez le voir c'est comme le début de l'autre. Ma question est puis je la supprimer manuellement via le regitre? est ce vraiment un trojan? Je vous remercie pour votre aide.