Salut,

1/

F - Hijackthis - Outil de diagnostic et réparation
lire démo
http://pageperso.aol.fr/balltrap34/Hijenr.gif
http://pageperso.aol.fr/balltrap34/demohijack.htm
Télécharge version française ici
http://telechargement.zebulon.fr/160-patch-francais-pour-hij­ackthis-1991.html
Copie/colle le rapport

Bon courage

2/
Télécharge Blacklight(de F-Secure) a l’une des 2 adresses :
https://europe.f-secure.com/blacklight/try.shtml
http://www.f-secure.com/blacklight/try.shtml

et sauvegarde le sur ton Bureau.

Double-clique blbeta.exeet accepte la licence ; laisse [X]scan through Windows Explorer activé ; clique Scan puis Next

Tu verras une liste de fichiers détectés apparaître. Tu verras également un rapport, sur ton Bureau, nommé fsbl.xxxxxxx.log (les xxxxxxx sont des chiffres).
colle le rapport

A++

Il faut vivre chaque journée comme elle vient, et refuser ta­nt les
regrets que les inquiétudes pour l'Avenir ( Jim Fergus)

Merci de ton coup de main

je ne peux pas ouvrir blacklight, le message est " Blacklight could not acquire necessary privileges
- your computer settings may prevent acquiring theses privileges
- a malicious program have disabled these privileges


ensuite voila le rapport hijackthis :

Logfile of HijackThis v1.99.1
Scan saved at 11:19:02, on 12/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Labtec\Media Keyboard\V5.0\KbdAp32A.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Antipub\antipub.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O3 - Toolbar: Seekmo Toolbar - {53E0B6E8-A51D-448B-B692-40B67B285543} - C:\Program Files\Seekmo Programs\Seekmo Toolbar\SeekmoTB.dll (file missing)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LWBKEYBOARD] C:\Program Files\Labtec\Media Keyboard\V5.0\KbdAp32A.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [AVPCC] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exe" /wait
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [I downloaded pirated Software from P2P ] C:\WINDOWS\system32\0106.exe
O4 - HKLM\..\Run: [012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678912345678] C:\Program Files\user32.exe
O4 - HKLM\..\Run: [defender] C:\\dfndrff_15.exe
O4 - HKLM\..\Run: [djfdd7fe] RUNDLL32.EXE w5c69e8c.dll,n 003dd7fb0000000a5c69e8c
O4 - HKLM\..\Run: [newname] C:\\nwnmff_15.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_15.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [License Manager] "C:\Program Files\License_Manager\license_manager.exe " /silent
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://data.jeuxclassiques.com/npwwg.cab
O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by108fd.bay108.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site....
O16 - DPF: {826287F8-454E-11D9-ADFE-00062919A34C} (ActiveXUploadFotoCom.UserCtrlFotoCom) - http://express.foto.com/activeX/newUploadFotoCom.CAB
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/hardwaredetection.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {FB90BA05-66E6-4C56-BCD3-D65B0F7EBA39} (Foto.com SpeedUploader 1.0 Control) - http://express.foto.com/SFuploaderApplet/SpeedUploader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: Syncmgr - C:\WINDOWS\system32\irrol5931.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exe" /service (file missing)
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpm.exe" /service (file missing)
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Office Source Engine (ose) - Unknown owner - C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

SLt,

Fais ce qui suit pour nettoyer un peu
Ensuite on verra sur une autre soluce

Il est important d’effectuer la manip dans sa totalité et dans l’ordre :

Télécharge (sauf si tu les as) et colle les 3 rapports dans l’ordre

A - ad-aware version 1.06
(ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
voir demo
http://pageperso.aol.fr/balltrap34/adwseflash.zip

B - spybot version 1.4
(ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
voir demo d utilisation
http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm

C - Ccleaner : ( nettoyeur de registre, cookies+temps+tempos+prefetch+historique+etc..)
Télécharge ici :
http://www.ccleaner.com/ccdownload.asp
Tutorial ici:
http://www.vulgarisation-informatique.com/nettoyer-windows-c­cleaner.php

D – Ewido
http://www.malekal.com/tutorial_ewidoV4.html
ou
http://www.infos-du-net.com/telecharger/Ewido-Anti-Malware.h­tml

Mets le à jour en cliquant update now.
Fais un "complete system scan".
A la fin du scan, vérifie qu'il y est bien marqué "delete à côté de chaque malware et clique seulement sur : "Apply all actions"
Ensuite, clique sur "Save Report " puis "Save report as" et sauve le rapport dans tes documents.

Copie/colle le rapport



E - Scan online avec BitDefender (fonctionne uniquement sous Internet Explorer en acceptant l’ activX)
http://assiste.free.fr/p/antivirus_gratuits_en_ligne/antivirus_en_ligne.php
http://www.bitdefender.fr/scan8/ie.html
Copie/COLLE le rapport entier



Tu nous diras un peu ce qu'il se passe par la suite

A++

Il faut vivre chaque journée comme elle vient, et refuser tant les
regrets que les inquiétudes pour l'Avenir ( Jim Fergus)

Merci beaucoup,
je vais partir au boulot, je ferai tout ce que tu m'a dis ce soir, et t'enverrai les réponses,

a ++

Slt marie
voila les rapports

pour AdAware: could not remove C:\WINDOWS\system32\h0j4la1q1d.dll

pour Ewido :

ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 23:54:55 12/09/2006

+ Scan result:



HKU\S-1-5-21-1078081533-343818398-839522115-1004\Software\Mi­crosoft\Windows\CurrentVersion\Ext\Stats\{5929CD6E-2062-44A4­-B2C5-2C7E78FBAB38} -> Adware.Generic : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP397\A0032288.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP398\A0032358.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP399\A0033387.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP399\A0033403.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP399\A0033408.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP400\A0033430.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP400\A0033810.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP400\A0033822.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP400\A0033826.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP400\A0033834.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP400\A0033838.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP401\snapshot\MFEX-83.DAT -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP402\snapshot\MFEX-83.DAT -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP403\snapshot\MFEX-83.DAT -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP404\snapshot\MFEX-83.DAT -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP405\snapshot\MFEX-83.DAT -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP406\A0033966.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP406\A0033986.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP406\snapshot\MFEX-83.DAT -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP407\A0034007.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP407\A0034013.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP407\A0034015.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP407\A0034019.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP407\A0034021.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP407\A0034025.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP407\A0034030.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP407\A0034034.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP408\A0034040.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP408\A0034044.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP409\A0034054.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP409\A0034058.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP409\A0034095.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP410\A0034103.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP411\A0034113.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP412\A0034340.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP412\A0034342.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP415\A0034771.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP415\A0034840.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP415\A0034844.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP415\A0034848.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP416\A0034851.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP416\A0034855.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP416\A0034858.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP416\A0034862.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP417\A0034907.dll -> Adware.Look2Me : Cleaned.
C:\WINDOWS\system32\irjol5131.dll -> Adware.Look2Me : Cleaned.
C:\WINDOWS\system32\nzwrses.dll -> Adware.Look2Me : Cleaned.
C:\WINDOWS\system32\r68s0gl7e6q.dll -> Adware.Look2Me : Cleaned.
C:\WINDOWS\system32\vrrifier.dll -> Adware.Look2Me : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP397\A0031744.dll -> Adware.Softomate : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP400\A0033840.dll -> Adware.Softomate : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP397\A0031729.dll -> Adware.SurfSide : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP399\A0033388.dll -> Adware.SurfSide : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP400\A0033833.dll -> Adware.SurfSide : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP409\A0034061.dll -> Downloader.Agent.awb : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP409\A0034062.dll -> Downloader.Agent.awb : Cleaned.
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP400\A0033507.exe -> Downloader.VB.amh : Cleaned.
C:\WINDOWS\Downloaded Program Files\USDR6V_0001_D18M3107NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.l : Cleaned.
C:\Documents and Settings\Geof\Local Settings\Temp\Cookies\geof@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\WINDOWS\system32\1024 -> Trojan.Small : Cleaned.


::Report end


Je t'enverai le rapport de bitdefender demain, il est super long a analyser,

a ++

Slt !!

voila le rapport de BirDefender :

BitDefender Online Scanner



Rapport d'analyse généré à: Wed, Sep 13, 2006 - 01:30:05

Voie d'analyse: A:\;C:\;D:\;E:\;F:\;H:\;

Statistiques

Temps
01:13:29

Fichiers
522321

Directoires
4641

Secteurs de boot
3

Archives
9850

Paquets programmes
54245

Résultats

Virus identifiés
1

Fichiers infectés
7

Fichiers suspects
0

Avertissements
0

Désinfectés
0

Fichiers effacés
7




Info sur les moteurs

Définition virus
453918

Version des moteurs
AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38)

Analyse des plugins
13

Archive des plugins
38

Unpack des plugins
6

E-mail plugins
6

Système plugins
1




Paramètres d'analyse

Première action
Désinfecté

Seconde Action
Supprimé

Heuristique
Oui

Acceptez les avertissements
Oui

Extensions analysées
*;

Excludez les extensions


Analyse d'emails
Oui

Analyse des Archives
Oui

Analyser paquets programmes
Oui

Analyse des fichiers
Oui

Analyse de boot
Oui




Fichier analysé
Statut

C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P396\A0031648.exe
Infecté par: Trojan.DollarRevenue.B

C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P396\A0031648.exe
Echec de la désinfection

C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P396\A0031648.exe
Supprimé

C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P396\A0031671.exe
Infecté par: Trojan.DollarRevenue.B

C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P396\A0031671.exe
Echec de la désinfection

C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P396\A0031671.exe
Supprimé

C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P397\A0032294.exe
Infecté par: Trojan.DollarRevenue.B

C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P397\A0032294.exe
Echec de la désinfection

C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P397\A0032294.exe
Supprimé

C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P398\A0032336.exe
Infecté par: Trojan.DollarRevenue.B

C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P398\A0032336.exe
Echec de la désinfection

C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P398\A0032336.exe
Supprimé

C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P398\A0032378.exe
Infecté par: Trojan.DollarRevenue.B

C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P398\A0032378.exe
Echec de la désinfection

C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P398\A0032378.exe
Supprimé

C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P398\A0032403.exe
Infecté par: Trojan.DollarRevenue.B

C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P398\A0032403.exe
Echec de la désinfection

C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P398\A0032403.exe
Supprimé

C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P400\A0033454.exe
Infecté par: Trojan.DollarRevenue.B

C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P400\A0033454.exe
Echec de la désinfection

C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P400\A0033454.exe
Supprimé

Salut

LOL

C:\System Volume Information\_restore


L'infection se situe dans le système de restauration XP (System Volume Information\_restore)

¤Désactive ta restauration système (uniquement si tu es sous XP):
Clic droit sur poste de travail puis,
propriété, tu cliques sur onglet restauration système
tu coches la case « désactiver la restauration » et applique.

Puis,

¤Réactive ta restauration système (uniquement si tu es sous XP):
Clic droit sur poste de travail puis,
propriété, tu cliques sur onglet restauration système
tu décoches la case « désactiver la restauration » et applique.



Refais un HT
Stp
Merci

Donnes les symptomes de ton PC

A++
Il faut vivre chaque journée comme elle vient, et refuser ta­nt les
regrets que les inquiétudes pour l'Avenir ( Jim Fergus)

Slt,

je vien de désactivé puis réactivé...
par contre qu'est un HT ??? stp

HT===> Hitjackthis Il faut vivre chaque journée comme elle vient, et refuser tant les
regrets que les inquiétudes pour l'Avenir ( Jim Fergus)

Ok lol

voici le rapport :

Logfile of HijackThis v1.99.1
Scan saved at 11:07:01, on 13/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Labtec\Media Keyboard\V5.0\KbdAp32A.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
C:\windows\system32\reykvrbgkv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O3 - Toolbar: Seekmo Toolbar - {53E0B6E8-A51D-448B-B692-40B67B285543} - C:\Program Files\Seekmo Programs\Seekmo Toolbar\SeekmoTB.dll (file missing)
O4 - HKLM\..\Run: [LWBKEYBOARD] C:\Program Files\Labtec\Media Keyboard\V5.0\KbdAp32A.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [AVPCC] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exe" /wait
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [djfdd7fe] RUNDLL32.EXE w5c69e8c.dll,n 003dd7fb0000000a5c69e8c
O4 - HKLM\..\Run: [reykvrbgkv] c:\windows\system32\reykvrbgkv.exe reykvrbgkv
O4 - HKLM\..\Run: [newname] C:\\nwnmff_15.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [I downloaded pirated Software from P2P ] C:\WINDOWS\system32\0106.exe
O4 - HKLM\..\Run: [012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678912345678] C:\Program Files\user32.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [License Manager] "C:\Program Files\License_Manager\license_manager.exe " /silent
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://data.jeuxclassiques.com/npwwg.cab
O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by108fd.bay108.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site....
O16 - DPF: {826287F8-454E-11D9-ADFE-00062919A34C} (ActiveXUploadFotoCom.UserCtrlFotoCom) - http://express.foto.com/activeX/newUploadFotoCom.CAB
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/hardwaredetection.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {FB90BA05-66E6-4C56-BCD3-D65B0F7EBA39} (Foto.com SpeedUploader 1.0 Control) - http://express.foto.com/SFuploaderApplet/SpeedUploader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WindowsUpdate - C:\WINDOWS\system32\h0j4la1q1d.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exe" /service (file missing)
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpm.exe" /service (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Office Source Engine (ose) - Unknown owner - C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

Les symptomes de mon pc sont : j'ai de millions de pub que je n'avais pas avant !

je ne peux plus me servir de msn messenger ( ne répond pas qd il démare ) , idem pour Word ( dt j'ai la licence )

qd je scan mon pc avec AdAware par exemple, il me détruit ce qu'il trouve, ms le lendemain tt est revenu....

Bonjour,

Méthode à suivre dans l'ordre...
------------------------------------------------------------­----------------
Télécharger ces logiciels (sauf si tu les as)
A utiliser plus tard

A - ad-aware version 1.06
(ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
voir demo
http://pageperso.aol.fr/balltrap34/adwseflash.zip

B - spybot version 1.4
(ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
voir demo d utilisation
http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm

C - Ccleaner : ( nettoyeur de registre, cookies+temps+tempos+prefetch+historique+etc..)
Télécharge ici :
http://www.ccleaner.com/ccdownload.asp
Tutorial ici:
http://www.vulgarisation-informatique.com/nettoyer-windows-c­cleaner.php

D - Ewido
http://www.malekal.com/tutorial_ewidoV4.html
------------------------------------------------------------­----------------
¤Affiche tous les fichiers et dossiers :
Clique sur démarrer/panneau de configuration/outil/option des dossiers/affichage

Coche « afficher les fichiers et dossiers cachés »

Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"

Décoche « masquer les extensions dont le type est connu »
Puis fais «Ok» pour valider les changements.

Et appliquer !
=================================
Relance HijackThis, choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked"


R3 - Default URLSearchHook is missing


O3 - Toolbar: Seekmo Toolbar - {53E0B6E8-A51D-448B-B692-40B67B285543} - C:\Program Files\Seekmo Programs\Seekmo Toolbar\SeekmoTB.dll (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://data.jeuxclassiques.com/npwwg.cab
O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by108fd.bay108.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site....
O16 - DPF: {826287F8-454E-11D9-ADFE-00062919A34C} (ActiveXUploadFotoCom.UserCtrlFotoCom) - http://express.foto.com/activeX/newUploadFotoCom.CAB
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/hardwaredetection.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {FB90BA05-66E6-4C56-BCD3-D65B0F7EBA39} (Foto.com SpeedUploader 1.0 Control) - http://express.foto.com/SFuploaderApplet/SpeedUploader.cab

O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe

Pour cette ligne

BOONTY


O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe


pour ce dernier ( 23 ) vire le en faisant Démarrer >> exécuter >> services.msc

Arrête-le et désactive-le.

Ou

désinstalle manuellement en passant par "panneau de configuration –Ajout/supp des programmes et tu vires ce logiciel


============ ============================
¤Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).
----------------------------------------------------------------------------
¤Vide tes fichiers temps et temporary internet file:

Maintenant tu lances
A/ Ad-Aware supprime quarantaine
B/ Spybot Supprime quarantaine
C/ Ccleaner Ewido Copier/coller le rapport
D/
----------------------------------------------------------------------------
¤ Vide ta Corbeille.
----------------------------------------------------------------------------
¤ Redémarre en mode normal, relance Hijackthis et copie/colle un nouveau rapport sur le forum.

Tiens nous au courant

A+
Il faut vivre chaque journée comme elle vient, et refuser tant les
regrets que les inquiétudes pour l'Avenir ( Jim Fergus)

Slt marie

voila les rapports :

Ewido : ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 00:23:29 14/09/2006

+ Scan result:



C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\R­P419\A0035046.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP420\A0035077.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP420\A0035083.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP420\A0035088.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP420\A0035092.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP420\A0035095.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP420\A0035100.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A72E859A-4A44-453D-928C-ED6F80DAF36D}\RP420\A0035121.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
[1196] C:\WINDOWS\system32\guard.tmp -> Adware.Look2Me : Error during cleaning.
[1316] C:\WINDOWS\system32\guard.tmp -> Adware.Look2Me : Error during cleaning.


::Report end

Hijackthis :

Logfile of HijackThis v1.99.1
Scan saved at 00:29:02, on 14/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Labtec\Media Keyboard\V5.0\KbdAp32A.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Antipub\antipub.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=userinit.exe
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [LWBKEYBOARD] C:\Program Files\Labtec\Media Keyboard\V5.0\KbdAp32A.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [AVPCC] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exe" /wait
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [djfdd7fe] RUNDLL32.EXE w5c69e8c.dll,n 003dd7fb0000000a5c69e8c
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: MS-DOS Emulation - C:\WINDOWS\system32\f80olid3180.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exe" /service (file missing)
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpm.exe" /service (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Office Source Engine (ose) - Unknown owner - C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

en espérant une amélioration, a biento...lol

fangi

Bonsoir,

Je vois que Marie a un peu de mal lol... 'vais essayer de l'épauler ;)

- Méthode à suivre dans l'ordre -

Tu fais tout exactement comme je te l'écrit !

1/ Clique droit sur "Poste de travail" -> "Propriétés" -> onglet "Restauration du système" -> tu coches "Désactiver la Restauration du système sur tous les lecteurs" -> "Appliquer" -> "Oui".

Ensuite, tu décoches "Désactiver la Restauration du système sur tous les lecteurs" -> "Appliquer" -> "OK".

2/ Télécharge Look2Me-Destroyer.exe sur ton Bureau.

http://www.atribune.org/ccount/click.php?id=7

* Ferme toutes les fenêtres actives avant de passer à l'étape suivante.
* Double-clique Look2Me-Destroyer.exe afin de lancer l'outil.
* Coche "Run this program as a task"
* Un message s'affichera, te disant ceci : "Look2Me-Destroyer will close and re-open in approximately 10 seconds". Clique [OK]
* Il se relancera après les 10 secondes, puis clique sur le bouton "Scan for L2M"; les icônes de ton Bureau vont disparaître : c'est normal !
* Lorsque le scan termine, clique sur le bouton "Remove L2M"
* Un message "Done Scanning" apparaîtra, clique [OK].
* Un nouveau message s'affichera : "Done removing infected files! Look2Me-Destroyer will now shutdown your computer"; clique [OK].
* Ton PC va maintenant s'éteindre.
* Démarre ton PC normalement.
* Colle le rapport généré, situé ici : C:\Look2Me-Destroyer.txt , ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.

#Si Look2Me-Destroyer ne se relance pas automatiquement après les 10 secondes, redémarre et essaie à nouveau.

##Si tu reçois un message de ton parefeu que l'outil tente d'accéder à l'internet : accepte !

###Si un message runtime error '339' s'affiche : télécharge MSWINSCK.OCX du lien ci-dessous, et place-le dans le dossier C:\Windows\System32
http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX

3/ Mets à jour Ewido puis redémarre le PC en mode sans échec : tu tapotes sur la touche F8 de ton clavier (ou bien F5 selon la version de Windows) et tu choisis le mode "sans échec".

4/ Exécute Ewido et effectue un scan complet puis désinfecte ton PC avec.
Copie/colle le rapport entier sur le forum.

5/ Remets un log HijackThis car il restera des lignes à fixer...
Courage, Kristopher

Slt kristopher, merci bcp de t'occuper de mon cas..

voila les derniers rapports :

Look2Me-Destroyer V1.0.12

Scanning for infected files.....
Scan started at 14/09/2006 22:58:09

Infected! C:\WINDOWS\system32\hrl0053me.dll
Infected! C:\WINDOWS\system32\hr8s05l7e.dll

Attempting to delete infected files...

Attempting to delete: C:\WINDOWS\system32\hrl0053me.dll
C:\WINDOWS\system32\hrl0053me.dll could not be deleted!

Attempting to delete: C:\WINDOWS\system32\hr8s05l7e.dll
C:\WINDOWS\system32\hr8s05l7e.dll could not be deleted!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Run

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{BE5CD00D-3605-4EF4-9A93-A98C8E59C42F}"
HKCR\Clsid\{BE5CD00D-3605-4EF4-9A93-A98C8E59C42F}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{576333AD-7F77-4E6A-A4FF-DED1388910C7}"
HKCR\Clsid\{576333AD-7F77-4E6A-A4FF-DED1388910C7}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{2B538B28-55DE-43C7-8DB6-AA98A8E42DF5}"
HKCR\Clsid\{2B538B28-55DE-43C7-8DB6-AA98A8E42DF5}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{2C0B381F-0FBD-4ADC-A1A6-1E7A6942E43E}"
HKCR\Clsid\{2C0B381F-0FBD-4ADC-A1A6-1E7A6942E43E}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{F9DF177D-1650-42F7-9505-D73616BDAB68}"
HKCR\Clsid\{F9DF177D-1650-42F7-9505-D73616BDAB68}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{160967C0-DCD3-4682-B145-7489A2A2F34D}"
HKCR\Clsid\{160967C0-DCD3-4682-B145-7489A2A2F34D}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{63020087-FB49-4C81-95A1-9AB02ED9526D}"
HKCR\Clsid\{63020087-FB49-4C81-95A1-9AB02ED9526D}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{ACE03EBD-0DAC-4CC8-9B81-44611EDA129C}"
HKCR\Clsid\{ACE03EBD-0DAC-4CC8-9B81-44611EDA129C}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{E4E8A1E0-7828-4535-BF22-7614BA25B0C3}"
HKCR\Clsid\{E4E8A1E0-7828-4535-BF22-7614BA25B0C3}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{5BDEF730-B7A9-4B20-9A14-B88E2A81EA3D}"
HKCR\Clsid\{5BDEF730-B7A9-4B20-9A14-B88E2A81EA3D}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{71C8E36D-F71F-4301-81F3-7BA6FED980C4}"
HKCR\Clsid\{71C8E36D-F71F-4301-81F3-7BA6FED980C4}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{DD23A284-8F3B-4B1C-9D0D-A8B17495CC8A}"
HKCR\Clsid\{DD23A284-8F3B-4B1C-9D0D-A8B17495CC8A}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administrateurs - Succeeded





ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 23:55:38 14/09/2006

+ Scan result:



C:\WINDOWS\system32\enpsl1771.dll -> Adware.Look2Me : Cleaned.
C:\WINDOWS\system32\hrl0053me.dll -> Adware.Look2Me : Cleaned.
C:\Documents and Settings\Geof\Local Settings\Temp\Cookies\geof@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned.
C:\Documents and Settings\Geof\Local Settings\Temp\Cookies\geof@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
C:\Documents and Settings\Geof\Local Settings\Temp\Cookies\geof@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned.
C:\WINDOWS\Temp\Cookies\geof@casinotropez[1].txt -> TrackingCookie.Casinotropez : Cleaned.
C:\Documents and Settings\Geof\Local Settings\Temp\Cookies\geof@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : Cleaned.
C:\Documents and Settings\Geof\Local Settings\Temp\Cookies\geof@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
C:\WINDOWS\Temp\Cookies\geof@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
C:\Documents and Settings\Geof\Local Settings\Temp\Cookies\geof@estat[1].txt -> TrackingCookie.Estat : Cleaned.
C:\Documents and Settings\Geof\Local Settings\Temp\Cookies\geof@as1.falkag[2].txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\Geof\Local Settings\Temp\Cookies\geof@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : Cleaned.
C:\Documents and Settings\Geof\Local Settings\Temp\Cookies\geof@weborama[1].txt -> TrackingCookie.Weborama : Cleaned.
C:\WINDOWS\Temp\Cookies\geof@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Geof\Local Settings\Temp\Cookies\geof@zedo[2].txt -> TrackingCookie.Zedo : Cleaned.


::Report end





Logfile of HijackThis v1.99.1
Scan saved at 23:58:42, on 14/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Labtec\Media Keyboard\V5.0\KbdAp32A.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Antipub\antipub.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
C:\WINDOWS\system32\svchost.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=userinit.exe
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [LWBKEYBOARD] C:\Program Files\Labtec\Media Keyboard\V5.0\KbdAp32A.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [AVPCC] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exe" /wait
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [djfdd7fe] RUNDLL32.EXE w5c69e8c.dll,n 003dd7fb0000000a5c69e8c
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exe" /service (file missing)
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpm.exe" /service (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Office Source Engine (ose) - Unknown owner - C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

encore merci et a biento
fangiogogo

C'est encore kristopher..

si tu veux, j'ai enfin réussi a installé et executer blacklight ...
je vais t'envoyé également le rapport si tu peux en tirer qq chose..

a ++

fangio

Dsl, je voulais dire " c'est encore moi, ....... "

a +
fangio

Coucou,

j'ai enfin réussi a installé et executer blacklight ...

Cela serait sympa de le voir. Merci

A++

Il faut vivre chaque journée comme elle vient, et refuser ta­nt les
regrets que les inquiétudes pour l'Avenir ( Jim Fergus)

Slt marie, slt kristopher

voila le rapport de blacklight :

09/15/06 12:02:08 [Info]: BlackLight Engine 1.0.46 initialized
09/15/06 12:02:08 [Info]: OS: 5.1 build 2600 (Service Pack 2)
09/15/06 12:02:08 [Note]: 7019 4
09/15/06 12:02:08 [Note]: 7005 0
09/15/06 12:02:13 [Note]: 7006 0
09/15/06 12:02:13 [Note]: 7011 1292
09/15/06 12:02:13 [Note]: 7026 0
09/15/06 12:02:13 [Note]: 7026 0
09/15/06 12:02:13 [Note]: 7024 3
09/15/06 12:02:13 [Info]: Hidden process: C:\windows\system32\reykvrbgkv.exe
09/15/06 12:02:13 [Note]: FSRAW library version 1.7.1019
09/15/06 12:05:17 [Info]: Hidden file: c:\WINDOWS\system32\reykvrbgkv.dat
09/15/06 12:05:17 [Note]: 10002 1
09/15/06 12:05:17 [Info]: Hidden file: C:\windows\system32\reykvrbgkv.exe
09/15/06 12:05:17 [Note]: 10002 1
09/15/06 12:05:18 [Info]: Hidden file: c:\WINDOWS\system32\reykvrbgkv_nav.dat
09/15/06 12:05:18 [Note]: 10002 1
09/15/06 12:05:18 [Info]: Hidden file: c:\WINDOWS\system32\reykvrbgkv_navps.dat
09/15/06 12:05:18 [Note]: 10002 1
09/15/06 12:05:37 [Info]: Hidden file: c:\WINDOWS\Prefetch\REYKVRBGKV.EXE-2DF637BF.pf
09/15/06 12:05:37 [Note]: 10002 1
09/15/06 12:06:03 [Note]: 7007 0

a biento
fangiogogo