fenetre intenpestive suite a l'utilisation d'un crack

Salut,

Maintenant tu connais le risque des cracks  

Télécharge Hijackthis (de Trend Micro)
Poste un rapport en suivant ce tuto.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:19:40, on 15/02/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*http://fr.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.fr.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*http://fr.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: {43ed72fb-65f6-d63a-fb84-0d23efd3e8e0} - {0e8e3dfe-32d0-48bf-a36d-6f56bf27de34} - C:\Windows\system32\xeehaaen.dll
O2 - BHO: (no name) - {69D3A76E-E8C8-4267-A70A-B103038A2E51} - C:\Windows\system32\tusqn.dll
O2 - BHO: (no name) - {6FB62B78-ACD6-4673-97DF-89C5370423F2} - C:\Windows\system32\tusqn.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {C0C80C2C-A187-4C9C-9CD9-FD3FD0B6139C} - C:\Windows\system32\sstsq.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Windows\system32\SysMonitor.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [I downloaded pirated Software from P2P 2006] Command Conquer 3 Tiberium Wars
O4 - HKLM\..\Run: [I downloaded pirated Software from P2P ] C:\Windows\system32\Command & Conquer 3 Tiberium Wars.exe
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\awvtu.dll,#1
O4 - HKLM\..\Run: [runner1] C:\Windows\mrofinu2000351.exe 61A847B5BBF72810329B385577F801F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310F3D1DC7E4638E8323A15A04FB79DC4617E6FD967002BA754E1C2832211379A26033AAC
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [74011bfc] rundll32.exe "C:\Windows\system32\tfxyskxn.dll",b
O4 - HKCU\..\Run: [?????????] ??????????????e
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986....
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.ca...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPACl...
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 9417 bytes

alors qu'est ce que sa veut dire je ne voit rien? merci de votre aide

Re,

Bien infectée ^^

Télécharge Combofix (de sUBs) sur ton Bureau.

Désactive temporairement toute protection résidente ! (Antivirus, antispywares..)
Double clique combofix.exe.
Tape sur la touche 1 (Yes) pour démarrer le scan.
Lorsque le scan sera complété, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.

Le rapport se trouve ici : C:\Combofix.txt

moi quand j'ai un problème comme ça, je fais un "full clean" ^^:

- je poste mon log hijack this isi: http://www.hijackthis.de/fr
- si y a un processus bizarre, je fais une recherche internet sur ces processus et regarde si ils sont reconnus comme un virus ou un malware
- mise à jour des antivirus et antispyware
- un scan antivirus avec l'antivirus de l'ordinateur
- je fais des scans antivirus et anti spyware en ligne, avec ceux proposés ici:
http://www.favorisxp.com/antivirus-ligne-anti-spyware-t...
- utilisation du logiciel combofix
- suppression des fichiers temporaires du systéme et internet ainsi que les fichiers de restauration du système.
- on peut aussi néttoyer le registre...

Moi c'est ce que je fais, après dès que j'ai une emmerde, car une emmerde en emméne d'autres ^^

PS:XmichouX, d'après une ancienne rumeur, je croyais que combofix aujourd'hui avait un problème comme quoi il détectait des fichiers normaux comme étant dangeureux, est-ce encore vrai ou le probléme a été corrigé ?

ComboFix 08-02-16.2 - cedric et katia 2008-02-15 20:29:59.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1015 [GMT 1:00]
Endroit: C:\Users\cedric et katia\Desktop\ComboFix.exe
* Création d'un nouveau point de restauration
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\drsmartload.exe
C:\uniq
C:\Windows\mrofinu2000351.exe
C:\Windows\system32\awvtu.dll
C:\Windows\System32\bacdd.ini
C:\Windows\System32\bacdd.ini2
C:\Windows\system32\bxtokfcx.dll
C:\Windows\system32\cmxqdlcb.dll
C:\Windows\system32\ddcab.dll
C:\Windows\system32\dqeuhcfh.dllbox
C:\Windows\system32\efccdbc.dll
C:\Windows\system32\efcyv.dll
C:\Windows\system32\gtefaplu.dll
C:\Windows\System32\huaugopa.ini
C:\Windows\System32\hwbpfvkc.ini
C:\Windows\system32\igcgmsqx.dll
C:\Windows\System32\iklnn.ini
C:\Windows\System32\iklnn.ini2
C:\Windows\system32\nnlki.dll
C:\Windows\System32\nqsut.ini
C:\Windows\System32\nqsut.ini2
C:\Windows\System32\nxksyxft.ini
C:\Windows\system32\opnkjji.dll
C:\Windows\System32\qstss.ini
C:\Windows\System32\qstss.ini2
C:\Windows\system32\sstsq.dll
C:\Windows\system32\tfxyskxn.dll
C:\Windows\system32\tusqn.dll
C:\Windows\system32\uqjshrqp.dll
C:\Windows\system32\xeehaaen.dll
C:\Windows\System32\xqsmgcgi.ini

.
((((((((((((((((((((((((((((( Fichiers créés 2008-01-16 to 2008-02-16 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans cet espace de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-15 19:18 --------- d-----w C:\Program Files\Trend Micro
2008-02-15 18:01 --------- d-----w C:\Program Files\Alwil Software
2008-02-14 14:22 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-02-14 14:19 54,784 ----a-w C:\Windows\system32\drivers\i8042prt.sys
2008-02-14 14:19 495,160 ----a-w C:\Windows\system32\drivers\Wdf01000.sys
2008-02-14 14:19 35,384 ----a-w C:\Windows\system32\drivers\WdfLdr.sys
2008-02-14 14:19 35,384 ----a-w C:\Windows\system32\drivers\kbdclass.sys
2008-02-14 14:19 34,360 ----a-w C:\Windows\system32\drivers\mouclass.sys
2008-02-14 14:19 19,968 ----a-w C:\Windows\system32\drivers\sermouse.sys
2008-02-14 14:19 15,872 ----a-w C:\Windows\system32\drivers\mouhid.sys
2008-02-14 14:16 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-02-14 14:16 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
2008-02-14 14:16 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-02-14 14:16 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-02-14 14:16 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
2008-02-14 14:16 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys
2008-02-14 14:16 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
2008-02-14 14:15 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-14 14:15 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-14 14:15 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-14 14:15 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-14 14:13 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-13 19:02 --------- d-----w C:\Program Files\ImgBurn
2008-02-13 19:00 50,638 ----a-w C:\Program Files\serial.zip
2008-02-13 19:00 50,638 ----a-w C:\Program Files\serial.dat
2008-02-13 17:44 47,062 ----a-w C:\yidknjo.exe
2008-02-13 17:44 47,062 ----a-w C:\wuxlbsl.exe
2008-02-13 17:44 47,062 ----a-w C:\rtos.exe
2008-02-13 17:44 47,062 ----a-w C:\Program Files\secure32.html
2008-02-13 17:44 47,062 ----a-w C:\Program Files\cqwydcgt.exe
2008-02-13 17:44 47,062 ----a-w C:\kosjlqeb.exe
2008-02-13 17:44 47,062 ----a-w C:\jojg.exe
2008-02-13 17:43 47,062 ----a-w C:\vesuyym.exe
2008-02-13 17:43 47,062 ----a-w C:\sfokuk.exe
2008-02-13 17:43 47,062 ----a-w C:\rrhedgnt.exe
2008-02-13 17:43 47,062 ----a-w C:\exwfrso.exe
2008-02-13 17:43 --------- d-----w C:\Program Files\serial2
2008-02-12 13:52 --------- d-----w C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium
2008-02-12 13:34 --------- d-----w C:\Program Files\Electronic Arts
2008-02-11 19:50 --------- d-----w C:\Program Files\Common Files\ArcSoft
2008-02-11 19:46 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-11 19:46 --------- d-----w C:\Program Files\Hercules
2008-02-11 16:33 --------- d-----w C:\Users\cedric et katia\AppData\Roaming\ArcSoft
2008-02-10 19:37 --------- d-----w C:\ProgramData\GRAW2
2008-02-10 19:35 --------- d-----w C:\ProgramData\ATI
2008-02-10 19:35 --------- d-----w C:\Program Files\ATI
2008-02-10 19:32 --------- d-----w C:\Program Files\ATI Technologies
2008-02-10 19:22 --------- d-----w C:\Program Files\AGEIA Technologies
2008-02-10 19:21 --------- d-----w C:\ProgramData\Media Center Programs
2008-02-10 19:21 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-10 19:14 --------- d-----w C:\Program Files\UBISOFT
2008-02-10 19:02 --------- d-----w C:\Users\cedric et katia\AppData\Roaming\InstallShield
2008-02-07 12:44 --------- d-----w C:\Program Files\Common Files\NewTech Infosystems
2008-02-07 12:41 --------- d-----w C:\Program Files\GameSpy Arcade
2008-02-07 12:40 --------- d-----w C:\Program Files\WinTV
2008-02-06 17:10 --------- d-----w C:\Program Files\Windows Defender
2008-02-04 14:30 --------- d-----w C:\Users\cedric et katia\AppData\Roaming\WarZone
2008-02-04 14:30 --------- d-----w C:\Program Files\WarZone
2008-02-04 10:53 1,054,829 ----a-w C:\Windows\Prison Tycoon 3 Uninstaller.exe
2008-02-04 10:42 --------- d-----w C:\Users\cedric et katia\AppData\Roaming\BitTorrent
2008-02-04 10:36 --------- d-----w C:\Program Files\ValuSoft
2008-02-04 10:36 --------- d-----w C:\Program Files\Common Files\Thraex Software
2008-01-19 13:54 --------- d-----w C:\Program Files\Common Files\Steam
2008-01-14 18:46 9,302 ----a-w C:\Windows\dr.exe
2008-01-11 21:28 --------- d-----w C:\Program Files\Windows Sidebar
2008-01-11 21:28 --------- d-----w C:\Program Files\Windows Mail
2008-01-11 08:50 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys
2008-01-11 08:50 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys
2007-12-21 15:37 --------- d-----w C:\Program Files\MSN Messenger
2007-12-21 15:37 --------- d-----w C:\Program Files\Messenger Plus! Live
2007-12-21 03:55 3,478,528 ----a-w C:\Windows\system32\drivers\atikmdag.sys
2007-12-21 02:09 49,152 ----a-w C:\Windows\system32\drivers\ati2erec.dll
2007-08-30 13:23 174 --sha-w C:\Program Files\desktop.ini
2006-07-23 18:10 484,522 --sha-r C:\Program Files\serial.tde
2006-05-28 16:46 397,306 ----a-w C:\Program Files\wunauclt.zip
2006-05-28 16:46 397,306 ----a-w C:\Program Files\wunauclt.tbe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"????r"="" []
"?????????"="??????????????e" []
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 13:35 125440]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 12:32 94208]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 23:29 165784]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 13:36 201728]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [2007-09-08 00:01 43008]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-06-07 07:04 1006264]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 14:37 4186112 C:\Windows\RtHDVCpl.exe]
"Acer Tour"="" []
"Acer Empowering Technology Monitor"="C:\Windows\system32\SysMonitor.exe" [2006-11-23 15:24 319488]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-01-19 15:19 90191]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-01-19 15:19 7770112]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-01-19 15:19 81920]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 20:48 57344]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-06 23:04 464168]
"eRecoveryService"="" []
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 20:52 49152]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-12-14 17:57 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-12-14 17:51 217088]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"NeroCheck"="C:\Windows\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [ ]
"NWEReboot"="" []
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"I downloaded pirated Software from P2P 2006"="Command Conquer 3 Tiberium Wars" []
"I downloaded pirated Software from P2P "="C:\Windows\system32\Command & Conquer 3 Tiberium Wars.exe" [ ]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06 29696]
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2006-01-06 19:05:26 528384]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 20:40:10 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\Windows\system32\tusqn.dll

R0 PSDFilter;PSDFilter;C:\Windows\system32\DRIVERS\psdfilter.sys [2007-02-06 23:04]
R0 PSDNServ;PSDNSERVER;C:\Windows\system32\drivers\PSDNServ.sys [2007-02-06 23:04]
R0 psdvdisk;psdvdisk;C:\Windows\system32\drivers\psdvdisk.sys [2006-11-08 15:11]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2007-12-04 15:52]
R2 eDataSecurity Service;eDSService.exe;"C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe" [2007-02-06 23:04]
R2 int15;int15;C:\Acer\Empowering Technology\eRecovery\int15.sys [2006-12-07 17:12]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-12-21 04:55]
R3 HCWBT8xx;Hauppauge WinTV 848/9 WDM Video Driver;C:\Windows\system32\drivers\HCWBT8XX.sys [2006-01-25 15:14]
R3 ovt530;Webcam Classic;C:\Windows\system32\Drivers\ov530vid.sys [2005-03-15 17:04]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2006-11-09 02:52]
S3 HCW713x;Hauppauge 713x VU PCI TV Card;C:\Windows\system32\DRIVERS\HCW713x.sys [2007-03-26 13:46]
S3 Ph3xIB32;Philips 713x VU PCI TV Card;C:\Windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 09:43]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\Windows\system32\DRIVERS\ss_bus.sys [2005-08-30 16:57]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\Windows\system32\DRIVERS\ss_mdfl.sys [2005-08-30 16:58]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\Windows\system32\DRIVERS\ss_mdm.sys [2005-08-30 16:59]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-01-11 22:32]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6ef4ba55-1433-11dc-8b32-806e6f6e6963}]
\shell\AutoRun\command - E:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b22f09f0-2c82-11dc-ad08-001921e98b53}]
\shell\AutoRun\command - K:\RunGame.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b22f09f2-2c82-11dc-ad08-001921e98b53}]
\shell\AutoRun\command - L:\RunGame.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cd9b2cee-2729-11dc-a8f8-001921e98b53}]
\shell\AutoRun\command - J:\Setup.exe

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-02-13 18:49:53 C:\Windows\Tasks\At1.job"
- C:\Windows\system32\wunauclt.exe
"2008-02-13 19:06:06 C:\Windows\Tasks\At10.job"
- C:\Windows\user32.exe
"2008-02-13 19:00:45 C:\Windows\Tasks\At2.job"
- C:\Windows\system32\wunauclt.exe
"2008-02-13 18:49:53 C:\Windows\Tasks\At3.job"
- C:\Windows\system32\wunauclt.exe
"2008-02-13 18:49:53 C:\Windows\Tasks\At4.job"
- C:\Windows\dr.exe
"2008-02-13 19:01:10 C:\Windows\Tasks\At5.job"
- C:\Windows\user32.exe
"2008-02-13 18:49:53 C:\Windows\Tasks\At6.job"
- C:\Windows\dr.exe
"2008-02-13 18:49:53 C:\Windows\Tasks\At7.job"
- C:\Windows\system32\wunauclt.exe
"2008-02-13 18:49:53 C:\Windows\Tasks\At8.job"
- C:\Windows\system32\wunauclt.exe
"2008-02-13 19:00:45 C:\Windows\Tasks\At9.job"
- C:\Windows\system32\wunauclt.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-16 20:37:06
Windows 6.0.6000 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-02-16 20:39:32
ComboFix-quarantined-files.txt 2008-02-16 19:39:28
.
2008-02-15 17:46:28 --- E O F ---

moi je ne croit pas trop au anti virus en ligne car il te mette toujours des trucs en plus pour que tu achete leur antivirus car il a lair de trouver pleins de chose... sinon tout allait bien avant c'est des que j'ai insataller ce crack de mer**

et maintenant je dois faire quoi?

Re,

Télécharge Purity.zip
Dézippe-le sur le bureau..
Redémarre en mode sans échec
/!\ Ne jamais démarrer en mode sans échec via MSCONFIG /!\
Doublie clique sur le dossier Purity. Exécute Purity.bat . (L%u2019extension bat peut ne pas apparaître)
Le bloc note va s%u2019ouvrir. Poste le rapport ici.
Le rapport se trouve dans le dossier Purity : >Purity.txt<

**************

Désinstalle via ajout/suppr de programmes :

Command & Conquer 3 Les guerres du Tiberium

**************

Copie le texte se situant dans le cadre ci-dessous :

File::
C:\Windows\system32\wunauclt.exe
C:\Windows\user32.exe
C:\Windows\dr.exe
C:\Windows\Tasks\At1.job
C:\Windows\Tasks\At2.job
C:\Windows\Tasks\At3.job
C:\Windows\Tasks\At4.job
C:\Windows\Tasks\At5.job
C:\Windows\Tasks\At6.job
C:\Windows\Tasks\At7.job
C:\Windows\Tasks\At8.job
C:\Windows\Tasks\At9.job
C:\Windows\Tasks\At10.job
C:\Windows\system32\tusqn.dll
C:\Windows\system32\Command & Conquer 3 Tiberium Wars.exe
C:\Windows\Prison Tycoon 3 Uninstaller.exe
C:\Program Files\serial.zip
C:\Program Files\serial.dat
C:\yidknjo.exe
C:\wuxlbsl.exe
C:\rtos.exe
C:\Program Files\secure32.html
C:\Program Files\cqwydcgt.exe
C:\kosjlqeb.exe
C:\jojg.exe
C:\vesuyym.exe
C:\sfokuk.exe
C:\rrhedgnt.exe
C:\exwfrso.exe

Folder::
C:\Windows\system32\Command Conquer 3 Tiberium Wars
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium
C:\Program Files\serial2

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"????r"=-
"?????????"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"=-
"NeroFilterCheck"=-
"I downloaded pirated Software from P2P 2006"=-
"I downloaded pirated Software from P2P "=-

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :


Cela va relancer Combofix, tape sur 1 puis valide. Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

fix lancé en mode sans echec
Rapport Purity 0.02 lancé [1] fois! le 16/02/2008 à 21:05:52,58
Liste des éléments rencontrés au cours de la Recherche...

Aucun élément nuisible rencontré.

Fin du rapport
ComboFix 08-02-16.2 - cedric et katia 2008-02-16 21:54:00.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1065 [GMT 1:00]
Endroit: C:\Users\cedric et katia\Desktop\ComboFix.exe
Command switches used :: C:\Users\cedric et katia\Desktop\CFScript.txt
* Création d'un nouveau point de restauration

FILE
C:\exwfrso.exe
C:\jojg.exe
C:\kosjlqeb.exe
C:\Program Files\cqwydcgt.exe
C:\Program Files\secure32.html
C:\Program Files\serial.dat
C:\Program Files\serial.zip
C:\rrhedgnt.exe
C:\rtos.exe
C:\sfokuk.exe
C:\vesuyym.exe
C:\Windows\dr.exe
C:\Windows\Prison Tycoon 3 Uninstaller.exe
C:\Windows\system32\Command & Conquer 3 Tiberium Wars.exe
C:\Windows\system32\tusqn.dll
C:\Windows\system32\wunauclt.exe
C:\Windows\Tasks\At1.job
C:\Windows\Tasks\At10.job
C:\Windows\Tasks\At2.job
C:\Windows\Tasks\At3.job
C:\Windows\Tasks\At4.job
C:\Windows\Tasks\At5.job
C:\Windows\Tasks\At6.job
C:\Windows\Tasks\At7.job
C:\Windows\Tasks\At8.job
C:\Windows\Tasks\At9.job
C:\Windows\user32.exe
C:\wuxlbsl.exe
C:\yidknjo.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\exwfrso.exe
C:\jojg.exe
C:\kosjlqeb.exe
C:\Program Files\cqwydcgt.exe
C:\Program Files\secure32.html
C:\Program Files\serial.dat
C:\Program Files\serial.zip
C:\Program Files\serial2
C:\rrhedgnt.exe
C:\rtos.exe
C:\sfokuk.exe
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\MapPreviews\data_maps_official_map_mp_2_simon_map_mp_2_simon.tga
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\GSVoice.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\hotkeys.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\IDB\000_GDI_Internal_MemosIDB.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\IDB\001_GDI_News_AlertIDB.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\IDB\002_GDI_Field_ReconIDB.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\IDB\003_GDI_WeaponryIDB.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\IDB\005_GDI_BackgroundIDB.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\IDB\006_Nod_Internal_MemosIDB.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\IDB\008_Nod_Field_ReconIDB.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\IDB\009_Nod_WeaponryIDB.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\IDB\010_Nod_RumorsIDB.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\IDB\011_Nod_BackgroundIDB.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\IDB\012_Alien_Internal_MemosIDB.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\movies.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\Options.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\ProfileData.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\Skirmish.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\Stats_CAMPAIGN_GAME.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\Stats_LAN_GAME.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\Stats_ONLINE_CLAN_1V1_GAME.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\Stats_ONLINE_CLAN_2V2_GAME.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\Stats_ONLINE_RANKED_1V1_GAME.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\Stats_ONLINE_RANKED_2V2_GAME.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\Stats_ONLINE_UNRANKED_GAME.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\cedric\Stats_SKIRMISH_GAME.ini
C:\Users\cedric et katia\AppData\Roaming\Command & Conquer 3 Les guerres du Tiberium\Profils\directory.ini
C:\vesuyym.exe
C:\Windows\dr.exe
C:\Windows\Prison Tycoon 3 Uninstaller.exe
C:\Windows\Tasks\At1.job
C:\Windows\Tasks\At10.job
C:\Windows\Tasks\At2.job
C:\Windows\Tasks\At3.job
C:\Windows\Tasks\At4.job
C:\Windows\Tasks\At5.job
C:\Windows\Tasks\At6.job
C:\Windows\Tasks\At7.job
C:\Windows\Tasks\At8.job
C:\Windows\Tasks\At9.job
C:\wuxlbsl.exe
C:\yidknjo.exe

.
((((((((((((((((((((((((((((( Fichiers créés 2008-01-16 to 2008-02-16 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans cet espace de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-15 19:18 --------- d-----w C:\Program Files\Trend Micro
2008-02-15 18:01 --------- d-----w C:\Program Files\Alwil Software
2008-02-14 14:22 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-02-14 14:19 54,784 ----a-w C:\Windows\system32\drivers\i8042prt.sys
2008-02-14 14:19 495,160 ----a-w C:\Windows\system32\drivers\Wdf01000.sys
2008-02-14 14:19 35,384 ----a-w C:\Windows\system32\drivers\WdfLdr.sys
2008-02-14 14:19 35,384 ----a-w C:\Windows\system32\drivers\kbdclass.sys
2008-02-14 14:19 34,360 ----a-w C:\Windows\system32\drivers\mouclass.sys
2008-02-14 14:19 19,968 ----a-w C:\Windows\system32\drivers\sermouse.sys
2008-02-14 14:19 15,872 ----a-w C:\Windows\system32\drivers\mouhid.sys
2008-02-14 14:16 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-02-14 14:16 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
2008-02-14 14:16 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-02-14 14:16 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-02-14 14:16 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
2008-02-14 14:16 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys
2008-02-14 14:16 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
2008-02-14 14:15 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-14 14:15 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-14 14:15 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-14 14:15 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-14 14:13 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-13 19:02 --------- d-----w C:\Program Files\ImgBurn
2008-02-12 13:34 --------- d-----w C:\Program Files\Electronic Arts
2008-02-11 19:50 --------- d-----w C:\Program Files\Common Files\ArcSoft
2008-02-11 19:46 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-11 19:46 --------- d-----w C:\Program Files\Hercules
2008-02-11 16:33 --------- d-----w C:\Users\cedric et katia\AppData\Roaming\ArcSoft
2008-02-10 19:37 --------- d-----w C:\ProgramData\GRAW2
2008-02-10 19:35 --------- d-----w C:\ProgramData\ATI
2008-02-10 19:35 --------- d-----w C:\Program Files\ATI
2008-02-10 19:32 --------- d-----w C:\Program Files\ATI Technologies
2008-02-10 19:22 --------- d-----w C:\Program Files\AGEIA Technologies
2008-02-10 19:21 --------- d-----w C:\ProgramData\Media Center Programs
2008-02-10 19:21 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-10 19:14 --------- d-----w C:\Program Files\UBISOFT
2008-02-10 19:02 --------- d-----w C:\Users\cedric et katia\AppData\Roaming\InstallShield
2008-02-07 12:44 --------- d-----w C:\Program Files\Common Files\NewTech Infosystems
2008-02-07 12:41 --------- d-----w C:\Program Files\GameSpy Arcade
2008-02-07 12:40 --------- d-----w C:\Program Files\WinTV
2008-02-06 17:10 --------- d-----w C:\Program Files\Windows Defender
2008-02-04 14:30 --------- d-----w C:\Users\cedric et katia\AppData\Roaming\WarZone
2008-02-04 14:30 --------- d-----w C:\Program Files\WarZone
2008-02-04 10:42 --------- d-----w C:\Users\cedric et katia\AppData\Roaming\BitTorrent
2008-02-04 10:36 --------- d-----w C:\Program Files\ValuSoft
2008-02-04 10:36 --------- d-----w C:\Program Files\Common Files\Thraex Software
2008-01-19 13:54 --------- d-----w C:\Program Files\Common Files\Steam
2008-01-11 21:28 --------- d-----w C:\Program Files\Windows Sidebar
2008-01-11 21:28 --------- d-----w C:\Program Files\Windows Mail
2008-01-11 08:50 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys
2008-01-11 08:50 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys
2007-12-21 15:37 --------- d-----w C:\Program Files\MSN Messenger
2007-12-21 15:37 --------- d-----w C:\Program Files\Messenger Plus! Live
2007-12-21 03:55 3,478,528 ----a-w C:\Windows\system32\drivers\atikmdag.sys
2007-12-21 02:09 49,152 ----a-w C:\Windows\system32\drivers\ati2erec.dll
2007-08-30 13:23 174 --sha-w C:\Program Files\desktop.ini
2006-07-23 18:10 484,522 --sha-r C:\Program Files\serial.tde
2006-05-28 16:46 397,306 ----a-w C:\Program Files\wunauclt.zip
2006-05-28 16:46 397,306 ----a-w C:\Program Files\wunauclt.tbe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"????r"="" []
"?????????"="??????????????e" []
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 13:35 125440]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 12:32 94208]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 23:29 165784]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 13:36 201728]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [2007-09-08 00:01 43008]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-06-07 07:04 1006264]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 14:37 4186112 C:\Windows\RtHDVCpl.exe]
"Acer Tour"="" []
"Acer Empowering Technology Monitor"="C:\Windows\system32\SysMonitor.exe" [2006-11-23 15:24 319488]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-01-19 15:19 90191]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-01-19 15:19 7770112]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-01-19 15:19 81920]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 20:48 57344]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-06 23:04 464168]
"eRecoveryService"="" []
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 20:52 49152]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-12-14 17:57 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-12-14 17:51 217088]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [ ]
"NWEReboot"="" []
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06 29696]
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2006-01-06 19:05:26 528384]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 20:40:10 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

R0 PSDFilter;PSDFilter;C:\Windows\system32\DRIVERS\psdfilter.sys [2007-02-06 23:04]
R0 PSDNServ;PSDNSERVER;C:\Windows\system32\drivers\PSDNServ.sys [2007-02-06 23:04]
R0 psdvdisk;psdvdisk;C:\Windows\system32\drivers\psdvdisk.sys [2006-11-08 15:11]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2007-12-04 15:52]
R2 eDataSecurity Service;eDSService.exe;"C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe" [2007-02-06 23:04]
R2 int15;int15;C:\Acer\Empowering Technology\eRecovery\int15.sys [2006-12-07 17:12]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-12-21 04:55]
R3 HCWBT8xx;Hauppauge WinTV 848/9 WDM Video Driver;C:\Windows\system32\drivers\HCWBT8XX.sys [2006-01-25 15:14]
R3 ovt530;Webcam Classic;C:\Windows\system32\Drivers\ov530vid.sys [2005-03-15 17:04]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2006-11-09 02:52]
S3 HCW713x;Hauppauge 713x VU PCI TV Card;C:\Windows\system32\DRIVERS\HCW713x.sys [2007-03-26 13:46]
S3 Ph3xIB32;Philips 713x VU PCI TV Card;C:\Windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 09:43]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\Windows\system32\DRIVERS\ss_bus.sys [2005-08-30 16:57]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\Windows\system32\DRIVERS\ss_mdfl.sys [2005-08-30 16:58]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\Windows\system32\DRIVERS\ss_mdm.sys [2005-08-30 16:59]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-01-11 22:32]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6ef4ba55-1433-11dc-8b32-806e6f6e6963}]
\shell\AutoRun\command - E:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b22f09f0-2c82-11dc-ad08-001921e98b53}]
\shell\AutoRun\command - K:\RunGame.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b22f09f2-2c82-11dc-ad08-001921e98b53}]
\shell\AutoRun\command - L:\RunGame.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cd9b2cee-2729-11dc-a8f8-001921e98b53}]
\shell\AutoRun\command - J:\Setup.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-16 21:59:42
Windows 6.0.6000 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\WerFault.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Windows\system32\WUDFHost.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-02-16 22:02:25 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-16 21:02:19
ComboFix2.txt 2008-02-16 19:39:33
.
2008-02-15 17:46:28 --- E O F ---
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:03:11, on 16/02/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\ehome\ehmsas.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\Explorer.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\notepad.exe
C:\Windows\system32\conime.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.fr.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*http://fr.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Windows\system32\SysMonitor.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [?????????] ??????????????e
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986....
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.ca...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPACl...
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 7926 bytes
voila le tout merci bcp de m'aider

esce que c'est terminé?

ya quelqu'un??

Re,

Merci de patienter. Nous sommes bénévoles, ce n'est pas notre métier, nous avons une vie en dehors !

Va dans démarrer, exécuter, tape regedit.

Va dans cette clef :
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

Cherche et supprime ces valeurs si tu les trouves :
"????r"
"?????????"

Sinon, dis moi si tu vois quelque chose qui y ressemble.

oui je me doute   je faisait sa juste pour que mon message reste en haut des sujets... alors dans ma base de registre ce qui est peut etre bizarre ;
ehTray.exe reg sz c windows ehome ehtray.exe
et j'ai deux clefs ou c'est ecrit en caractere chinois...

Peux-tu faire un screenshot pour celles en caractère chinois ?

si tu me dit comment on fait pas soucis ;-)

http://forum.forumactif.com/questions-reponses-frequent...
Ensuite tu l'héberges sur un hébergeur d'images :
par exemple: hiboox, zimagez, imageshack ... et tu mets le lien sur le forum  

http://www.servimg.com/image_preview.php?i=1&u=11998009
http://i28.servimg.com/u/f28/11/99/80/09/sans_t10.jpg
jespere que sa marche...

Supprime les et reposte un Hijackthis.

ok et sa a l'air daller j'ai plus les fenetre msdos ni les pub! tes trop fort :-)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:33:44, on 16/02/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\SysMonitor.exe
C:\Windows\System32\rundll32.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Windows\ehome\ehmsas.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.fr.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*http://fr.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Windows\system32\SysMonitor.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986....
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.ca...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPACl...
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe

--
End of file - 7883 bytes

Bien.

Télécharge sur ton bureau : Clean (de Malekal) >Tuto<
Dézippe le sur ton bureau. Double-clic sur ce dossier clean.
Double-clic sur clean.cmd. (L’extension cmd peut ne pas apparaître) Cela va ouvrir une fenêtre noire.
Un menu va apparaître, choisis l'option 1 puis entrée. Ensuite appuies sur une touche comme il te sera demandé et poste le rapport ici.
Le rapport se trouve ici : C:\rapport_clean.txt

Si tu obtiens un fichier C:\upload_moi.zip, merci de faire ceci.

**************

Désinstalle avast, redémarre et supprime ~~>C:\Program Files\Alwil Software

Télécharge ccleaner (>>tuto à lire !<<), tu download «the latest version » puis installe le en décochant - Ajouter la Barre d'Outils Yahoo! CCleaner
Puis lance le nettoyage, puis fais chercher des erreurs et sauvegardes si tu le souhaites.

Télécharge et installe Antivir. (tuto)
Pourquoi changer ? Avast vs Antivir
Vérifie qu’il soit bien à jour ! Fais une analyse complète, poste le rapport.

je pense que je vais faire sa demain ou quoi car je suis hs et je bosse demain matin, merci beaucoup beaucoup en tout cas c'est vraiment sympas de consacrer du temps a des novices comme moi, bonne nuit

J'te l'avais dit k_nibal, c'est des pros ici  

oui, moi avec ma méthode, j'ai plus qu'à me prosterner ^^

chapeau les gars !!