Fichier ATAPI.SY infecté par trojan-rootkit

bonjour Wayne,
j'ai déjà Malwarebytes, il n'avait rien vu...le scan de Clamwin est plus performant. au début il y avait 4 trojan-rootkit !

bonsoir archet9,
j'ai déjà la console de récupération installée, bon je suppose qu'il va la trouver...OK, je fais ça et je reviens poster, merci !

me revoilà,
voici le rapport :
ComboFix 10-04-03.02 - jean-philippe 04/04/2010 23:11:45.3.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.3198.2794 [GMT 2:00]
Lancé depuis: c:\documents and settings\jean-philippe\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-746137067-1547161642-725345543-1004
c:\windows\AppPatch\AcAdProc.dll
c:\windows\system32\tmp3.tmp
c:\windows\system32\tmp56.tmp
c:\windows\system32\TMPA.tmp

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-03-04 au 2010-04-04 ))))))))))))))))))))))))))))))))))))
.

2010-03-10 09:40 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-08 19:04 . 2010-03-08 19:04 -------- d-----w- c:\program files\WinFreeTV
2010-03-07 10:42 . 2010-03-07 10:42 7424000 ----a-r- c:\documents and settings\jean-philippe\Application Data\Microsoft\Installer\{4EE2EF4B-25D3-4D44-8384-A2B96F811F55}\soffice.exe
2010-03-07 10:41 . 2010-03-07 10:41 -------- d-----w- c:\program files\JRE
2010-03-06 11:10 . 2010-03-06 11:10 -------- d-----w- c:\program files\Lame for Audacity

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-04 20:57 . 2009-12-17 00:20 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-04-04 20:57 . 2010-02-06 23:35 -------- d-----w- c:\documents and settings\jean-philippe\Application Data\vlc
2010-04-04 18:38 . 2009-12-17 00:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-04-04 18:37 . 2009-12-17 00:20 -------- d-----w- c:\program files\SpywareBlaster
2010-04-03 21:51 . 2009-12-30 01:04 -------- d-----w- c:\documents and settings\jean-philippe\Application Data\Skype
2010-04-03 11:48 . 2009-12-29 23:16 -------- d-----w- c:\documents and settings\jean-philippe\Application Data\dvdcss
2010-04-02 23:41 . 2009-12-17 01:30 1 ----a-w- c:\documents and settings\jean-philippe\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-04-02 13:25 . 2010-01-12 12:20 -------- d-----w- c:\documents and settings\jean-philippe\Application Data\Audacity
2010-03-30 21:25 . 2009-12-17 01:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-30 21:22 . 2009-12-31 23:33 5918776 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-03-29 22:46 . 2009-12-17 01:04 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-29 22:45 . 2009-12-17 01:04 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-29 19:28 . 2009-12-16 19:49 -------- d-----w- c:\program files\CCleaner
2010-03-28 05:58 . 2004-08-05 12:00 84956 ----a-w- c:\windows\system32\perfc00C.dat
2010-03-28 05:58 . 2004-08-05 12:00 509844 ----a-w- c:\windows\system32\perfh00C.dat
2010-03-11 07:44 . 2009-12-28 15:03 -------- d-----w- c:\documents and settings\jean-philippe\Application Data\Canon
2010-03-11 06:26 . 2009-12-16 20:12 22960 ----a-w- c:\documents and settings\jean-philippe\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-08 19:08 . 2009-12-20 14:02 -------- d-----w- c:\program files\VideoLAN
2010-03-07 10:41 . 2009-12-17 01:27 -------- d-----w- c:\program files\OpenOffice.org 3
2010-03-01 16:18 . 2010-03-01 16:18 136 ----a-w- c:\documents and settings\jean-philippe\Local Settings\Application Data\fusioncache.dat
2010-02-26 22:38 . 2010-02-26 22:38 -------- d-----w- c:\program files\Fichiers communs\Java
2010-02-26 22:38 . 2010-02-26 22:38 503808 ----a-w- c:\documents and settings\jean-philippe\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2d01cc7b-n\msvcp71.dll
2010-02-26 22:38 . 2010-02-26 22:38 499712 ----a-w- c:\documents and settings\jean-philippe\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2d01cc7b-n\jmc.dll
2010-02-26 22:38 . 2010-02-26 22:38 348160 ----a-w- c:\documents and settings\jean-philippe\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2d01cc7b-n\msvcr71.dll
2010-02-26 22:38 . 2010-02-26 22:38 61440 ----a-w- c:\documents and settings\jean-philippe\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-18362d9d-n\decora-sse.dll
2010-02-26 22:38 . 2010-02-26 22:38 12800 ----a-w- c:\documents and settings\jean-philippe\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-18362d9d-n\decora-d3d.dll
2010-02-26 22:38 . 2009-12-17 01:25 -------- d-----w- c:\program files\Java
2010-02-26 22:26 . 2010-02-26 22:26 -------- d-----w- c:\program files\NortonInstaller
2010-02-25 06:17 . 2004-08-05 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-19 23:47 . 2010-02-19 23:47 3604480 ----a-w- c:\windows\system32\GPhotos.scr
2010-02-06 23:40 . 2010-02-06 16:50 -------- d-----w- c:\documents and settings\jean-philippe\Application Data\BitTorrent
2010-02-06 17:46 . 2010-02-06 16:50 -------- d-----w- c:\program files\BitTorrent
2010-02-05 21:55 . 2009-12-17 01:03 -------- d-----w- c:\program files\QuickTime Alternative
2010-02-05 21:55 . 2010-02-05 21:55 -------- d-----w- c:\program files\Fichiers communs\Apple
2010-02-05 21:55 . 2010-02-05 21:55 -------- d-----w- c:\program files\Apple Software Update
2010-02-05 21:55 . 2010-02-05 21:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2010-02-03 23:41 . 2010-01-12 21:06 -------- d-----w- c:\program files\trend micro
2010-02-03 23:41 . 2009-12-16 22:18 -------- d-----w- c:\program files\Windows Media Connect 2
2010-01-17 15:22 . 2010-01-17 14:47 444952 ----a-w- c:\windows\system32\wrap_oal.dll
2010-01-17 15:22 . 2010-01-17 14:47 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2010-01-06 21:35 . 2010-01-06 21:35 17432 ---ha-w- c:\windows\system32\mlfcache.dat
2010-01-06 16:13 . 2009-12-17 00:01 0 ---h--w- c:\documents and settings\All Users\Application Data\PKP_DLdu.DAT
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-12-15 5513216]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^LE COMPAGNON CLUB.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\LE COMPAGNON CLUB.lnk
backup=c:\windows\pss\LE COMPAGNON CLUB.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^jean-philippe^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 3.1.lnk]
path=c:\documents and settings\jean-philippe\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 3.1.lnk
backup=c:\windows\pss\OpenOffice.org 3.1.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-12-11 14:57 948672 ----a-r- c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-22 00:57 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS SmartDoctor]
2004-12-16 13:55 987136 ----a-w- c:\program files\ASUS\SmartDoctor\SmartDoctor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AsusStartupHelp]
2006-11-14 06:25 363008 ----a-r- c:\program files\ASUS\AASP\1.00.17\AsRunHelp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
2009-03-02 12:08 209153 ----a-w- c:\program files\Avira\AntiVir Desktop\avgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ClamWin]
2009-11-03 20:49 86016 ----a-w- c:\program files\ClamWin\bin\ClamTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio8788GX]
2008-07-11 07:04 200704 ----a-r- c:\windows\system\HsMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 02:33 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
2006-05-24 04:20 17920 ----a-w- c:\windows\CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
2009-06-03 23:55 25600 ----a-w- c:\windows\system32\Ctxfihlp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
2005-07-19 16:32 221184 ----a-w- c:\windows\system32\LVCOMSX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 02:34 1695232 ------w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 15:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2004-12-15 04:01 86016 ----a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2004-12-15 04:01 1490944 ----a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- c:\program files\QuickTime Alternative\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-11 14:21 246504 ----a-w- c:\program files\Fichiers communs\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 00:00 90112 ------w- c:\windows\Updreg.EXE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\system32\\dxdiag.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [16/12/2009 22:30 108289]
R3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\system32\drivers\CT20XUT.sys [04/06/2009 03:46 171032]
R3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\system32\drivers\CTEXFIFX.sys [04/06/2009 03:46 1324056]
R3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\system32\drivers\CTHWIUT.sys [04/06/2009 03:46 72728]
S3 c65013264;c65013264;c:\windows\system32\drivers\c6501.sys --> c:\windows\system32\drivers\c6501.sys [?]
S3 cmudaxp;cmudaxp;c:\windows\system32\drivers\cmudaxp.sys --> c:\windows\system32\drivers\cmudaxp.sys [?]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Fichiers communs\Creative Labs Shared\Service\CTAELicensing.exe [17/01/2010 17:23 79360]
S3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.sys [04/06/2009 03:46 171032]
S3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.sys [04/06/2009 03:46 1324056]
S3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.sys [04/06/2009 03:46 72728]
.
Contenu du dossier 'Tâches planifiées'
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = 127.0.0.1
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\jean-philippe\Application Data\Mozilla\Firefox\Profiles\nph5tbwv.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - component: c:\documents and settings\jean-philippe\Application Data\Mozilla\Firefox\Profiles\nph5tbwv.default\extensions\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}\components\npAFOM.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\windows\system32\C2MP\npdivx32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHELINS SUPPRIMES - - - -

MSConfigStartUp-BJCFD - c:\program files\BroadJump\Client Foundation\CFD.exe
MSConfigStartUp-C6501Sound - c6501.cpl
MSConfigStartUp-Cmaudio8788 - cmicnfgp.cpl
MSConfigStartUp-Google Update - c:\documents and settings\jean-philippe\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
MSConfigStartUp-Motive SmartBridge - c:\progra~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-04 23:16
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1220945662-602162358-725345543-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(3888)
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Creative\Shared Files\CTAudSvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\ATKKBService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Heure de fin: 2010-04-04 23:19:55 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-04-04 21:19

Avant-CF: 10 805 026 816 octets libres
Après-CF: 10 768 494 592 octets libres

- - End Of File - - 2D4D576EFAD1FBD7741DA13952C43B4F

voilà, bonne lecture et merci !
Curtis

en tout cas, d'après ClamWin, le disque C est propre maintenant !
c'est encourageant !
Curtis

OK merci !
voilà l'adresse du lien, si j'ai bien suivi :(
http://www.cijoint.fr/cjlink.php?file=cj201004/cijnApLKIV.txt
c'est ça ? j'ai bon ?
;o)
Curtis

Bonjour,
oui je pense que c'était bien un faux positif...
ClamWin est un bon scanner, mais il lance beaucoup d'alertes sur des FP !

voilà pour le rapport de suppression :

[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\Combofix.txt: trouvé !
C:\Qoobox: trouvé !
C:\Documents and Settings\jean-philippe\Bureau\ComboFix.exe: trouvé !
C:\Qoobox\Quarantine\catchme.log: trouvé !
C:\WINDOWS\mbr.exe: trouvé !

---------------------------------
--> Suppression:

C:\Documents and Settings\jean-philippe\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Combofix.txt: supprimé !
C:\Qoobox\Quarantine\catchme.log: supprimé !
C:\WINDOWS\mbr.exe: supprimé !
C:\Qoobox: supprimé !

voilà, ça m'a l'air bon...il n'a pas aimé que je jette ComboFix moi-même ;o)

pour la purge de la restauration système, je n'ai jamais trop compris : je fais un point de restauration avant de la vider ou juste après ?

merci, à bientôt !

Curtis