Michael33

Bonjour, Merci pour votre réponse. J'ai désinstallé Avast et je l'ai remplacé par AntiVir. J'ai aussi installé le pare feu Comodo ainsi que Malwarebyte's Anti-Malware dont un scan de mon ordi n'a pas signalé de problème. J'ai aussi mis à jour Internet Explorer. Je suis donc en version 7 J'ai un PC portable IBM ThinkPad R50e et j'ai n'ai jamais réussi à faire les mises à jour du système via le logiciel IBM présent en natif sur l'ordi pour cela. J'ai mis à jour le logiciel IBM qui sert justement à mettre à jour le système. Comme la précédente version, il y a toujours un echec lors de la mise à jour... Voici le log HijackThis après tout ça : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:14:36, on 15/08/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\ibmpmsvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\S24EvMon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\COMODO\Firewall\cmdagent.exe C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe C:\WINDOWS\System32\QCONSVC.EXE C:\WINDOWS\system32\RegSrvc.exe C:\WINDOWS\System32\svchost.exe c:\program files\lenovo\system update\suservice.exe C:\WINDOWS\system32\TpKmpSVC.exe C:\Program Files\Fichiers communs\Lenovo\Scheduler\tvtsched.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\tp4serv.exe C:\WINDOWS\system32\hkcmd.exe C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\IBMTOOLS\UTILS\ibmprc.exe C:\PROGRA~1\ThinkPad\CONNEC~1\QCTray.exe C:\PROGRA~1\ThinkPad\CONNEC~1\QCWLIcon.exe C:\WINDOWS\system32\igfxtray.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\COMODO\Firewall\cfp.exe C:\Program Files\Fichiers communs\Lenovo\Scheduler\scheduler_proxy.exe C:\Program Files\IBM\Messages By IBM\ibmmessages.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\HiJackThis\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe O4 - HKLM\..\Run: [TP4EX] tp4ex.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [iBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe O4 - HKLM\..\Run: [bMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper O4 - HKLM\..\Run: [QCTray] C:\PROGRA~1\ThinkPad\CONNEC~1\QCTray.exe O4 - HKLM\..\Run: [QCWLICON] C:\PROGRA~1\ThinkPad\CONNEC~1\QCWLIcon.exe O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Fichiers communs\Lenovo\Scheduler\scheduler_proxy.exe O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [JAVA_IBM] Java (IBM) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IASRunner Class) - https://www-307.ibm.com/pc/support/access/a...ntent/AcpIR.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1173127782012 O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/a...gnerADP-1.0.cab O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://www.photoservice.com/telechargement...geUploader4.cab O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing) O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe O23 - Service: System Update (SUService) - Lenovo Group Limited - c:\program files\lenovo\system update\suservice.exe O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe O23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Program Files\Fichiers communs\Lenovo\Scheduler\tvtsched.exe -- End of file - 8510 bytes Connaissez-vous une application permettant de configurer les processus qui démarrent en même temps que mon ordi ? J'ai l'impression qu'il y a plein de choses inutiles qui se lancent au démarrage et qui le ralentisse. En plus, l'ordre avec lequel les choses démarrent ne me semble pas logique. Merci d'avance Michaël

Bonjour, Mon ordinateur a des lenteurs, certaines mises à jours qui bloquent, Internet Explorer qui ne se lance pas quand on clique sur l'icône (pourtant un processus se lance)... Je pense que j'ai un problème. Merci d'avance de me donner votre avis sur de rapport HiJackThis : Logfile of Trend Micro Hijac k Thi s v2.0.2 S can s aved at 23:47:38, on 14/08/2008 Platform: Window s XP S P3 (WinNT 5.01.2600) M S IE: Internet Explorer v6.00 S P3 (6.00.2900.5512) Boot mode: Normal Running proce s s e s : C:\WINDOW S \ S y s tem32\ s m s s .exe C:\WINDOW S \ s y s tem32\winlogon.exe C:\WINDOW S \ s y s tem32\ s ervice s .exe C:\WINDOW S \ s y s tem32\l s a s s .exe C:\WINDOW S \ S y s tem32\ibmpm s vc.exe C:\WINDOW S \ s y s tem32\ s vcho s t.exe C:\WINDOW S \ S y s tem32\ s vcho s t.exe C:\WINDOW S \ s y s tem32\ S 24EvMon.exe C:\Program File s \Alwil S oftware\Ava s t4\a s wUpd S v.exe C:\Program File s \Alwil S oftware\Ava s t4\a s h S erv.exe C:\WINDOW S \ s y s tem32\ s pool s v.exe C:\Program File s \IBM\IBM Rapid Re s tore Ultra\rrpc s b.exe C:\WINDOW S \ S y s tem32\QCON S VC.EXE C:\WINDOW S \ s y s tem32\Reg S rvc.exe C:\WINDOW S \ S y s tem32\ s vcho s t.exe C:\WINDOW S \ s y s tem32\Tp K mp S VC.exe C:\Program File s \Alwil S oftware\Ava s t4\a s hMai S v.exe C:\Program File s \Alwil S oftware\Ava s t4\a s hWeb S v.exe C:\WINDOW S \Explorer.EXE C:\WINDOW S \ s y s tem32\tp4 s erv.exe C:\WINDOW S \ s y s tem32\h k cmd.exe C:\PROGRA~1\Thin k Pad\P k gMgr\HOT K EY\TPH K MGR.exe C:\WINDOW S \ s y s tem32\dla\tf s wctrl.exe C:\IBMTOOL S \UTIL S \ibmprc.exe C:\Program File s \Thin k Pad\P k gMgr\HOT K EY\TPON S CR.exe C:\Program File s \Thin k Pad\P k gMgr\HOT K EY_1\Tp S crex.exe C:\PROGRA~1\ALWIL S ~1\Ava s t4\a s hDi s p.exe C:\Program File s \IBM\Me s s age s By IBM\ibmme s s age s .exe C:\PROGRA~1\Thin k Pad\CONNEC~1\QCTray.exe C:\PROGRA~1\Thin k Pad\CONNEC~1\QCWLIcon.exe C:\Program File s \Window s Live\Me s s enger\M s nM s gr.Exe C:\Program File s \ S pybot - S earch & De s troy\TeaTimer.exe C:\Program File s \Window s Live\Me s s enger\u s n s vc.exe C:\Program File s \Mozilla Firefox\firefox.exe C:\WINDOW S \ s y s tem32\winlogon.exe C:\Program File s \HiJac k Thi s \HiJac k Thi s .exe R0 - H K CU\ S oftware\Micro s oft\Internet Explorer\Main, S tart Page = http://www.google.fr/ R0 - H K CU\ S oftware\Micro s oft\Internet Explorer\Toolbar,Lin k s FolderName = Lien s O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program File s \Real\RealPlayer\rpbrow s errecordplugin.dll O2 - BHO: S pybot- S &D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\ S PYBOT~1\ S DHelper.dll O2 - BHO: DriveLetterAcce s s - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOW S \ s y s tem32\dla\tf s w s hx.dll O2 - BHO: S S VHelper Cla s s - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program File s \Java\jre1.5.0_06\bin\ s s v.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Programme d'aide de l'A s s i s tant de connexion Window s Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program File s \Fichier s commun s \Micro s oft S hared\Window s Live\Window s LiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program file s \google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program File s \Google\GoogleToolbarNotifier\2.0.301.7164\ s wg.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program File s \Micro s oft Money\ S y s tem\mnyviewer.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program file s \google\googletoolbar2.dll O4 - H K LM\..\Run: [Trac k Point S rv] tp4 s erv.exe O4 - H K LM\..\Run: [Hot K ey s Cmd s ] C:\WINDOW S \ s y s tem32\h k cmd.exe O4 - H K LM\..\Run: [TPHOT K EY] C:\PROGRA~1\Thin k Pad\P k gMgr\HOT K EY\TPH K MGR.exe O4 - H K LM\..\Run: [TP4EX] tp4ex.exe O4 - H K LM\..\Run: [dla] C:\WINDOW S \ s y s tem32\dla\tf s wctrl.exe O4 - H K LM\..\Run: [iBMPRC] C:\IBMTOOL S \UTIL S \ibmprc.exe O4 - H K LM\..\Run: [bMMLREF] C:\Program File s \Thin k Pad\Utilitie s \BMMLREF.EXE O4 - H K LM\..\Run: [TP K MAPHELPER] C:\Program File s \Thin k Pad\Utilitie s \Tp K mapAp.exe -helper O4 - H K LM\..\Run: [ava s t!] C:\PROGRA~1\ALWIL S ~1\Ava s t4\a s hDi s p.exe O4 - H K LM\..\Run: [ibmme s s age s ] C:\Program File s \IBM\Me s s age s By IBM\\ibmme s s age s .exe O4 - H K LM\..\Run: [QCTray] C:\PROGRA~1\Thin k Pad\CONNEC~1\QCTray.exe O4 - H K LM\..\Run: [QCWLICON] C:\PROGRA~1\Thin k Pad\CONNEC~1\QCWLIcon.exe O4 - H K CU\..\Run: [ibmme s s age s ] C:\Program File s \IBM\Me s s age s By IBM\ibmme s s age s .exe O4 - H K CU\..\Run: [m s nm s gr] "C:\Program File s \Window s Live\Me s s enger\M s nM s gr.Exe" /bac k ground O4 - H K CU\..\Run: [ s pybot S D TeaTimer] C:\Program File s \ S pybot - S earch & De s troy\TeaTimer.exe O4 - H K U S \ S -1-5-21-2142657939-3939912313-3781766193-1005\..\Run: [ibmme s s age s ] C:\Program File s \IBM\Me s s age s By IBM\ibmme s s age s .exe (U s er 'Corinne') O4 - H K U S \ S -1-5-21-2142657939-3939912313-3781766193-1005\..\Run: [m s nm s gr] "C:\Program File s \Window s Live\Me s s enger\m s nm s gr.exe" /bac k ground (U s er 'Corinne') O4 - H K U S \ S -1-5-21-2142657939-3939912313-3781766193-1005\..\Run: [ s wg] C:\Program File s \Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (U s er 'Corinne') O4 - S tartup: Adobe Gamma.ln k .di s abled O4 - Global S tartup: Adobe Gamma Loader.exe.ln k .di s abled O4 - Global S tartup: Digital Line Detect.ln k .di s abled O4 - Global S tartup: HP Digital Imaging Monitor.ln k .di s abled O8 - Extra context menu item: E&xporter ver s Micro s oft Excel - re s ://C:\PROGRA~1\MICRO S ~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICRO S ~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\ S PYBOT~1\ S DHelper.dll O9 - Extra 'Tool s ' menuitem: S pybot - S earch & De s troy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\ S PYBOT~1\ S DHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOW S \Networ k Diagno s tic\xpnetdiag.exe O9 - Extra 'Tool s ' menuitem: @xp s p3re s .dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOW S \Networ k Diagno s tic\xpnetdiag.exe O9 - Extra button: Me s s enger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program File s \Me s s enger\m s m s g s .exe O9 - Extra 'Tool s ' menuitem: Window s Me s s enger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program File s \Me s s enger\m s m s g s .exe O11 - Option s group: [JAVA_IBM] Java (IBM) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Window s Genuine Advantage Validation Tool) - http://go.micro s oft.com/fwlin k /?lin k id=39204 O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IA S Runner Cla s s ) - http s ://www-307.ibm.com/pc/ s upport/acce s s /a...ntent/AcpIR.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Cla s s ) - http://update.micro s oft.com/micro s oftupdat...b?1173127782012 O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (Hou s eCall Control) - http://a840.g.a k amai.net/7/840/537/2005111...all/x s can53.cab O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Cla s s ) - http s :// s tatic.impot s .gouv.fr/tdir/ s tatic/a...gnerADP-1.0.cab O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://www.photo s ervice.com/telechargement...geUploader4.cab O18 - Protocol: tal k to - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\ME S S EN~1\M S GRAP~1.DLL O23 - S ervice: Adobe LM S ervice - Adobe S y s tem s - C:\Program File s \Fichier s commun s \Adobe S y s tem s S hared\ S ervice\Adobelm s vc.exe O23 - S ervice: ava s t! iAV S 4 Control S ervice (a s wUpd S v) - ALWIL S oftware - C:\Program File s \Alwil S oftware\Ava s t4\a s wUpd S v.exe O23 - S ervice: ava s t! Antiviru s - ALWIL S oftware - C:\Program File s \Alwil S oftware\Ava s t4\a s h S erv.exe O23 - S ervice: ava s t! Mail S canner - ALWIL S oftware - C:\Program File s \Alwil S oftware\Ava s t4\a s hMai S v.exe O23 - S ervice: ava s t! Web S canner - ALWIL S oftware - C:\Program File s \Alwil S oftware\Ava s t4\a s hWeb S v.exe O23 - S ervice: Google Updater S ervice (gu s vc) - Google - C:\Program File s \Google\Common\Google Updater\GoogleUpdater S ervice.exe O23 - S ervice: IBM Rapid Re s tore Ultra S ervice - Un k nown owner - C:\Program File s \IBM\IBM Rapid Re s tore Ultra\rrpc s b.exe O23 - S ervice: IBM PM S ervice (IBMPM S VC) - Un k nown owner - C:\WINDOW S \ S y s tem32\ibmpm s vc.exe O23 - S ervice: Pml Driver HPZ12 - HP - C:\WINDOW S \ s y s tem32\HPZipm12.exe O23 - S ervice: IBM P S A Acce s s Driver Control (P s a S rv) - Un k nown owner - C:\WINDOW S \ s y s tem32\P s a S rv.exe (file mi s s ing) O23 - S ervice: QCON S VC - IBM Corp. - C:\WINDOW S \ S y s tem32\QCON S VC.EXE O23 - S ervice: Reg S rvc - Intel Corporation - C:\WINDOW S \ s y s tem32\Reg S rvc.exe O23 - S ervice: S pectrum24 Event Monitor ( S 24EventMonitor) - Intel Corporation - C:\WINDOW S \ s y s tem32\ S 24EvMon.exe O23 - S ervice: IBM K CU S ervice (Tp K mp S VC) - Un k nown owner - C:\WINDOW S \ s y s tem32\Tp K mp S VC.exe -- End of file - 8527 byte s Michaël

Bonjour, Depuis quelques temps j'ai remarqué quelques petits problèmes sur mon ordinateur : - j'ai besoin de cliquer de nombreuse fois sur l'icône d'Internet Explorer avant que le logiciel se lance, alors que poutant il y a bien autant de processus iexplorer de de nombre de fois où j'ai dû cliqué... - lorsque j'essaye d'ouvrir mes mail via l'icône de MSN Messenger, Internet Explorer ne se lance pas (sauf si une fenetre de Internet Explorer est déjà ouverte) Merci d'avance de bien vouloir m'aider à y voir plus clair dans ce rapport HiJackThis et de me dire ce qu'il faut nettoyer. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:29:48, on 30/07/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\ibmpmsvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\S24EvMon.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe C:\WINDOWS\System32\QCONSVC.EXE C:\WINDOWS\system32\RegSrvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\TpKmpSVC.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\tp4serv.exe C:\WINDOWS\system32\hkcmd.exe C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\IBMTOOLS\UTILS\ibmprc.exe C:\PROGRA~1\ThinkPad\CONNEC~1\QCWLIcon.exe C:\WINDOWS\system32\RunDll32.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\IBM\Messages By IBM\ibmmessages.exe C:\PROGRA~1\ThinkPad\CONNEC~1\QCTray.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Microsoft Money\System\urlmap.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Michaël\Bureau\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file) O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe O4 - HKLM\..\Run: [TP4EX] tp4ex.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [iBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe O4 - HKLM\..\Run: [QCWLICON] C:\PROGRA~1\ThinkPad\CONNEC~1\QCWLIcon.exe O4 - HKLM\..\Run: [bMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor O4 - HKLM\..\Run: [bMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE O4 - HKLM\..\Run: [bMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\\ibmmessages.exe O4 - HKLM\..\Run: [QCTray] C:\PROGRA~1\ThinkPad\CONNEC~1\QCTray.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Startup: Adobe Gamma.lnk.disabled O4 - Global Startup: Adobe Gamma Loader.exe.lnk.disabled O4 - Global Startup: Digital Line Detect.lnk.disabled O4 - Global Startup: HP Digital Imaging Monitor.lnk.disabled O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [JAVA_IBM] Java (IBM) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IASRunner Class) - https://www-307.ibm.com/pc/support/access/a...ntent/AcpIR.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1173127782012 O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/a...gnerADP-1.0.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://www.photoservice.com/telechargement...geUploader4.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing) O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe -- End of file - 9832 bytes Merci Michaël

Merci beaucoup pour votre aide et tout vos conseils. MON PROBLEME EST RESOLU

Bonjour, Merci beaucoup pour votre aide. Voici le rapport de OTMoveIt2 : DllUnregisterServer procedure not found in C:\WINDOWS\System32\geBstuUM.dll C:\WINDOWS\System32\geBstuUM.dll NOT unregistered. C:\WINDOWS\System32\geBstuUM.dll moved successfully. OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07242008_091534 Il y a quelques années j'avais Antivir jusqu'au jour ou il a laissé passé un virus et je l'ai remplacé par Avast qui a troué et supprimé le virus. Je sais que les choses bougent souvent dans le monde des antivirus et j'hésite encore a remplacer Avast par Antivir car Avast à l'avantage de vérifier les mails. Je n'ai pas vraiment le temps de m'en occuper cette semaine car je suis débordé et comme on lit tout et son contraire sur Internet concernant la comparaisons entre les anitivirus, il faut que je prenne le temps d'étudier sérieusement cette question. Je vais le faire dans les semaines qui viennent. En tout cas j'ai lu votre comparatif et je suis prêt à changer à nouveau d'antivirus si Antivir s'avère plus efficace. J'ai juste besoin de temps pour y réfléchir et trouver une solution pour controler mes mails si Antivir ne le fait pas. Sinon j'ai mis à jour Java Voici le rapport HijackThis : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:49:52, on 24/07/2008 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe C:\WINDOWS\system32\pctspk.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\System32\msiexec.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {8C749FE5-A256-4184-B953-0F77E59CD60C} - C:\WINDOWS\System32\geBstuUM.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [skwatAutoconnect] C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Global Startup: NetShow PowerPoint Helper.lnk.disabled O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Adobe Gamma Loader.lnk.disabled O4 - Global Startup: Microsoft Office.lnk.disabled O4 - Global Startup: Contrôle d’état.lnk.disabled O4 - Global Startup: EPSON Status Monitor 3 Environment Check(3).lnk.disabled O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\PROGRAM FILES\ATI MULTIMEDIA\TV\EXPLBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure...teleir_cert.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1125933013636 O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{7ABC097B-4716-4816-BDCE-31AD58AB908A}: NameServer = 84.103.237.143 86.64.145.143 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: ADSLAutoconnect - Unknown owner - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe -- End of file - 6258 bytes

Et pour finir le rapport HijachThis : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:50:54, on 23/07/2008 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe C:\WINDOWS\system32\pctspk.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: (no name) - {13CF93B8-DC82-47B0-B759-C7D5869DDA55} - C:\WINDOWS\System32\geBstuUM.dll O2 - BHO: (no name) - {1C2DA439-4680-4E85-A22D-EB2385FABF80} - C:\WINDOWS\system32\tuvUOGyv.dll (file missing) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {889A5211-B0A9-4E66-A9BB-CE19CD6F211B} - (no file) O2 - BHO: (no name) - {EE69909E-E2CC-445B-85A8-4097CCFF8DD2} - (no file) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [skwatAutoconnect] C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Global Startup: NetShow PowerPoint Helper.lnk.disabled O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Adobe Gamma Loader.lnk.disabled O4 - Global Startup: Microsoft Office.lnk.disabled O4 - Global Startup: Contrôle d’état.lnk.disabled O4 - Global Startup: EPSON Status Monitor 3 Environment Check(3).lnk.disabled O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\PROGRAM FILES\ATI MULTIMEDIA\TV\EXPLBAR.DLL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure...teleir_cert.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1125933013636 O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{7ABC097B-4716-4816-BDCE-31AD58AB908A}: NameServer = 86.64.145.141 84.103.237.141 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: ADSLAutoconnect - Unknown owner - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe -- End of file - 6710 bytes

J'ai finalement réussis à redémarrer en mode sans echec. Voici donc le rapport de Sdfix : SDFix: Version 1.207 Run by Line test on 23/07/2008 at 16:33 Microsoft Windows XP [version 5.1.2600] Running From: C:\SDFix Checking Services : Restoring Default Security Values Restoring Default Hosts File Rebooting Checking Files : Trojan Files Found: C:\WINDOWS\system32\TFTP168 - Deleted C:\WINDOWS\system32\TFTP944 - Deleted C:\WINDOWS\system32\TFTP376 - Deleted C:\WINDOWS\system32\TFTP1484 - Deleted C:\WINDOWS\system32\TFTP1052 - Deleted C:\WINDOWS\system32\TFTP1876 - Deleted C:\WINDOWS\Temp\removalfile.bat - Deleted Removing Temp Files ADS Check : Final Check : catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-23 16:51:01 Windows 5.1.2600 FAT NTAPI scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: Remaining Files : File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes : Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe" Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" Finished! Voici ensuite le rapport de MBAM : Malwarebytes' Anti-Malware 1.22 Version de la base de données: 982 Windows 5.1.2600 17:31:30 23/07/2008 mbam-log-7-23-2008 (17-31-30).txt Type de recherche: Examen complet (C:\|) Eléments examinés: 77981 Temps écoulé: 33 minute(s), 33 second(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 2 Clé(s) du Registre infectée(s): 9 Valeur(s) du Registre infectée(s): 2 Elément(s) de données du Registre infecté(s): 4 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 20 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): C:\WINDOWS\SYSTEM32\geBstuUM.dll (Trojan.Vundo) -> Unloaded module successfully. C:\WINDOWS\SYSTEM32\nbxxljla.dll (Trojan.Vundo) -> Unloaded module successfully. Clé(s) du Registre infectée(s): HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2eb19b35-2843-48e0-8987-6c278b5b27e7} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{2eb19b35-2843-48e0-8987-6c278b5b27e7} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5715d66f-f4b4-4752-8e5a-fea95b027b8f} (Trojan.Vundo) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{5715d66f-f4b4-4752-8e5a-fea95b027b8f} (Trojan.Vundo) -> Delete on reboot. HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully. Valeur(s) du Registre infectée(s): HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3144137d (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bm327720e1 (Trojan.Agent) -> Delete on reboot. Elément(s) de données du Registre infecté(s): HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\gebstuum -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\gebstuum -> Delete on reboot. HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel\Homepage (Hijack.Homepage) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): C:\WINDOWS\SYSTEM32\eavlxz.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\geBstuUM.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\SYSTEM32\MUutsBeg.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\MUutsBeg.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\wmkmrpfk.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\kfprmkmw.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\qtnvtjhe.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\ehjtvntq.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\xdeynqve.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\evqnyedx.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\nbxxljla.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\SYSTEM32\aljlxxbn.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\wgfgetjb.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\yoqeavhg.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\ieonlmgf.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\Line test\Local Settings\Temporary Internet Files\Content.IE5\IV89V2XD\kb767887[1] (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\Line test\Local Settings\Temporary Internet Files\Content.IE5\G5MJS12B\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\nykyfvgf.dll (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\BM327720e1.xml (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\BM327720e1.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

Merci pour votre aide. J'ai commencer la procédure que vous m'avez indiqué et je me heurte à un problème. Lorsque je lance la procédure de démarrage en mode sans echec tout ce passe bien jusqu'à une boite de dialogue qui me demande de confirmer que je désire bien démarrer Windows en mode sans echec ou si je ne préfere pas utiliser la restauration système. Je réponds donc "oui" pour confirmer mon souhait de démarrer en mode sans echec. La boite de dialogue se ferme, mon ordinateur fait alors un bip et bloque sur un écran noir où les inscriptions "Mode sans echec" et Windows Version... sont écritent en blanc en haut de l'écran. Je bloque...

Bonjour, J'écris sur ce forum pour vous demander de l'aide car mon PC est infecté et que je n'arrive pas à savoir par quoi, et encore moins comment m'en débarasser. Il y a quelques jour j'ai perdu ma conexion à Internet suite à une mise à jour de ZoneAlarm qui a fait planté le logiciel mais je ne suis pas certain que ces deux évenement soient liés. A ce moment là, impossible de désinstallé ZoneAlarm ni de le mettre à jour, ni de le réinstaller. J'ai constaté qu'en coupant ZoneAlarm, qui ne fonctionnait pas normalement, je récupérais ma connexion Internet. J'ai donc laissé mon ordi deux jours sans firewall et j'en ai profité pour scanner ma machine avec Spybot et Avast. C'est peut-être pendant cette période que j'ai été infecté... Toujours est-il que Spybot a trouvé une bestiole et l'a supprimé et que Avast n'a rien trouvé. Après cela, j'ai pu réinstaller ZoneAlarm sans problème mais Spybot s'est mis à me demander des autorisations de modification du registre à chaque démarrage. Si je les refuse, Spybot me les redemande indéfiniment. Mon PC est donc contaminé par quelque chose. De plus, mon ordinateur est relié à un petit réseau de trois ordinateurs, et depuis quelques jours, j'ai perdu le réseau. Tout les paramètres réseau ont disparus et je ne peux même plus ajouter de nouvelle connexion réseau afin de réparer les dégats provoqués par l'infection sur mon réseau. Voici donc mon log HijachThis : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:31:08, on 22/07/2008 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\System32\Rundll32.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe C:\WINDOWS\system32\pctspk.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\System32\rundll32.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: (no name) - {1B0F82E5-4DFD-4B42-A7E3-FBDEB2B13D87} - C:\WINDOWS\System32\geBstuUM.dll O2 - BHO: (no name) - {1C2DA439-4680-4E85-A22D-EB2385FABF80} - C:\WINDOWS\system32\tuvUOGyv.dll (file missing) O2 - BHO: {7e72b5b8-72c6-7898-0e84-348253b91be2} - {2eb19b35-2843-48e0-8987-6c278b5b27e7} - C:\WINDOWS\System32\eavlxz.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {889A5211-B0A9-4E66-A9BB-CE19CD6F211B} - (no file) O2 - BHO: (no name) - {EE69909E-E2CC-445B-85A8-4097CCFF8DD2} - (no file) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [bM327720e1] Rundll32.exe "C:\WINDOWS\System32\nykyfvgf.dll",s O4 - HKLM\..\Run: [3144137d] rundll32.exe "C:\WINDOWS\System32\nbxxljla.dll",b O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [skwatAutoconnect] C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Global Startup: NetShow PowerPoint Helper.lnk.disabled O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Adobe Gamma Loader.lnk.disabled O4 - Global Startup: Microsoft Office.lnk.disabled O4 - Global Startup: Contrôle d’état.lnk.disabled O4 - Global Startup: EPSON Status Monitor 3 Environment Check(3).lnk.disabled O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\PROGRAM FILES\ATI MULTIMEDIA\TV\EXPLBAR.DLL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure...teleir_cert.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1125933013636 O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{7ABC097B-4716-4816-BDCE-31AD58AB908A}: NameServer = 86.64.145.143 84.103.237.143 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: ADSLAutoconnect - Unknown owner - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe -- End of file - 6965 bytes Je ne suis pas vraiment un pro de l'analyse des log HijackThis mais j'ai un doute sur les lignes suivantes : - O4 - HKLM\..\Run: [bM327720e1] Rundll32.exe "C:\WINDOWS\System32\nykyfvgf.dll",s - O4 - HKLM\..\Run: [3144137d] rundll32.exe "C:\WINDOWS\System32\nbxxljla.dll",b (ces applications causent les demandes d'intervention sur le registre que me fait Spybot à chaque démarrage) Merci d'avance de m'aider à trouver par quoi je suis infecté et surtout comment m'en débarasser sachant que je ne connait pas bien HijackThis et son fonctionnement. Michaël