Un problème pour r@in | b0w

[Chrislall]

Rebonjour r@in | b0w
J'espère que tu liras de post. Mais sinon je veux bien avoir à faire avec une autre personne qui pourrait m'aider...
J'ai récupéré le portable d'un bon ami afin d'essayer de venir à bout de :
MSServeur, une autre saloperie qui s'est incrusté.
Je joins directement un rapport hydjackthis je pense que ce sera utile... et nous fera gagner du temps...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:15:53, on 10/01/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:Windowssystem32Dwm.exe
C:WindowsExplorer.EXE
C:Windowssystem32 askeng.exe
C:Program FilesWindows DefenderMSASCui.exe
C:Program FilesSynapticsSynTPSynTPEnh.exe
C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxWatchTray9.exe
C:Program FilesPicasa2PicasaMediaDetector.exe
C:Program FilesIntelIntel Matrix Storage ManagerIAAnotif.exe
C:Program FilesLexmark 3500-4500 Serieslxdimon.exe
C:Program FilesLexmark 3500-4500 Serieslxdiamon.exe
C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe
C:Program FilesJavajre6injusched.exe
C:Program FilesAlwil SoftwareAvast4ashDisp.exe
C:Program FilesiTunesiTunesHelper.exe
C:WindowsSystem32 undll32.exe
C:Program FilesWindows Sidebarsidebar.exe
C:Program FilesPackard BellSetUpMyPCSmpSys.exe
C:Windowsehomeehtray.exe
C:Program FilesWindows LiveMessengermsnmsgr.exe
C:Program FilesSkypePhoneSkype.exe
C:Program FilesTomTom HOME 2HOMERunner.exe
C:Program FilesWindows Media Playerwmpnscfg.exe
C:Program FilesSpybot - Search & DestroyTeaTimer.exe
C:WindowsSystem32 undll32.exe
C:Program FilesLogitechSetPointSetPoint.exe
C:Windowsehomeehmsas.exe
C:Program FilesCommon FilesLogishrdKHAL2KHALMNPR.EXE
C:Program FilesSkypePlugin ManagerskypePM.exe
C:Program FilesCommon FilesRoxio Shared9.0SharedCOMCPSHelpRunner.exe
C:Program FilesTrend MicroHijackThisHijackThis.exe
C:Windowssystem32SearchFilterHost.exe

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.whatwashomepage.com/?q=http: ... ge.com/?q=
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:Program FilesOrangeSearchURLHookSearchPageURL.dll (file missing)
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:PROGRA~1SPYBOT~1SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre6inssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:Program FilesGoogleGoogle_BAEBAE.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program FilesJavajre6injp2ssv.dll
O4 - HKLM..Run: [Windows Defender] %ProgramFiles%Windows DefenderMSASCui.exe -hide
O4 - HKLM..Run: [SynTPEnh] C:Program FilesSynapticsSynTPSynTPEnh.exe
O4 - HKLM..Run: [RoxWatchTray] "C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxWatchTray9.exe"
O4 - HKLM..Run: [Picasa Media Detector] C:Program FilesPicasa2PicasaMediaDetector.exe
O4 - HKLM..Run: [toolbar_eula_launcher] C:Program FilesPackard BellGOOGLE_EULAEULALauncher.exe
O4 - HKLM..Run: [IAAnotif] "C:Program FilesIntelIntel Matrix Storage ManagerIaanotif.exe"
O4 - HKLM..Run: [lxdimon.exe] "C:Program FilesLexmark 3500-4500 Serieslxdimon.exe"
O4 - HKLM..Run: [lxdiamon] "C:Program FilesLexmark 3500-4500 Serieslxdiamon.exe"
O4 - HKLM..Run: [FaxCenterServer] "C:Program Files\Lexmark Fax Solutionsfm3032.exe" /s
O4 - HKLM..Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM..Run: [Symantec PIF AlertEng] "C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe" /a /m "C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}AlertEng.dll"
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre6injusched.exe"
O4 - HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeQTTask.exe" -atboottime
O4 - HKLM..Run: [AppleSyncNotifier] C:Program FilesCommon FilesAppleMobile Device SupportinAppleSyncNotifier.exe
O4 - HKLM..Run: [iTunesHelper] "C:Program FilesiTunesiTunesHelper.exe"
O4 - HKLM..Run: [NvSvc] RUNDLL32.EXE C:Windowssystem32
vsvc.dll,nvsvcStart
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:Windowssystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:Windowssystem32NvMcTray.dll,NvTaskbarInit
O4 - HKCU..Run: [Sidebar] C:Program FilesWindows Sidebarsidebar.exe /autoRun
O4 - HKCU..Run: [SmpcSys] C:Program FilesPackard BellSetUpMyPCSmpSys.exe
O4 - HKCU..Run: [ehTray.exe] C:WindowsehomeehTray.exe
O4 - HKCU..Run: [MsnMsgr] "C:Program FilesWindows LiveMessengerMsnMsgr.Exe" /background
O4 - HKCU..Run: [Skype] "C:Program FilesSkypePhoneSkype.exe" /nosplash /minimized
O4 - HKCU..Run: [TomTomHOME.exe] "C:Program FilesTomTom HOME 2HOMERunner.exe"
O4 - HKCU..Run: [WMPNSCFG] C:Program FilesWindows Media PlayerWMPNSCFG.exe
O4 - HKCU..Run: [SpybotSD TeaTimer] C:Program FilesSpybot - Search & DestroyTeaTimer.exe
O4 - HKCU..Run: [MSServer] rundll32.exe C:UsersJACQUE~1AppDataLocalTempssqPjgDW.dll,#1
O4 - HKCU..Run: [cmds] rundll32.exe C:UsersJACQUE~1AppDataLocalTempddcBQhge.dll,c
O4 - HKUSS-1-5-19..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-19..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-20..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'SERVICE RESEAU')
O4 - Global Startup: Logitech SetPoint.lnk = C:Program FilesLogitechSetPointSetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~3Office12EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~3Office12ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~3Office12ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~3Office12REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:PROGRA~1SPYBOT~1SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:PROGRA~1SPYBOT~1SDHelper.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: http://www.orange.fr
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:Program FilesCommon FilesAppleMobile Device SupportinAppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:Program FilesBonjourmDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:Program FilesCommon FilesSymantec SharedccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe (file missing)
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:Program FilesIntelIntel Matrix Storage ManagerIaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:Program FilesCommon FilesInstallShieldDriver1050Intel 32IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:Program FilesiPodiniPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:Program FilesCommon FilesLogishrdBluetoothLBTServ.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:PROGRA~1SymantecLIVEUP~1LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:Program FilesCommon FilesSymantec SharedccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe
O23 - Service: lxdiCATSCustConnectService - Lexmark International, Inc. - C:Windowssystem32spoolDRIVERSW32X863\lxdiserv.exe
O23 - Service: lxdi_device - - C:Windowssystem32lxdicoms.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:Program FilesCommon FilesSureThing Sharedstllssvr.exe

--
End of file - 10567 bytes

ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo

[panda77]

Salut,

en attendant r@in | b0w

il y a des traces de trojan (sûrement du vundo)

télécharge Malwarebytes
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

installe le en suivant les instructions,accepte la mise à jour de la BDS durant l'installation.

lance Malwarebytes,choisie "exécuter un examen complet" et à la fin du scan , coche tous les éléments trouvés,et on cliques sur" supprimer la sélection".
et enfin poste le rapport...

redémarre ton pc et fait un nouveau scan Hijackthis pour me poster le rapport avec celui de malwarebytes.

@+

[Chrislall]

Merci PANDA 77 pour ton empressement à me dépanner, décidemment sur ce site les gens sont "à l'écoute", je t'envoie donc ce que tu m'as demandé.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:00:10, on 10/01/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:Windowssystem32Dwm.exe
C:WindowsExplorer.EXE
C:Windowssystem32 askeng.exe
C:Program FilesWindows DefenderMSASCui.exe
C:Program FilesSynapticsSynTPSynTPEnh.exe
C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxWatchTray9.exe
C:Program FilesPicasa2PicasaMediaDetector.exe
C:Program FilesIntelIntel Matrix Storage ManagerIAAnotif.exe
C:Program FilesLexmark 3500-4500 Serieslxdimon.exe
C:Program FilesLexmark 3500-4500 Serieslxdiamon.exe
C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe
C:Program FilesAdobeReader 8.0Reader eader_sl.exe
C:Program FilesJavajre6injusched.exe
C:Program FilesAlwil SoftwareAvast4ashDisp.exe
C:Program FilesiTunesiTunesHelper.exe
C:WindowsSystem32 undll32.exe
C:Program FilesWindows Sidebarsidebar.exe
C:Program FilesPackard BellSetUpMyPCSmpSys.exe
C:Windowsehomeehtray.exe
C:Program FilesWindows LiveMessengermsnmsgr.exe
C:Program FilesSkypePhoneSkype.exe
C:Program FilesTomTom HOME 2HOMERunner.exe
C:Program FilesWindows Media Playerwmpnscfg.exe
C:Program FilesSpybot - Search & DestroyTeaTimer.exe
C:Program FilesLogitechSetPointSetPoint.exe
C:WindowsSystem32 undll32.exe
C:Windowsehomeehmsas.exe
C:Program FilesCommon FilesLogishrdKHAL2KHALMNPR.EXE
C:Program FilesCommon FilesRoxio Shared9.0SharedCOMCPSHelpRunner.exe
C:Program FilesSkypePlugin ManagerskypePM.exe
C:Program FilesTrend MicroHijackThisHijackThis.exe

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.whatwashomepage.com/?q=http: ... ge.com/?q=
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:Program FilesOrangeSearchURLHookSearchPageURL.dll (file missing)
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:PROGRA~1SPYBOT~1SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre6inssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:Program FilesGoogleGoogle_BAEBAE.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program FilesJavajre6injp2ssv.dll
O4 - HKLM..Run: [Windows Defender] %ProgramFiles%Windows DefenderMSASCui.exe -hide
O4 - HKLM..Run: [SynTPEnh] C:Program FilesSynapticsSynTPSynTPEnh.exe
O4 - HKLM..Run: [RoxWatchTray] "C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxWatchTray9.exe"
O4 - HKLM..Run: [Picasa Media Detector] C:Program FilesPicasa2PicasaMediaDetector.exe
O4 - HKLM..Run: [toolbar_eula_launcher] C:Program FilesPackard BellGOOGLE_EULAEULALauncher.exe
O4 - HKLM..Run: [IAAnotif] "C:Program FilesIntelIntel Matrix Storage ManagerIaanotif.exe"
O4 - HKLM..Run: [lxdimon.exe] "C:Program FilesLexmark 3500-4500 Serieslxdimon.exe"
O4 - HKLM..Run: [lxdiamon] "C:Program FilesLexmark 3500-4500 Serieslxdiamon.exe"
O4 - HKLM..Run: [FaxCenterServer] "C:Program Files\Lexmark Fax Solutionsfm3032.exe" /s
O4 - HKLM..Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM..Run: [Symantec PIF AlertEng] "C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe" /a /m "C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}AlertEng.dll"
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre6injusched.exe"
O4 - HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeQTTask.exe" -atboottime
O4 - HKLM..Run: [AppleSyncNotifier] C:Program FilesCommon FilesAppleMobile Device SupportinAppleSyncNotifier.exe
O4 - HKLM..Run: [iTunesHelper] "C:Program FilesiTunesiTunesHelper.exe"
O4 - HKLM..Run: [NvSvc] RUNDLL32.EXE C:Windowssystem32
vsvc.dll,nvsvcStart
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:Windowssystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:Windowssystem32NvMcTray.dll,NvTaskbarInit
O4 - HKCU..Run: [Sidebar] C:Program FilesWindows Sidebarsidebar.exe /autoRun
O4 - HKCU..Run: [SmpcSys] C:Program FilesPackard BellSetUpMyPCSmpSys.exe
O4 - HKCU..Run: [ehTray.exe] C:WindowsehomeehTray.exe
O4 - HKCU..Run: [MsnMsgr] "C:Program FilesWindows LiveMessengerMsnMsgr.Exe" /background
O4 - HKCU..Run: [Skype] "C:Program FilesSkypePhoneSkype.exe" /nosplash /minimized
O4 - HKCU..Run: [TomTomHOME.exe] "C:Program FilesTomTom HOME 2HOMERunner.exe"
O4 - HKCU..Run: [WMPNSCFG] C:Program FilesWindows Media PlayerWMPNSCFG.exe
O4 - HKCU..Run: [SpybotSD TeaTimer] C:Program FilesSpybot - Search & DestroyTeaTimer.exe
O4 - HKUSS-1-5-19..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-19..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-20..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'SERVICE RESEAU')
O4 - Global Startup: Logitech SetPoint.lnk = C:Program FilesLogitechSetPointSetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~3Office12EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~3Office12ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~3Office12ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~3Office12REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:PROGRA~1SPYBOT~1SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:PROGRA~1SPYBOT~1SDHelper.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: http://www.orange.fr
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:Program FilesCommon FilesAppleMobile Device SupportinAppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:Program FilesBonjourmDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:Program FilesCommon FilesSymantec SharedccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe (file missing)
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:Program FilesIntelIntel Matrix Storage ManagerIaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:Program FilesCommon FilesInstallShieldDriver1050Intel 32IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:Program FilesiPodiniPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:Program FilesCommon FilesLogishrdBluetoothLBTServ.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:PROGRA~1SymantecLIVEUP~1LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:Program FilesCommon FilesSymantec SharedccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe
O23 - Service: lxdiCATSCustConnectService - Lexmark International, Inc. - C:Windowssystem32spoolDRIVERSW32X863\lxdiserv.exe
O23 - Service: lxdi_device - - C:Windowssystem32lxdicoms.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:Program FilesCommon FilesSureThing Sharedstllssvr.exe

--
End of file - 10394 bytes
))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:00:10, on 10/01/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:Windowssystem32Dwm.exe
C:WindowsExplorer.EXE
C:Windowssystem32 askeng.exe
C:Program FilesWindows DefenderMSASCui.exe
C:Program FilesSynapticsSynTPSynTPEnh.exe
C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxWatchTray9.exe
C:Program FilesPicasa2PicasaMediaDetector.exe
C:Program FilesIntelIntel Matrix Storage ManagerIAAnotif.exe
C:Program FilesLexmark 3500-4500 Serieslxdimon.exe
C:Program FilesLexmark 3500-4500 Serieslxdiamon.exe
C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe
C:Program FilesAdobeReader 8.0Reader eader_sl.exe
C:Program FilesJavajre6injusched.exe
C:Program FilesAlwil SoftwareAvast4ashDisp.exe
C:Program FilesiTunesiTunesHelper.exe
C:WindowsSystem32 undll32.exe
C:Program FilesWindows Sidebarsidebar.exe
C:Program FilesPackard BellSetUpMyPCSmpSys.exe
C:Windowsehomeehtray.exe
C:Program FilesWindows LiveMessengermsnmsgr.exe
C:Program FilesSkypePhoneSkype.exe
C:Program FilesTomTom HOME 2HOMERunner.exe
C:Program FilesWindows Media Playerwmpnscfg.exe
C:Program FilesSpybot - Search & DestroyTeaTimer.exe
C:Program FilesLogitechSetPointSetPoint.exe
C:WindowsSystem32 undll32.exe
C:Windowsehomeehmsas.exe
C:Program FilesCommon FilesLogishrdKHAL2KHALMNPR.EXE
C:Program FilesCommon FilesRoxio Shared9.0SharedCOMCPSHelpRunner.exe
C:Program FilesSkypePlugin ManagerskypePM.exe
C:Program FilesTrend MicroHijackThisHijackThis.exe

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.whatwashomepage.com/?q=http: ... ge.com/?q=
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:Program FilesOrangeSearchURLHookSearchPageURL.dll (file missing)
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:PROGRA~1SPYBOT~1SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre6inssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:Program FilesGoogleGoogle_BAEBAE.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program FilesJavajre6injp2ssv.dll
O4 - HKLM..Run: [Windows Defender] %ProgramFiles%Windows DefenderMSASCui.exe -hide
O4 - HKLM..Run: [SynTPEnh] C:Program FilesSynapticsSynTPSynTPEnh.exe
O4 - HKLM..Run: [RoxWatchTray] "C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxWatchTray9.exe"
O4 - HKLM..Run: [Picasa Media Detector] C:Program FilesPicasa2PicasaMediaDetector.exe
O4 - HKLM..Run: [toolbar_eula_launcher] C:Program FilesPackard BellGOOGLE_EULAEULALauncher.exe
O4 - HKLM..Run: [IAAnotif] "C:Program FilesIntelIntel Matrix Storage ManagerIaanotif.exe"
O4 - HKLM..Run: [lxdimon.exe] "C:Program FilesLexmark 3500-4500 Serieslxdimon.exe"
O4 - HKLM..Run: [lxdiamon] "C:Program FilesLexmark 3500-4500 Serieslxdiamon.exe"
O4 - HKLM..Run: [FaxCenterServer] "C:Program Files\Lexmark Fax Solutionsfm3032.exe" /s
O4 - HKLM..Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM..Run: [Symantec PIF AlertEng] "C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe" /a /m "C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}AlertEng.dll"
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre6injusched.exe"
O4 - HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeQTTask.exe" -atboottime
O4 - HKLM..Run: [AppleSyncNotifier] C:Program FilesCommon FilesAppleMobile Device SupportinAppleSyncNotifier.exe
O4 - HKLM..Run: [iTunesHelper] "C:Program FilesiTunesiTunesHelper.exe"
O4 - HKLM..Run: [NvSvc] RUNDLL32.EXE C:Windowssystem32
vsvc.dll,nvsvcStart
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:Windowssystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:Windowssystem32NvMcTray.dll,NvTaskbarInit
O4 - HKCU..Run: [Sidebar] C:Program FilesWindows Sidebarsidebar.exe /autoRun
O4 - HKCU..Run: [SmpcSys] C:Program FilesPackard BellSetUpMyPCSmpSys.exe
O4 - HKCU..Run: [ehTray.exe] C:WindowsehomeehTray.exe
O4 - HKCU..Run: [MsnMsgr] "C:Program FilesWindows LiveMessengerMsnMsgr.Exe" /background
O4 - HKCU..Run: [Skype] "C:Program FilesSkypePhoneSkype.exe" /nosplash /minimized
O4 - HKCU..Run: [TomTomHOME.exe] "C:Program FilesTomTom HOME 2HOMERunner.exe"
O4 - HKCU..Run: [WMPNSCFG] C:Program FilesWindows Media PlayerWMPNSCFG.exe
O4 - HKCU..Run: [SpybotSD TeaTimer] C:Program FilesSpybot - Search & DestroyTeaTimer.exe
O4 - HKUSS-1-5-19..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-19..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-20..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'SERVICE RESEAU')
O4 - Global Startup: Logitech SetPoint.lnk = C:Program FilesLogitechSetPointSetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~3Office12EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~3Office12ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~3Office12ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~3Office12REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:PROGRA~1SPYBOT~1SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:PROGRA~1SPYBOT~1SDHelper.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: http://www.orange.fr
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:Program FilesCommon FilesAppleMobile Device SupportinAppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:Program FilesBonjourmDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:Program FilesCommon FilesSymantec SharedccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe (file missing)
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:Program FilesIntelIntel Matrix Storage ManagerIaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:Program FilesCommon FilesInstallShieldDriver1050Intel 32IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:Program FilesiPodiniPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:Program FilesCommon FilesLogishrdBluetoothLBTServ.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:PROGRA~1SymantecLIVEUP~1LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:Program FilesCommon FilesSymantec SharedccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe
O23 - Service: lxdiCATSCustConnectService - Lexmark International, Inc. - C:Windowssystem32spoolDRIVERSW32X863\lxdiserv.exe
O23 - Service: lxdi_device - - C:Windowssystem32lxdicoms.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:Program FilesCommon FilesSureThing Sharedstllssvr.exe

--
End of file - 10394 bytes
Voilà, voilà. Au plaisir de te lire... Tu penses !!!!
Cordialement

[panda77]

salut Chritall

j'aurais aimer avoir le rapport Malwarebytes,pour voir quel types d'infections tu as.
pour retrouver le rapport:
1.ouvre Malwarebytes
2.clique sur l'onglet "Rapports/Logs"
3.fait un clic sur le rapport désiré et choisie "ouvrir"(en bas à gauche).
4.puis fait un copier coller du rapport texte qui s'ouvre.

@+

[r@in | b0w]

Bonjour.


_ Via HiJackThis, tu supprimes les lignes:

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.whatwashomepage.com/?q=http: ... tp://www.w hatwashomepage.com/?q=http://www.whatwashomepage.com/?q=http://www.whatwashomepa ge.com/?q=
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:Program FilesGoogleGoogle_BAEBAE.dll (file missing)
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeQTTask.exe" -atboottime
O4 - HKLM..Run: [iTunesHelper] "C:Program FilesiTunesiTunesHelper.exe"
O4 - HKCU..Run: [MsnMsgr] "C:Program FilesWindows LiveMessengerMsnMsgr.Exe" /background


_ Tu as des traces de Norton antivirus, s'il était préinstallé sur ta machine et que tu l'as remplacé par Avast comme je le vois, tu vas ici pour récupérer le désinstallateur Norton.

Tu le lances ensuite pour qu'il supprime tout.


_ Où est le rapport Mbam?

[Chrislall]

Bonjour
Ravi de te retrouver, voilà les rapports demandés.

Malwarebytes' Anti-Malware 1.32
Version de la base de données: 1638
Windows 6.0.6001 Service Pack 1

11/01/2009 13:21:28
mbam-log-2009-01-11 (13-21-28).txt

Type de recherche: Examen complet (C:|D:|E:|)
Eléments examinés: 120537
Temps écoulé: 57 minute(s), 33 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)


)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:00:10, on 10/01/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:Windowssystem32Dwm.exe
C:WindowsExplorer.EXE
C:Windowssystem32 askeng.exe
C:Program FilesWindows DefenderMSASCui.exe
C:Program FilesSynapticsSynTPSynTPEnh.exe
C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxWatchTray9.exe
C:Program FilesPicasa2PicasaMediaDetector.exe
C:Program FilesIntelIntel Matrix Storage ManagerIAAnotif.exe
C:Program FilesLexmark 3500-4500 Serieslxdimon.exe
C:Program FilesLexmark 3500-4500 Serieslxdiamon.exe
C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe
C:Program FilesAdobeReader 8.0Reader eader_sl.exe
C:Program FilesJavajre6injusched.exe
C:Program FilesAlwil SoftwareAvast4ashDisp.exe
C:Program FilesiTunesiTunesHelper.exe
C:WindowsSystem32 undll32.exe
C:Program FilesWindows Sidebarsidebar.exe
C:Program FilesPackard BellSetUpMyPCSmpSys.exe
C:Windowsehomeehtray.exe
C:Program FilesWindows LiveMessengermsnmsgr.exe
C:Program FilesSkypePhoneSkype.exe
C:Program FilesTomTom HOME 2HOMERunner.exe
C:Program FilesWindows Media Playerwmpnscfg.exe
C:Program FilesSpybot - Search & DestroyTeaTimer.exe
C:Program FilesLogitechSetPointSetPoint.exe
C:WindowsSystem32 undll32.exe
C:Windowsehomeehmsas.exe
C:Program FilesCommon FilesLogishrdKHAL2KHALMNPR.EXE
C:Program FilesCommon FilesRoxio Shared9.0SharedCOMCPSHelpRunner.exe
C:Program FilesSkypePlugin ManagerskypePM.exe
C:Program FilesTrend MicroHijackThisHijackThis.exe

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.whatwashomepage.com/?q=http: ... ge.com/?q=
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:Program FilesOrangeSearchURLHookSearchPageURL.dll (file missing)
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:PROGRA~1SPYBOT~1SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre6inssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:Program FilesGoogleGoogle_BAEBAE.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program FilesJavajre6injp2ssv.dll
O4 - HKLM..Run: [Windows Defender] %ProgramFiles%Windows DefenderMSASCui.exe -hide
O4 - HKLM..Run: [SynTPEnh] C:Program FilesSynapticsSynTPSynTPEnh.exe
O4 - HKLM..Run: [RoxWatchTray] "C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxWatchTray9.exe"
O4 - HKLM..Run: [Picasa Media Detector] C:Program FilesPicasa2PicasaMediaDetector.exe
O4 - HKLM..Run: [toolbar_eula_launcher] C:Program FilesPackard BellGOOGLE_EULAEULALauncher.exe
O4 - HKLM..Run: [IAAnotif] "C:Program FilesIntelIntel Matrix Storage ManagerIaanotif.exe"
O4 - HKLM..Run: [lxdimon.exe] "C:Program FilesLexmark 3500-4500 Serieslxdimon.exe"
O4 - HKLM..Run: [lxdiamon] "C:Program FilesLexmark 3500-4500 Serieslxdiamon.exe"
O4 - HKLM..Run: [FaxCenterServer] "C:Program Files\Lexmark Fax Solutionsfm3032.exe" /s
O4 - HKLM..Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM..Run: [Symantec PIF AlertEng] "C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe" /a /m "C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}AlertEng.dll"
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre6injusched.exe"
O4 - HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeQTTask.exe" -atboottime
O4 - HKLM..Run: [AppleSyncNotifier] C:Program FilesCommon FilesAppleMobile Device SupportinAppleSyncNotifier.exe
O4 - HKLM..Run: [iTunesHelper] "C:Program FilesiTunesiTunesHelper.exe"
O4 - HKLM..Run: [NvSvc] RUNDLL32.EXE C:Windowssystem32
vsvc.dll,nvsvcStart
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:Windowssystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:Windowssystem32NvMcTray.dll,NvTaskbarInit
O4 - HKCU..Run: [Sidebar] C:Program FilesWindows Sidebarsidebar.exe /autoRun
O4 - HKCU..Run: [SmpcSys] C:Program FilesPackard BellSetUpMyPCSmpSys.exe
O4 - HKCU..Run: [ehTray.exe] C:WindowsehomeehTray.exe
O4 - HKCU..Run: [MsnMsgr] "C:Program FilesWindows LiveMessengerMsnMsgr.Exe" /background
O4 - HKCU..Run: [Skype] "C:Program FilesSkypePhoneSkype.exe" /nosplash /minimized
O4 - HKCU..Run: [TomTomHOME.exe] "C:Program FilesTomTom HOME 2HOMERunner.exe"
O4 - HKCU..Run: [WMPNSCFG] C:Program FilesWindows Media PlayerWMPNSCFG.exe
O4 - HKCU..Run: [SpybotSD TeaTimer] C:Program FilesSpybot - Search & DestroyTeaTimer.exe
O4 - HKUSS-1-5-19..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-19..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-20..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'SERVICE RESEAU')
O4 - Global Startup: Logitech SetPoint.lnk = C:Program FilesLogitechSetPointSetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~3Office12EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~3Office12ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~3Office12ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~3Office12REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:PROGRA~1SPYBOT~1SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:PROGRA~1SPYBOT~1SDHelper.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: http://www.orange.fr
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:Program FilesCommon FilesAppleMobile Device SupportinAppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:Program FilesBonjourmDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:Program FilesCommon FilesSymantec SharedccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe (file missing)
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:Program FilesIntelIntel Matrix Storage ManagerIaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:Program FilesCommon FilesInstallShieldDriver1050Intel 32IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:Program FilesiPodiniPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:Program FilesCommon FilesLogishrdBluetoothLBTServ.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:PROGRA~1SymantecLIVEUP~1LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:Program FilesCommon FilesSymantec SharedccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe
O23 - Service: lxdiCATSCustConnectService - Lexmark International, Inc. - C:Windowssystem32spoolDRIVERSW32X863\lxdiserv.exe
O23 - Service: lxdi_device - - C:Windowssystem32lxdicoms.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:Program FilesCommon FilesSureThing Sharedstllssvr.exe

--
End of file - 10394 bytes

[r@in | b0w]

Tu n'as pas fait ceci:

_ Via HiJackThis, tu supprimes les lignes:

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.whatwashomepage.com/?q=http: ... tp://www.w hatwashomepage.com/?q=http://www.whatwashomepage.com/?q=http://www.whatwashomepa ge.com/?q=
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:Program FilesGoogleGoogle_BAEBAE.dll (file missing)
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeQTTask.exe" -atboottime
O4 - HKLM..Run: [iTunesHelper] "C:Program FilesiTunesiTunesHelper.exe"
O4 - HKCU..Run: [MsnMsgr] "C:Program FilesWindows LiveMessengerMsnMsgr.Exe" /background


_ Tu as des traces de Norton antivirus, s'il était préinstallé sur ta machine et que tu l'as remplacé par Avast comme je le vois, tu vas ici pour récupérer le désinstallateur Norton.

[Chrislall]

J'avais bien fait ce que tu avais demandé y compris la désinstall de Norton... J'ai du me tromper de rapport


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:57:33, on 11/01/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:Windowssystem32Dwm.exe
C:WindowsExplorer.EXE
C:Program FilesWindows DefenderMSASCui.exe
C:Windowssystem32 askeng.exe
C:Program FilesSynapticsSynTPSynTPEnh.exe
C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxWatchTray9.exe
C:Program FilesPicasa2PicasaMediaDetector.exe
C:Program FilesIntelIntel Matrix Storage ManagerIAAnotif.exe
C:Program FilesLexmark 3500-4500 Serieslxdimon.exe
C:Program FilesLexmark 3500-4500 Serieslxdiamon.exe
C:Program FilesJavajre6injusched.exe
C:Program FilesAlwil SoftwareAvast4ashDisp.exe
C:WindowsSystem32 undll32.exe
C:Program FilesWindows Sidebarsidebar.exe
C:Program FilesPackard BellSetUpMyPCSmpSys.exe
C:Windowsehomeehtray.exe
C:Program FilesSkypePhoneSkype.exe
C:Program FilesTomTom HOME 2HOMERunner.exe
C:Program FilesWindows Media Playerwmpnscfg.exe
C:Program FilesSpybot - Search & DestroyTeaTimer.exe
C:Program FilesLogitechSetPointSetPoint.exe
C:WindowsSystem32 undll32.exe
C:Windowsehomeehmsas.exe
C:Program FilesCommon FilesLogishrdKHAL2KHALMNPR.EXE
C:Program FilesCommon FilesRoxio Shared9.0SharedCOMCPSHelpRunner.exe
C:Program FilesSkypePlugin ManagerskypePM.exe
C:Program FilesMalwarebytes' Anti-Malwarembam.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesTrend MicroHijackThisHijackThis.exe
C:Windowssystem32SearchFilterHost.exe

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:Program FilesOrangeSearchURLHookSearchPageURL.dll (file missing)
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:PROGRA~1SPYBOT~1SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre6inssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program FilesJavajre6injp2ssv.dll
O4 - HKLM..Run: [Windows Defender] %ProgramFiles%Windows DefenderMSASCui.exe -hide
O4 - HKLM..Run: [SynTPEnh] C:Program FilesSynapticsSynTPSynTPEnh.exe
O4 - HKLM..Run: [RoxWatchTray] "C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxWatchTray9.exe"
O4 - HKLM..Run: [Picasa Media Detector] C:Program FilesPicasa2PicasaMediaDetector.exe
O4 - HKLM..Run: [toolbar_eula_launcher] C:Program FilesPackard BellGOOGLE_EULAEULALauncher.exe
O4 - HKLM..Run: [IAAnotif] "C:Program FilesIntelIntel Matrix Storage ManagerIaanotif.exe"
O4 - HKLM..Run: [lxdimon.exe] "C:Program FilesLexmark 3500-4500 Serieslxdimon.exe"
O4 - HKLM..Run: [lxdiamon] "C:Program FilesLexmark 3500-4500 Serieslxdiamon.exe"
O4 - HKLM..Run: [FaxCenterServer] "C:Program Files\Lexmark Fax Solutionsfm3032.exe" /s
O4 - HKLM..Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre6injusched.exe"
O4 - HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 - HKLM..Run: [AppleSyncNotifier] C:Program FilesCommon FilesAppleMobile Device SupportinAppleSyncNotifier.exe
O4 - HKLM..Run: [NvSvc] RUNDLL32.EXE C:Windowssystem32
vsvc.dll,nvsvcStart
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:Windowssystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:Windowssystem32NvMcTray.dll,NvTaskbarInit
O4 - HKCU..Run: [Sidebar] C:Program FilesWindows Sidebarsidebar.exe /autoRun
O4 - HKCU..Run: [SmpcSys] C:Program FilesPackard BellSetUpMyPCSmpSys.exe
O4 - HKCU..Run: [ehTray.exe] C:WindowsehomeehTray.exe
O4 - HKCU..Run: [Skype] "C:Program FilesSkypePhoneSkype.exe" /nosplash /minimized
O4 - HKCU..Run: [TomTomHOME.exe] "C:Program FilesTomTom HOME 2HOMERunner.exe"
O4 - HKCU..Run: [WMPNSCFG] C:Program FilesWindows Media PlayerWMPNSCFG.exe
O4 - HKCU..Run: [SpybotSD TeaTimer] C:Program FilesSpybot - Search & DestroyTeaTimer.exe
O4 - HKUSS-1-5-19..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-19..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-20..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'SERVICE RESEAU')
O4 - Global Startup: Logitech SetPoint.lnk = C:Program FilesLogitechSetPointSetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~3Office12EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~3Office12ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~3Office12ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~3Office12REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:PROGRA~1SPYBOT~1SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:PROGRA~1SPYBOT~1SDHelper.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: http://www.orange.fr
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:Program FilesCommon FilesAppleMobile Device SupportinAppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:Program FilesBonjourmDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe (file missing)
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:Program FilesIntelIntel Matrix Storage ManagerIaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:Program FilesCommon FilesInstallShieldDriver1050Intel 32IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:Program FilesiPodiniPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:Program FilesCommon FilesLogishrdBluetoothLBTServ.exe
O23 - Service: lxdiCATSCustConnectService - Lexmark International, Inc. - C:Windowssystem32spoolDRIVERSW32X863\lxdiserv.exe
O23 - Service: lxdi_device - - C:Windowssystem32lxdicoms.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:Program FilesCommon FilesSureThing Sharedstllssvr.exe

--
End of file - 8701 bytes

[r@in | b0w]

J'ai du me tromper de rapport

En effet. Et je n'ai pas eu la présence d'esprit de regarder l'heure du rapport mais pas de soucis

Tu peux enlever aussi O4 - HKCU..Run: [WMPNSCFG] C:Program FilesWindows Media PlayerWMPNSCFG.exe.

Sinon, pour les fichiers précédemment trouvés et à risque, pour s'assurer que tout est bien, tu fais la suite.

Tu télécharges ComboFix.

Il faut désactiver l'UAC avant d'utiliser ComboFix.

Pour cela, il faut cliquer sur Démarrer puis Panneau de configuration.

Tu cliques ensuite sur Comptes d'utilisateurs puis sur Activer ou désactiver le contrôle des comptes d'utilisateurs.

Une fenêtre de confirmation s'ouvrira, décoches la ligne Utiliser le contrôle des comptes d'utilisateurs pour vous aider à protéger votre ordinateur puis cliques sur Ok.

Le redémarrage demandé sera nécessaire pour que l'UAC soit inactive.

Avant de lancer ComboFix, tu dois désactiver ta connexion Internet, ton antivirus, ton anti-spyware & ton pare-feu car ils peuvent bloquer l'exécution de l'utilitaire (faux-positifs).
Tu les réactiveras après l'utilisation de ComboFix.
Tu fermes toutes les fenêtres ouverte.

Tu lances ensuite l'utilitaire en double cliquant dessus, tu confirmes l'ouverture en cliquant sur Exécuter.

A la fenêtre Disclaimer, tu tapes sur [1].

L'analyse se lancera par la suite avec création d'un point de restauration et sauvegarde des fichiers Windows.
Patientes, ComboFix nettoie en 41 étapes.

Tu ne t'inquiètes pas, il se charge de tout.
Laisse-le faire et suis bien les instructions à l'écran, il est possible qu'il te demande de redémarrer.

Pendant son nettoyage, le Bureau peut disparaA®tre à plusieurs reprises. Tout redeviendra normal par la suite.

Surtout, tant que tu n'as pas un message de ComboFix t'informant que le ménage est terminé, tu ne fais rien de plus que ce que l'utilitaire t'indique, c'est important car il peut être long mais travaille efficacement.

Quand tout sera fini, tu liras:

Code: Tout sélectionner

Almost done... This window will close in a short while
Please wait a few seconds for the report log to pop up

ComboFix's log shall be located at C:ComboFix.txt

Normalement, le rapport s'ouvrira dans le Bloc-notes, tu nous copies-colles l'intégralité du fichier.
Si le Bloc-notes ne s'ouvre pas, tu iras chercher le rapport ici: C:ComboFix.txt et tu nous le colles dans ton prochain message.

[Chrislall]

J'ai fait Combofix mais ses reactions ne sont pas celles que tu m'as expliqué. Voilà ce que j'ai à la fin :
ComboFix 09-01-10.03 - Jacques et Patricia 2009-01-11 17:23:04.2 - NTFSx86
Microsoft® Windows Vista™ Edition Familiale Premium 6.0.6001.1.1252.1.1036.18.2038.1136 [GMT 1:00]
Lancé depuis: c:usersJacques et PatriciaDownloadsComboFix.exe
.

((((((((((((((((((((((((((((( Fichiers créés du 2008-12-11 au 2009-01-11 ))))))))))))))))))))))))))))))))))))
.

2009-01-11 12:01 . 2009-01-11 12:01 <REP> d-------- c:usersAll UsersNortonInstaller
2009-01-11 12:01 . 2009-01-11 12:01 <REP> d-------- c:programdataNortonInstaller
2009-01-10 18:24 . 2009-01-10 18:24 <REP> d-------- c:usersJacques et PatriciaAppDataRoamingMalwarebytes
2009-01-10 18:24 . 2009-01-10 18:24 <REP> d-------- c:usersAll UsersMalwarebytes
2009-01-10 18:24 . 2009-01-10 18:24 <REP> d-------- c:programdataMalwarebytes
2009-01-10 18:24 . 2009-01-10 18:25 <REP> d-------- c:program filesMalwarebytes' Anti-Malware
2009-01-10 18:24 . 2009-01-04 18:38 38,496 --a------ c:windowsSystem32driversmbamswissarmy.sys
2009-01-10 18:24 . 2009-01-04 18:38 15,504 --a------ c:windowsSystem32driversmbam.sys
2009-01-10 16:15 . 2009-01-10 16:15 <REP> d-------- c:program filesTrend Micro
2009-01-10 15:46 . 2009-01-10 15:46 0 --ah----- c:windowsSystem32driversMsft_User_WpdFs_01_00_00.Wdf
2008-12-31 19:13 . 2009-01-05 19:29 <REP> d-------- c:usersAll UsersSpybot - Search & Destroy
2008-12-31 19:13 . 2009-01-05 19:29 <REP> d-------- c:programdataSpybot - Search & Destroy
2008-12-31 19:13 . 2009-01-05 18:15 <REP> d-------- c:program filesSpybot - Search & Destroy
2008-12-31 14:41 . 2008-04-26 09:26 891,448 --a------ c:windowsSystem32drivers cpip.sys
2008-12-31 14:41 . 2008-04-12 04:32 784,896 --a------ c:windowsSystem32 pcrt4.dll
2008-12-31 14:41 . 2008-08-02 02:01 625,152 --a------ c:windowsSystem32driversdxgkrnl.sys
2008-12-31 14:41 . 2008-06-26 04:29 565,248 --a------ c:windowsSystem32emdmgmt.dll
2008-12-31 14:41 . 2008-05-20 03:07 148,480 --a------ c:windowsSystem32drivers
wifi.sys
2008-12-31 14:41 . 2008-09-18 05:56 147,456 --a------ c:windowsSystem32Faultrep.dll
2008-12-31 14:41 . 2008-09-18 05:56 125,952 --a------ c:windowsSystem32wersvc.dll
2008-12-31 14:41 . 2008-04-05 02:21 72,192 --a------ c:windowsSystem32driverspacer.sys
2008-12-31 14:41 . 2008-06-26 04:29 45,056 --a------ c:windowsSystem32dataclen.dll
2008-12-31 14:41 . 2008-08-02 04:26 36,864 --a------ c:windowsSystem32cdd.dll
2008-12-31 14:41 . 2008-04-05 04:34 15,360 --a------ c:windowsSystem32pacerprf.dll
2008-12-31 14:38 . 2008-05-08 22:59 430,080 --a------ c:windowsSystem32vbscript.dll
2008-12-31 14:38 . 2008-05-08 22:59 180,224 --a------ c:windowsSystem32scrobj.dll
2008-12-31 14:38 . 2008-05-08 22:59 172,032 --a------ c:windowsSystem32scrrun.dll
2008-12-31 14:38 . 2008-05-08 22:59 155,648 --a------ c:windowsSystem32wscript.exe
2008-12-31 14:38 . 2008-05-08 22:58 135,168 --a------ c:windowsSystem32wshom.ocx
2008-12-31 14:38 . 2008-05-08 22:58 135,168 --a------ c:windowsSystem32cscript.exe
2008-12-31 14:38 . 2008-05-08 22:59 90,112 --a------ c:windowsSystem32wshext.dll
2008-12-30 20:11 . 2008-12-30 20:11 <REP> d-------- C:PerfLogs
2008-12-21 08:55 . 2008-12-21 08:54 410,984 --a------ c:windowsSystem32deploytk.dll
2008-12-19 11:58 . 2008-12-19 11:58 <REP> d-------- c:program filesBonjour
2008-12-19 11:57 . 2008-12-19 11:57 <REP> d----c--- c:windowsSystem32DRVSTORE
2008-12-19 11:57 . 2008-04-17 13:12 107,368 --a------ c:windowsSystem32GEARAspi.dll
2008-12-19 11:57 . 2008-04-17 13:12 15,464 --a------ c:windowsSystem32driversGEARAspiWDM.sys
2008-12-19 11:56 . 2008-12-19 11:57 <REP> d-------- c:usersAll Users{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-19 11:56 . 2008-12-19 11:57 <REP> d-------- c:programdata{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-19 11:56 . 2008-12-19 11:57 <REP> d-------- c:program filesiTunes
2008-12-19 11:56 . 2008-12-19 11:56 <REP> d-------- c:program filesiPod
2008-12-19 11:51 . 2008-12-19 11:51 <REP> d-------- c:program filesQuickTime
2008-12-19 11:40 . 2008-12-19 11:40 <REP> d-------- c:program filesSafari
2008-12-12 11:18 . 2008-12-12 11:18 87,336 --a------ c:windowsSystem32dns-sd.exe
2008-12-12 11:11 . 2008-12-12 11:11 61,440 --a------ c:windowsSystem32dnssd.dll
2008-12-12 08:42 . 2008-10-22 02:22 2,048 --a------ c:windowsSystem32 zres.dll
2008-12-11 18:48 . 2008-06-23 02:59 2,868,736 --a------ c:windowsSystem32mf.dll
2008-12-11 18:48 . 2008-06-23 02:59 996,352 --a------ c:windowsSystem32WMNetMgr.dll
2008-12-11 18:48 . 2008-01-19 08:34 98,816 --a------ c:windowsSystem32mfps.dll
2008-12-11 18:48 . 2008-06-23 02:58 94,720 --a------ c:windowsSystem32logagent.exe
2008-12-11 18:48 . 2008-01-19 08:33 53,248 --a------ c:windowsSystem32 rinstaller.exe
2008-12-11 18:48 . 2008-01-19 08:33 24,576 --a------ c:windowsSystem32mfpmp.exe
2008-12-11 18:46 . 2008-11-01 02:21 4,240,384 --a------ c:windowsSystem32GameUXLegacyGDFs.dll
2008-12-11 18:46 . 2008-11-01 04:44 28,672 --a------ c:windowsSystem32Apphlpdm.dll
2008-12-11 18:45 . 2008-10-16 05:47 827,392 --a------ c:windowsSystem32wininet.dll
2008-12-11 18:34 . 2008-10-21 06:25 296,960 --a------ c:windowsSystem32gdi32.dll
2008-12-11 18:25 . 2008-10-29 07:29 2,927,104 --a------ c:windowsexplorer.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-11 13:52 --------- d-----w c:programdataNVIDIA
2009-01-11 11:03 --------- d-----w c:program filesCommon FilesSymantec Shared
2009-01-05 18:13 --------- d-----w c:program filesNorton 360
2009-01-04 16:05 --------- d-----w c:programdataLx_cats
2008-12-30 19:23 174 --sha-w c:program filesdesktop.ini
2008-12-30 19:12 --------- d-----w c:program filesWindows Sidebar
2008-12-30 19:12 --------- d-----w c:program filesWindows Photo Gallery
2008-12-30 19:12 --------- d-----w c:program filesWindows Mail
2008-12-30 19:12 --------- d-----w c:program filesWindows Journal
2008-12-30 19:12 --------- d-----w c:program filesWindows Defender
2008-12-30 19:12 --------- d-----w c:program filesWindows Collaboration
2008-12-30 19:12 --------- d-----w c:program filesWindows Calendar
2008-12-30 18:21 82,432 ----a-w c:windowsSystem32axaltocm.dll
2008-12-30 18:21 101,888 ----a-w c:windowsSystem32ifxcardm.dll
2008-12-30 14:03 28,665 ----a-w c:usersJacques et PatriciaAppDataRoaming
vModes.dat
2008-12-21 07:54 --------- d-----w c:program filesJava
2008-12-20 17:52 --------- d-----w c:usersJacques et PatriciaAppDataRoamingApple Computer
2008-12-19 10:56 --------- d-----w c:program filesCommon FilesApple
2008-12-12 07:49 --------- d-----w c:programdataMicrosoft Help
2008-12-07 15:05 --------- d-----w c:program filesAlwil Software
2008-11-26 17:17 51,792 ----a-w c:windowssystem32driversaswMonFlt.sys
2008-11-01 03:44 541,696 ----a-w c:windowsAppPatchAcLayers.dll
2008-11-01 03:44 52,736 ----a-w c:windowsAppPatchiebrshim.dll
2008-11-01 03:44 460,288 ----a-w c:windowsAppPatchAcSpecfc.dll
2008-11-01 03:44 2,154,496 ----a-w c:windowsAppPatchAcGenral.dll
2008-11-01 03:44 173,056 ----a-w c:windowsAppPatchAcXtrnal.dll
2008-10-22 03:57 241,152 ----a-w c:windowsSystem32PortableDeviceApi.dll
2008-10-21 05:25 1,645,568 ----a-w c:windowsSystem32connect.dll
2008-10-16 21:13 1,809,944 ----a-w c:windowsSystem32wuaueng.dll
2008-10-16 21:12 561,688 ----a-w c:windowsSystem32wuapi.dll
2008-10-16 21:09 51,224 ----a-w c:windowsSystem32wuauclt.exe
2008-10-16 21:09 43,544 ----a-w c:windowsSystem32wups2.dll
2008-10-16 21:08 34,328 ----a-w c:windowsSystem32wups.dll
2008-10-16 20:56 1,524,736 ----a-w c:windowsSystem32wucltux.dll
2008-10-16 20:55 83,456 ----a-w c:windowsSystem32wudriver.dll
2008-10-16 13:08 162,064 ----a-w c:windowsSystem32wuwebv.dll
2008-10-16 12:56 31,232 ----a-w c:windowsSystem32wuapp.exe
2008-01-01 20:14 0 ----a-w c:usersJacques et PatriciaAppDataRoamingwklnhst.dat
2006-03-12 23:33 65,536 --sha-w c:windowsoemmpootootstat.dat
2007-12-29 10:00 32,768 --sha-w c:windowsSystem32configsystemprofileAppDataLocalMicrosoftWindowsHistoryHistory.IE5MSHist012007122920071230index.dat
.

((((((((((((((((((((((((((((( snapshot@2009-01-11_17.13.47.87 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-01-11 16:09:33 262,144 --sha-w c:windowsServiceProfilesNetworkServiceNTUSER.DAT
+ 2009-01-11 16:13:19 262,144 --sha-w c:windowsServiceProfilesNetworkServiceNTUSER.DAT
+ 2009-01-11 16:13:19 262,144 ---ha-w c:windowsServiceProfilesNetworkService
tuser.dat.LOG1
- 2009-01-11 16:01:10 104,940 ----a-w c:windowsSystem32perfc009.dat
+ 2009-01-11 16:14:08 104,940 ----a-w c:windowsSystem32perfc009.dat
- 2009-01-11 16:01:10 128,004 ----a-w c:windowsSystem32perfc00C.dat
+ 2009-01-11 16:14:08 128,004 ----a-w c:windowsSystem32perfc00C.dat
- 2009-01-11 16:01:10 595,506 ----a-w c:windowsSystem32perfh009.dat
+ 2009-01-11 16:14:08 595,506 ----a-w c:windowsSystem32perfh009.dat
- 2009-01-11 16:01:10 678,956 ----a-w c:windowsSystem32perfh00C.dat
+ 2009-01-11 16:14:08 678,956 ----a-w c:windowsSystem32perfh00C.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
"Sidebar"="c:program filesWindows Sidebarsidebar.exe" [2008-01-19 1233920]
"SmpcSys"="c:program filesPackard BellSetUpMyPCSmpSys.exe" [2007-07-19 1120568]
"ehTray.exe"="c:windowsehomeehTray.exe" [2008-01-19 125952]
"Skype"="c:program filesSkypePhoneSkype.exe" [2007-06-08 23299112]
"TomTomHOME.exe"="c:program filesTomTom HOME 2HOMERunner.exe" [2008-05-06 202088]
"SpybotSD TeaTimer"="c:program filesSpybot - Search & DestroyTeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"SynTPEnh"="c:program filesSynapticsSynTPSynTPEnh.exe" [2007-04-20 861744]
"RoxWatchTray"="c:program filesCommon FilesRoxio Shared9.0SharedCOMRoxWatchTray9.exe" [2007-01-11 232184]
"Picasa Media Detector"="c:program filesPicasa2PicasaMediaDetector.exe" [2007-02-21 366400]
"toolbar_eula_launcher"="c:program filesPackard BellGOOGLE_EULAEULALauncher.exe" [2007-02-20 28672]
"IAAnotif"="c:program filesIntelIntel Matrix Storage ManagerIaanotif.exe" [2007-03-21 174872]
"lxdimon.exe"="c:program filesLexmark 3500-4500 Serieslxdimon.exe" [2007-07-16 434864]
"lxdiamon"="c:program filesLexmark 3500-4500 Serieslxdiamon.exe" [2007-07-16 25264]
"FaxCenterServer"="c:program files\Lexmark Fax Solutionsfm3032.exe" [2007-07-16 311984]
"SunJavaUpdateSched"="c:program filesJavajre6injusched.exe" [2008-12-21 136600]
"avast!"="c:progra~1ALWILS~1Avast4ashDisp.exe" [2008-11-26 81000]
"AppleSyncNotifier"="c:program filesCommon FilesAppleMobile Device SupportinAppleSyncNotifier.exe" [2008-11-07 111936]
"NvSvc"="c:windowssystem32
vsvc.dll" [2007-08-16 86016]
"NvCplDaemon"="c:windowssystem32NvCpl.dll" [2007-08-16 8478720]
"NvMediaCenter"="c:windowssystem32NvMcTray.dll" [2007-08-16 81920]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:windowsKHALMNPR.Exe]

c:programdataMicrosoftWindowsStart MenuProgramsStartup
Logitech SetPoint.lnk - c:program filesLogitechSetPointSetPoint.exe [2008-07-18 805392]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringSymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringSymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicyFirewallRules]
"{0D273786-1B5C-4743-AA43-020488E0E5A4}"= UDP:c:program filesMicrosoft OfficeOffice12ONENOTE.EXE:Microsoft Office OneNote
"{E82C082D-1751-4BDC-85B0-E01C6A4BD957}"= TCP:c:program filesMicrosoft OfficeOffice12ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{87630C16-9D72-4459-A560-89F112CA2E15}c:\program files\skype\phone\skype.exe"= UDP:c:program filesskypephoneskype.exe:Packard Bell - Skype
"UDP Query User{95B64067-20C8-455F-8317-D83BAA139229}c:\program files\skype\phone\skype.exe"= TCP:c:program filesskypephoneskype.exe:Packard Bell - Skype
"{CC750700-559B-4CD8-9311-6BDC2EAA1371}"= UDP:c:windowsSystem32lxdicoms.exe:Lexmark Communications System
"{C3D156AC-F12E-4A03-9A76-D579713F170A}"= TCP:c:windowsSystem32lxdicoms.exe:Lexmark Communications System
"{A2CFFCFC-DA3C-4F88-A1B2-D7FF0CF9D7A9}"= UDP:c:program filesLexmark 3500-4500 Serieslxdiamon.exe:Lexmark Device Monitor
"{5803C934-4569-48DB-93C2-1D658F9360EB}"= TCP:c:program filesLexmark 3500-4500 Serieslxdiamon.exe:Lexmark Device Monitor
"{5D324005-86A9-4F70-83BA-A914A6BA1CC5}"= UDP:c:program filesLexmark 3500-4500 SeriesApp4R.exe:Lexmark Imaging Studio
"{DABC1275-BDA1-42DB-A253-1CFE9F975255}"= TCP:c:program filesLexmark 3500-4500 SeriesApp4R.exe:Lexmark Imaging Studio
"{07C3CD14-BFC7-4B15-A954-71579A173138}"= UDP:c:program filesAbbyy FineReader 6.0 SprintScanScanMan6.exe:ABBYY FineReader
"{1F3AB03E-67AB-4A1A-845C-114DE628DF4A}"= TCP:c:program filesAbbyy FineReader 6.0 SprintScanScanMan6.exe:ABBYY FineReader
"{3957C95A-8206-4AC9-BC61-89434D45C792}"= UDP:c:program filesLexmark Fax SolutionsFaxCtr.exe:Fax software
"{5BD8D89D-8226-4D2B-AD40-6E5126C7DFF9}"= TCP:c:program filesLexmark Fax SolutionsFaxCtr.exe:Fax software
"{7A8016DD-EE53-4E05-B3DB-BD0005A367BD}"= UDP:c:program filesLexmark 3500-4500 Serieslxdimon.exe:Device Monitor
"{3AEA82E4-05F9-4266-A457-F25F49C64A1E}"= TCP:c:program filesLexmark 3500-4500 Serieslxdimon.exe:Device Monitor
"{C43A6D9B-C67C-4585-BF42-3E26D4B1D956}"= UDP:c:usersJacques et PatriciaAppDataLocalTemplxdiwirelessFRENCHlxdiwpss.exe:
"{2B6EB34A-361B-431E-A21E-A7D5D6B97681}"= TCP:c:usersJacques et PatriciaAppDataLocalTemplxdiwirelessFRENCHlxdiwpss.exe:
"{0BA1BD66-4879-411E-BD9B-2378296C29CB}"= UDP:c:windowsSystem32lxdicfg.exe:Printer Communication System
"{BEBEECFA-8063-4581-807E-A447B6873D76}"= TCP:c:windowsSystem32lxdicfg.exe:Printer Communication System
"{7FE1032D-CA19-442E-9E6B-07495FE0BEA0}"= UDP:c:windowsSystem32spooldriversw32x863lxdipswx.exe:Printer Status Window Interface
"{F9F0A12E-AC60-4FEB-8513-DEEF6CEBEB37}"= TCP:c:windowsSystem32spooldriversw32x863lxdipswx.exe:Printer Status Window Interface
"{AFDB1413-0AAF-4269-BB2E-25BBD4394847}"= UDP:c:windowsSystem32spooldriversw32x863lxditime.exe:Lexmark Connect Time Executable
"{1741E372-17A4-4A45-83AA-4BF0BD97984B}"= TCP:c:windowsSystem32spooldriversw32x863lxditime.exe:Lexmark Connect Time Executable
"{ED8945A7-92A9-4836-A9B1-322293F2A64D}"= UDP:c:windowsSystem32spooldriversw32x863lxdijswx.exe:Job Status Window Interface
"{46F7F7CF-B415-4E27-8040-39CC1818B804}"= TCP:c:windowsSystem32spooldriversw32x863lxdijswx.exe:Job Status Window Interface
"{1ED50190-B779-4507-A1EE-22D0506C78BB}"= c:program filesWindows LiveMessengerlivecall.exe:Windows Live Messenger (Phone)
"{80C68F72-B5EF-4B37-B436-0C46FDC4923A}"= UDP:c:program filesLexmark 3500-4500 SeriesWirelesslxdiwpss.exe:
"{9EBF9A98-90BB-4CD8-8EB1-17B2730AB329}"= TCP:c:program filesLexmark 3500-4500 SeriesWirelesslxdiwpss.exe:
"TCP Query User{237B1A11-EE21-45AA-BA57-FE2F3FEE1B7F}c:\program files\skype\phone\skype.exe"= UDP:c:program filesskypephoneskype.exe:Packard Bell - Skype
"UDP Query User{24AED6D6-71DC-4CF7-A399-1F48927CA58A}c:\program files\skype\phone\skype.exe"= TCP:c:program filesskypephoneskype.exe:Packard Bell - Skype
"TCP Query User{0075B917-092D-4179-9D0C-D560A866F6FC}c:\windows\system32\spool\drivers\w32x86\3\lxdipswx.exe"= UDP:c:windowssystem32spooldriversw32x863lxdipswx.exe:Printer Status Window Interface
"UDP Query User{740620A7-0975-4D68-A090-A7C59B7A23F7}c:\windows\system32\spool\drivers\w32x86\3\lxdipswx.exe"= TCP:c:windowssystem32spooldriversw32x863lxdipswx.exe:Printer Status Window Interface
"TCP Query User{4C632639-2D80-40F0-9883-904D04D8AE7D}c:\program files\lexmark 3500-4500 series\app4r.exe"= UDP:c:program fileslexmark 3500-4500 seriesapp4r.exe:Printing Application
"UDP Query User{EAB1A29B-41C3-4887-96B8-B2CDF7B372B7}c:\program files\lexmark 3500-4500 series\app4r.exe"= TCP:c:program fileslexmark 3500-4500 seriesapp4r.exe:Printing Application
"{F3D42788-3428-4D46-A713-AC5CAC3B3674}"= UDP:c:program filesiTunesiTunes.exe:iTunes
"{47F6774C-1530-43A1-97FE-6869F8093A78}"= TCP:c:program filesiTunesiTunes.exe:iTunes
"{0C18E619-9246-4F0E-8921-11C04528393E}"= UDP:c:program filesBonjourmDNSResponder.exe:Bonjour
"{0C20FBF4-4856-4B46-9372-88E4147D4B34}"= TCP:c:program filesBonjourmDNSResponder.exe:Bonjour
"TCP Query User{BDD57F4D-B8D9-4BF3-B88C-10513BD3DED1}c:\program files\lexmark 3500-4500 series\lxdimon.exe"= UDP:c:program fileslexmark 3500-4500 serieslxdimon.exe:Device Monitor
"UDP Query User{4ABEDB91-0A7E-4AFD-8BE5-5347664C030B}c:\program files\lexmark 3500-4500 series\lxdimon.exe"= TCP:c:program fileslexmark 3500-4500 serieslxdimon.exe:Device Monitor
"TCP Query User{2C4A17EC-FC83-4916-B12E-33D95240525B}c:\program files\lexmark 3500-4500 series\lxdiamon.exe"= UDP:c:program fileslexmark 3500-4500 serieslxdiamon.exe:Device Monitor Application
"UDP Query User{A968996E-A075-4BAE-8BD3-9E4D481AE1D9}c:\program files\lexmark 3500-4500 series\lxdiamon.exe"= TCP:c:program fileslexmark 3500-4500 serieslxdiamon.exe:Device Monitor Application
"{AA2FF791-3043-437A-9E60-F52CF33FAFFB}"= UDP:c:usersJacques et PatriciaAppDataLocalTempWZSE0.TMPSymNRT.exe:Norton Removal Tool
"{EC0C491B-65C9-4B9A-BCC5-79744A1858FA}"= TCP:c:usersJacques et PatriciaAppDataLocalTempWZSE0.TMPSymNRT.exe:Norton Removal Tool

[HKLM~servicessharedaccessparametersfirewallpolicyPublicProfile]
"EnableFirewall"= 0 (0x0)

R1 aswSP;avast! Self Protection;c:windowsSystem32driversaswSP.sys [2008-12-07 111184]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:windowsSystem32driversRTL8187B.sys [2006-03-13 281088]
R4 aswFsBlk;aswFsBlk;c:windowsSystem32driversaswFsBlk.sys [2008-12-07 20560]
R4 aswMonFlt;aswMonFlt;c:windowsSystem32driversaswMonFlt.sys [2008-12-07 51792]
R4 lxdi_device;lxdi_device;c:windowssystem32lxdicoms.exe -service --> c:windowssystem32lxdicoms.exe -service [?]
S4 lxdiCATSCustConnectService;lxdiCATSCustConnectService;c:windowsSystem32spooldriversw32x863lxdiserv.exe [2007-06-11 99248]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2F]
shellAutoRuncommand - F:LaunchU3.exe -a

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{0d4c5f5f-e08b-11dc-8873-001b24a35e22}]
shellAutoRuncommand - F:LaunchU3.exe -a

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{a2ad5503-30ba-11dd-bbdb-0017c40c9701}]
shellAutoRuncommand - E:InstallTomTomHOME.exe
.
Contenu du dossier 'Tâches planifiées'

2009-01-11 c:windowsTasksExtension de garantie.job
- c:program filesPackard BellSetupmyPCPBCarNot.exe [2006-11-21 17:38]

2009-01-01 c:windowsTasksvmkhxgqr.job
- c:windowssystem32 undll32.exe [2006-11-02 10:45]
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:progra~1MICROS~3Office12EXCEL.EXE/3000
Trusted Zone: www.orange.fr
FF - ProfilePath - c:usersJacques et PatriciaAppDataRoamingMozillaFirefoxProfilesawiuzt6.default
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - plugin: c:program filesMozilla Firefoxplugins
p-mswmp.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-11 17:24:37
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...


**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'Explorer.exe'(3316)
c:program filesLogitechSetPointlgscroll.dll
.
Heure de fin: 2009-01-11 17:27:35
ComboFix-quarantined-files.txt 2009-01-11 16:26:16
ComboFix2.txt 2009-01-11 16:15:50

Avant-CF: 111 176 519 680 octets libres
Après-CF: 111,144,337,408 octets libres

257 --- E O F --- 2009-01-10 14:53:42

[r@in | b0w]

Pas de soucis pour l'explication pas-à-pas, le fix a peut-être été mis à jour.

Tout est clean maintenant.


Pour terminer la désinfection et optimiser Windows:


_ Désinstallation des utilitaires utilisés:

Les programmes utilisés pour la désinfection ne sont pas à utiliser quotidiennement.

Pour les désinstaller, il faut cliquer sur Démarrer puis Panneau de configuration.

Ensuite tu cliques sur Programmes et enfin sur Programmes et fonctionnalités.
Tu sélectionnes les utilitaires et tu cliques sur Désinstaller.

Pour une suppression effective, penses à supprimer leurs dossiers respectifs, la plupart à la racine de ta partition principale.


_ Utilisation d'un navigateur internet alternatif:

Internet Explorer n'étant pas sûr, il est préférable d'installer un navigateur internet alternatif pour sécuriser ton surf.

Tu as le choix entre Mozilla Firefox, Apple Safari ou encore Opéra.

Il faudra ensuite définir ce navigateur internet alternatif comme navigateur par défaut.


_ Utilisation d'un pare-feu alternatif:

Il est recommandé de ne pas utiliser le pare-feu Windows et d'en prendre un plus efficace.

Le choix est possible entre Zone Alarm & Sunbelt, tous deux compatibles avec Vista.

Après avoir sélectionné le pare-feu idéal, il faudra désactiver celui de Windows.


_ Nettoyage des points de restauration:

Dans un premier temps, il faut supprimer tous les points de restauration.

Pour cela, cliques sur Démarrer puis Panneau de configuration, cliques ensuite sur Système et maintenance puis enfin sur Système.

Tu cliques sur l'onglet de gauche Protection du système.
Si Windows te demande ton mot de passe administrateur, tu le fournis, s'il demande une confirmation, tu confirmes l'action.

Dans le cadre du bas nommé Points de restauration automatiques, tu décoches la ligne correspondant à ton disque dur (par défaut nommé Disque local (C: ) (Système).

Tu confirmes la suppression de tous les points de restauration en cliquant sur Désactiver la restauration du système.

Ensuite, il faut réactiver la restauration automatique du système.

Tu refais la manipulation précédente pour relancer les Propriétés système.
Tu coches alors la ligne correspondant à ton disque dur (par défaut nommé Disque local (C: ) (Système), tu cliques enfin sur Appliquer & Ok.

Tu auras créer un point de restauration propre.


_ Nettoyage des fichiers temporaires & de la base de registre:

Pour cela, Ccleaner reste le moyen le plus sûr et pratique de tout nettoyer sans risques.

En suivant ce tutorial, cet utilitaire sera configuré correctement.

Il est aussi utile de purger régulièrement le dossier Prefetch en profitant de Ccleaner pour automatiser ce nettoyage.
Pour cela, il faut aller dans Options puis Personnaliser pour ajouter le dossier C:WindowsPREFETCH.


_ Un petit coup d'oeil à notre dossier Nettoyage peut être utile en supplément.

[Chrislall]

Parfait je vais faire tout ça...
Encore une fois je te remercie et je te fais grâce cette fois de t'exprimer toute ma gratitute mais elle est sincère.
Cordialement
Chrislall

[r@in | b0w]

Pas de Mp

De rien, merci aussi à panda77 d'avoir lancé la désinfection.

Au bout de trois désinfections, je deviens payant