Problème de périphérique ?

Salut Etienne

Bizarre cette histoire.
Et ça arrive dès que tu branches un périphérique externe ? Tu branches quoi sur ta prise usb ?

Re

Ça m'étonnerait que ce soit lié à un virus, surtout si ça le fait aussi avec une webcam. A côté de ça, le lecteur CD ... donc a priori, ce n'est pas un problème d'usb.

Juste au cas où.

Télécharge UsbFix (de Chiquitine29 et C_XX) sur ton Bureau.

/!\ Déconnecte-toi et ferme toutes les applications en cours /!\
/!\ Branche tous tes périphériques ayant pu être infectés (clés usb, disque dur externe, etc ...) /!\

• Double-clique sur "UsbFix" pour lancer le programme
  (Utilisateur de Vista/Windows 7, clique-droit sur UsbFix > Exécuter en tant qu'administrateur)
  
• Tape "F" pour français et valide avec la touche "Entrée"
  
• Tape ensuite "1" pour "Rechercher" et valide
  
• Laisse travailler l'outil
  
• A la fin, un rapport apparaitra (sinon, il est situé ici C:\Usbfix.txt). Poste-le dans ta prochaine réponse

Une aide à l'utilisation ici

Re
Voici mes rapport : le premier est avec mon mp4 et le deuxiéme avec mon autre mp4 et apprès avoir fait supression après le premier rapport
______________________________________________________________________________

############################## | UsbFix V6.073 |

User : Etienne (Administrateurs) # 5A8C6EC0D
Update on 09/01/2010 by El Desaparecido , C_XX & Chimay8
Start at: 23:09:22 | 09/01/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Pentium(R) 4 CPU 3.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : Bitdefender Antivirus 8.0 [ Enabled | Updated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 149,05 Go (65,45 Go free) # NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM
F:\ -> Disque amovible # 971,62 Mo (562,91 Mo free) # FAT

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe 628
C:\WINDOWS\system32\csrss.exe 684
C:\WINDOWS\system32\winlogon.exe 708
C:\WINDOWS\system32\services.exe 752
C:\WINDOWS\system32\lsass.exe 764
C:\WINDOWS\system32\svchost.exe 932
C:\WINDOWS\system32\svchost.exe 1012
C:\WINDOWS\System32\svchost.exe 1108
C:\WINDOWS\system32\svchost.exe 1196
C:\WINDOWS\system32\svchost.exe 1240
C:\WINDOWS\system32\spoolsv.exe 1364
C:\WINDOWS\system32\svchost.exe 1504
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe 1544
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 1556
C:\Program Files\Bonjour\mDNSResponder.exe 1572
C:\Program Files\GreenPrint\GPSRHT01.exe 1616
C:\Program Files\Java\jre6\bin\jqs.exe 1724
C:\WINDOWS\system32\nvsvc32.exe 1776
C:\Program Files\Fichiers communs\Portrait Displays\Drivers\pdisrvc.exe 1796
C:\WINDOWS\system32\svchost.exe 1832
C:\Program Files\Winsudate\gibsvc.exe 1856
C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe 1876
C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe 1888
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe 2036
C:\WINDOWS\System32\svchost.exe 624
C:\WINDOWS\System32\alg.exe 660
C:\WINDOWS\system32\wbem\wmiapsrv.exe 1908
C:\WINDOWS\explorer.exe 2116
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe 2384
C:\WINDOWS\system32\RUNDLL32.EXE 2648
C:\WINDOWS\SOUNDMAN.EXE 2656
C:\WINDOWS\ALCWZRD.EXE 2664
C:\Program Files\Logitech\Video\LogiTray.exe 2776
C:\Program Files\iTunes\iTunesHelper.exe 2844
C:\Program Files\Java\jre6\bin\jusched.exe 2856
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe 2864
C:\WINDOWS\system32\LVComS.exe 2904
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ArcCon.ac 2944
C:\Program Files\Philips\GoGear VIBE Device Manager\GoGear_Vibe_DeviceManager.exe 2960
C:\Program Files\iPod\bin\iPodService.exe 3064
C:\Program Files\GreenPrint\gpsrdg01.exe 3456
C:\WINDOWS\Explorer.EXE 3508
C:\WINDOWS\system32\RUNDLL32.EXE 3768
C:\WINDOWS\SOUNDMAN.EXE 3780
C:\WINDOWS\ALCWZRD.EXE 3800
C:\Program Files\iTunes\iTunesHelper.exe 3876
C:\WINDOWS\system32\ctfmon.exe 3900
C:\Program Files\Windows Live\Messenger\msnmsgr.exe 3916
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 3948
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe 3956
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe 4040
C:\Program Files\OpenOffice.org 3\program\soffice.exe 4076
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe 280
C:\Program Files\OpenOffice.org 3\program\soffice.bin 432
C:\Program Files\Windows Live\Contacts\wlcomm.exe 2816
C:\Program Files\SpeedFan\speedfan.exe 2804
C:\Program Files\Mozilla Firefox\firefox.exe 1948
C:\WINDOWS\system32\wbem\wmiprvse.exe 2632

################## | Elements infectieux |


################## | Registre |

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableTaskMgr"

################## | Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\H
Shell\AutoRun\command =H:\LaunchU3.exe -a

################## | Cracks > Keygens > Serials |

"C:\Documents and Settings\Etienne Diouf\Bureau\NFS Shift\eed.Shift-RELOADED.UpByNOx.For.AK-TEAM\Crack\rld-nfss.exe"
16/09/2009 00:49 |Size 8192 |Crc32 5b2dc441 |Md5 1835ca2538b43ceac957f34fd43812bd

"C:\Documents and Settings\Etienne Diouf\Bureau\NFS Shift\eed.Shift-RELOADED.UpByNOx.For.AK-TEAM\Crack\shift.exe"
15/09/2009 23:55 |Size 8736256 |Crc32 d39bc02d |Md5 6872d63eee336d8b00d5b0d613553f7c

"C:\Program Files\EA GAMES\Les Sims 2\TSBin\Crack_Sims2.exe"
25/09/2004 21:37 |Size 661343 |Crc32 5df1677e |Md5 de928491932b72e9fccd20fb358249b9

"C:\Documents and Settings\Etienne Diouf\Bureau\GTA\crack-nodvd.zip"
-> Contain : GTA_SA.EXE 14383616 DFLT-N 60% 5759438 07-06-2005 18:59:10 acff1f28


################## | ! Fin du rapport # UsbFix V6.073 ! |
___________________________________________________________________________

############################## | UsbFix V6.073 |

User : Etienne (Administrateurs) # 5A8C6EC0D
Update on 09/01/2010 by El Desaparecido , C_XX & Chimay8
Start at: 23:22:59 | 09/01/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Pentium(R) 4 CPU 3.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : Bitdefender Antivirus 8.0 [ Enabled | Updated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 149,05 Go (65,41 Go free) # NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM
F:\ -> Disque amovible # 3,66 Go (2,69 Go free) [PHILIPS] # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe 628
C:\WINDOWS\system32\csrss.exe 696
C:\WINDOWS\system32\winlogon.exe 720
C:\WINDOWS\system32\services.exe 764
C:\WINDOWS\system32\lsass.exe 776
C:\WINDOWS\system32\svchost.exe 940
C:\WINDOWS\system32\svchost.exe 1024
C:\WINDOWS\System32\svchost.exe 1120
C:\WINDOWS\system32\svchost.exe 1212
C:\WINDOWS\system32\svchost.exe 1316
C:\WINDOWS\system32\spoolsv.exe 1420
C:\WINDOWS\system32\svchost.exe 1532
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe 1588
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 1604
C:\Program Files\Bonjour\mDNSResponder.exe 1620
C:\Program Files\GreenPrint\GPSRHT01.exe 1664
C:\Program Files\Java\jre6\bin\jqs.exe 1796
C:\WINDOWS\system32\nvsvc32.exe 1848
C:\Program Files\Fichiers communs\Portrait Displays\Drivers\pdisrvc.exe 1868
C:\WINDOWS\system32\svchost.exe 1904
C:\Program Files\Winsudate\gibsvc.exe 1928
C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe 1948
C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe 1976
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe 220
C:\WINDOWS\System32\svchost.exe 1104
C:\WINDOWS\System32\alg.exe 1148
C:\WINDOWS\system32\wbem\wmiapsrv.exe 1284
C:\WINDOWS\system32\wbem\wmiprvse.exe 1504
C:\Program Files\GreenPrint\gpsrdg01.exe 2148
C:\WINDOWS\Explorer.EXE 2272
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe 2564
C:\WINDOWS\system32\RUNDLL32.EXE 2764
C:\WINDOWS\SOUNDMAN.EXE 2776
C:\WINDOWS\ALCWZRD.EXE 2784
C:\Program Files\Logitech\Video\LogiTray.exe 2808
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe 2832
C:\Program Files\iTunes\iTunesHelper.exe 2852
C:\Program Files\Java\jre6\bin\jusched.exe 2860
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe 2868
C:\WINDOWS\system32\ctfmon.exe 2876
C:\Program Files\Windows Live\Messenger\msnmsgr.exe 2884
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 2892
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe 2900
C:\Program Files\Philips\GoGear VIBE Device Manager\GoGear_Vibe_DeviceManager.exe 2920
C:\Program Files\OpenOffice.org 3\program\soffice.exe 2936
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe 2944
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe 2956
C:\Program Files\OpenOffice.org 3\program\soffice.bin 2952
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ArcCon.ac 3100
C:\WINDOWS\system32\LVComS.exe 3188
C:\Program Files\iPod\bin\iPodService.exe 3564
C:\Program Files\Windows Live\Contacts\wlcomm.exe 148
C:\WINDOWS\system32\wbem\wmiprvse.exe 2392
C:\WINDOWS\system32\msfeedssync.exe 2796

################## | Elements infectieux |


################## | Registre |

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableTaskMgr"

################## | Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\H
Shell\AutoRun\command =H:\LaunchU3.exe -a

################## | Cracks > Keygens > Serials |

"C:\Documents and Settings\Etienne Diouf\Bureau\NFS Shift\eed.Shift-RELOADED.UpByNOx.For.AK-TEAM\Crack\rld-nfss.exe"
16/09/2009 00:49 |Size 8192 |Crc32 5b2dc441 |Md5 1835ca2538b43ceac957f34fd43812bd

"C:\Documents and Settings\Etienne Diouf\Bureau\NFS Shift\eed.Shift-RELOADED.UpByNOx.For.AK-TEAM\Crack\shift.exe"
15/09/2009 23:55 |Size 8736256 |Crc32 d39bc02d |Md5 6872d63eee336d8b00d5b0d613553f7c

"C:\Program Files\EA GAMES\Les Sims 2\TSBin\Crack_Sims2.exe"
25/09/2004 21:37 |Size 661343 |Crc32 5df1677e |Md5 de928491932b72e9fccd20fb358249b9

"C:\Documents and Settings\Etienne Diouf\Bureau\GTA\crack-nodvd.zip"
-> Contain : GTA_SA.EXE 14383616 DFLT-N 60% 5759438 07-06-2005 18:59:10 acff1f28


################## | ! Fin du rapport # UsbFix V6.073 ! |

Salut

.:Etienne:. a écrit:

apprès avoir fait supression après le premier rapport

Évite de te lancer dans des suppressions sans que les rapports aient été analysés. Parfois les outils désignent des fichiers comme étant infectés, alors qu'il n'en ait rien.

Citation :

C:\Program Files\Winsudate\gibsvc.exe 1856

Lui, il ne devrait pas être là.


Eux non plus d'ailleurs :

Citation :

################## | Cracks > Keygens > Serials |

"C:\Documents and Settings\Etienne Diouf\Bureau\NFS Shift\eed.Shift-RELOADED.UpByNOx.For.AK-TEAM\Crack\rld-nfss.exe"
16/09/2009 00:49 |Size 8192 |Crc32 5b2dc441 |Md5 1835ca2538b43ceac957f34fd43812bd

"C:\Documents and Settings\Etienne Diouf\Bureau\NFS Shift\eed.Shift-RELOADED.UpByNOx.For.AK-TEAM\Crack\shift.exe"
15/09/2009 23:55 |Size 8736256 |Crc32 d39bc02d |Md5 6872d63eee336d8b00d5b0d613553f7c

"C:\Program Files\EA GAMES\Les Sims 2\TSBin\Crack_Sims2.exe"
25/09/2004 21:37 |Size 661343 |Crc32 5df1677e |Md5 de928491932b72e9fccd20fb358249b9

"C:\Documents and Settings\Etienne Diouf\Bureau\GTA\crack-nodvd.zip"
-> Contain : GTA_SA.EXE 14383616 DFLT-N 60% 5759438 07-06-2005 18:59:10 acff1f28

Evite les cracks car pour la plupart ils sont porteurs de virus, et ce n'est pas ton antivirus qui te protégera.


Tu pourrais faire tout ça s'il te plait ?
http://www.bibou0007.com/aide-a-la-desinfection-f8/procedure-a-suivre-avant-de-poster-t2887.htm


Bonne fin de week end

Ok j'éviterais la prochaine fois
Voici mon rapport de MBAM :
______________________________________________________________________________
Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3533
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

10/01/2010 21:32:20
mbam-log-2010-01-10 (21-32-20).txt

Type de recherche: Examen complet (A:\|C:\|D:\|E:\|)
Eléments examinés: 208207
Temps écoulé: 2 hour(s), 14 minute(s), 25 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 5

Processus mémoire infecté(s):
C:\Program Files\Winsudate\gibsvc.exe (Adware.Gibmedia) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winsvc (Adware.Gibmedia) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SafetyCenter (Rogue.SafetyCenter) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Program Files\Winsudate (Adware.Gibmedia) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Program Files\Winsudate\gibsvc.exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibcom.dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibidl.dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibupt.exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibusr.exe (Adware.Gibmedia) -> Quarantined and deleted successfully.

Ok, ça marche

Salut .:Etienne:.

Toujours avec nous ?

Sujet fermé en raison de l'inactivité. Si vous souhaitez réouvrir ce sujet, faites en la demande par MP en indiquant la raison et le lien vers ce sujet. Cela ne s'applique qu'à .:Etienne:.. Pour les autres, créez votre propre sujet.

Sujet réouvert

Voici mon Rapport GMER : http://www.miraclesalad.com/webtools/clip.php?clip=318c

Bonjour
le rapport gmer ne semble pas complet via ton lien
Si c'est le cas peux tu poster la suite ou utiliser ce site pour l'héberger : http://www.cijoint.fr/

Merci

Effectivement...
Voici le nouveau lien : http://www.cijoint.fr/cjlink.php?file=cj201002/cijS1306D8.txt

Bonsoir

• Clique ici pour télécharger OTL (de Old Timer) sur ton bureau
  
• Ferme toutes tes fenêtres, puis double clique sur OTL.exe pour le lancer.
  
• Dans le cadre Custom Scans/Fixes qui est en bas, colle le contenu du cadre ci dessous :
  
  

  Citation :

  :Files
  C:\Documents and Settings\Etienne Diouf\Bureau\NFS Shift\eed.Shift-RELOADED.UpByNOx.For.AK-TEAM\Crack
  C:\Program Files\EA GAMES\Les Sims 2\TSBin\Crack_Sims2.exe
  C:\Documents and Settings\Etienne Diouf\Bureau\GTA\crack-nodvd.zip
  
  :Commands
  [purity]
  [emptytemp]

  Puis clique sur le bouton Run Fix en haut.
  
• Laisse OTL tourner, le pc va redémarrer.
  
• Au redémarrage, un nouveau rapport va s'ouvrir, copie/colle son contenu ici svp

Bonne soirée

Salut

Ok

Bonsoir,
Voici le rapport:
______________________________________________________________
All processes killed
========== FILES ==========
C:\Documents and Settings\Etienne\Bureau\NFS Shift\eed.Shift-RELOADED.UpByNOx.For.AK-TEAM\Crack folder moved successfully.
C:\Program Files\EA GAMES\Les Sims 2\TSBin\Crack_Sims2.exe moved successfully.
C:\Documents and Settings\Etienne\Bureau\GTA\crack-nodvd.zip moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Ls
->Temp folder emptied: 1407 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes

User: Etienne
->Temp folder emptied: 51241677 bytes
->Temporary Internet Files folder emptied: 10578085 bytes
->Java cache emptied: 12118713 bytes
->FireFox cache emptied: 39206699 bytes
->Apple Safari cache emptied: 0 bytes

User: Joseph
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33510 bytes
->Java cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Théo
->Temp folder emptied: 39995 bytes
->Temporary Internet Files folder emptied: 34460222 bytes
->Java cache emptied: 12118713 bytes
->FireFox cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 630411 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 153,00 mb


OTL by OldTimer - Version 3.1.30.1 log created on 02222010_185759

Files\Folders moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Salut Etienne

Qu'en est il de tes problèmes ?

Lance OTL, clique sur Quick Scan et poste le rapport obtenu svp

Bonne soirée

Salut

Tu as quelle version de Bitdefender ?

Si version payante, désinstalle Avast :
http://www.avast.com/fr-fr/uninstall-utility

Si version gratuite de Bitdefender, alors désinstalle le
http://www.bitdefender.fr/KB333-fr--Desinstaller-BitDefender.html

Ok, pour OTL

Bonne journée

Bonjour,
Rapport OTL:
_________________________________________________________________
OTL logfile created on: 24/02/2010 12:03:04 - Run 1
OTL by OldTimer - Version 3.1.30.1 Folder = C:\Documents and Settings\Etienne Diouf\Bureau
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

1 023,00 Mb Total Physical Memory | 402,00 Mb Available Physical Memory | 39,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 79,00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149,05 Gb Total Space | 62,58 Gb Free Space | 41,99% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DIOUF-5A8C6EC0D
Current User Name: Etienne Diouf
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/02/21 21:53:20 | 000,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/02/21 14:29:35 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Etienne Diouf\Bureau\OTL.exe
PRC - [2010/02/11 19:53:42 | 002,756,488 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010/02/11 19:53:39 | 000,040,384 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2010/01/22 19:16:42 | 000,141,608 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe
PRC - [2010/01/22 19:16:30 | 000,545,576 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe
PRC - [2010/01/07 16:07:10 | 001,394,000 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
PRC - [2009/10/21 18:45:24 | 000,654,128 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\BitTorrent\bittorrent.exe
PRC - [2009/10/11 04:17:36 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe
PRC - [2009/10/11 04:17:35 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2009/10/10 13:32:18 | 000,305,664 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ArcCon.ac
PRC - [2009/10/10 13:32:18 | 000,203,264 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
PRC - [2009/09/28 09:42:50 | 000,109,056 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2009/08/19 10:31:42 | 007,418,368 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.bin
PRC - [2009/08/19 10:31:40 | 007,424,000 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.exe
PRC - [2009/07/31 22:30:56 | 000,973,824 | ---- | M] (GreenPrint Technologies LLC.) -- C:\Program Files\GreenPrint\gpsrdg01.exe
PRC - [2009/07/31 22:27:40 | 000,417,792 | ---- | M] (GreenPrint Technologies LLC.) -- C:\Program Files\GreenPrint\gpsrht01.exe
PRC - [2009/07/06 15:04:00 | 001,611,152 | ---- | M] (Philips) -- C:\Program Files\Philips\GoGear VIBE Device Manager\GoGear_Vibe_DeviceManager.exe
PRC - [2009/07/04 15:35:21 | 000,039,408 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2009/06/05 10:48:14 | 000,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2009/03/20 16:08:56 | 000,109,096 | ---- | M] (Portrait Displays, Inc.) -- C:\Program Files\Fichiers communs\Portrait Displays\Drivers\pdisrvc.exe
PRC - [2009/02/06 16:07:48 | 000,027,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Live\Contacts\wlcomm.exe
PRC - [2008/12/12 10:17:38 | 000,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2008/04/14 13:00:00 | 000,979,968 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/04/14 13:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\dwwin.exe
PRC - [2007/03/18 23:05:02 | 000,630,784 | ---- | M] () -- C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
PRC - [2006/05/21 08:43:14 | 000,155,648 | ---- | M] (Y'z@Home) -- C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
PRC - [2005/05/04 03:01:36 | 002,805,248 | ---- | M] (RealTek Semicoductor Corp.) -- C:\WINDOWS\ALCWZRD.EXE
PRC - [2004/09/30 06:35:00 | 000,127,043 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe
PRC - [2004/02/12 15:59:58 | 000,077,824 | ---- | M] (Labtec Inc.) -- C:\Program Files\Logitech\Video\LogiTray.exe
PRC - [2004/01/21 02:24:22 | 000,135,214 | ---- | M] (Labtec Inc.) -- C:\WINDOWS\system32\LVComS.exe


========== Modules (SafeList) ==========

MOD - [2010/02/21 14:29:35 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Etienne Diouf\Bureau\OTL.exe
MOD - [2007/03/18 23:04:22 | 000,069,632 | ---- | M] () -- C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
MOD - [2006/05/21 08:43:14 | 000,053,248 | ---- | M] () -- C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.dll
MOD - [2006/05/03 21:53:54 | 000,174,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\framedyn.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/02/11 19:53:39 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/02/11 19:53:39 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/02/11 19:53:39 | 000,040,384 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/01/22 19:16:30 | 000,545,576 | ---- | M] (Apple Inc.) [On_Demand | Running] -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service)
SRV - [2009/12/10 07:06:14 | 000,182,768 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc)
SRV - [2009/10/11 04:17:35 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Running] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2009/09/28 09:42:50 | 000,109,056 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009/07/31 22:27:40 | 000,417,792 | ---- | M] (GreenPrint Technologies LLC.) [Auto | Running] -- C:\Program Files\GreenPrint\gpsrht01.exe -- (GreenPrint)
SRV - [2009/06/05 10:48:14 | 000,144,712 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009/03/20 16:08:56 | 000,109,096 | ---- | M] (Portrait Displays, Inc.) [Auto | Running] -- C:\Program Files\Fichiers communs\Portrait Displays\Drivers\pdisrvc.exe -- (PdiService)
SRV - [2008/12/12 10:17:38 | 000,238,888 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
SRV - [2004/09/30 06:35:00 | 000,127,043 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://fr.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = fr
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E8 4D D5 70 DE 88 CA 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search the web"
FF - prefs.js..browser.search.defaulturl: "http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch"
FF - prefs.js..browser.startup.homepage: "fr.msn.com"
FF - prefs.js..extensions.enabledItems: illimitux@illimitux.net:3.2
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {e213bb8f-8ebd-11db-96b7-005056c00008}:3.0.0.75
FF - prefs.js..extensions.enabledItems: {c1dffba0-628e-11d9-9669-0800200c9a66}:3.5.0


FF - HKLM\software\mozilla\Firefox\extensions\\{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}: C:\Program Files\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox [2009/12/27 14:18:50 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/21 21:53:36 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/02/21 21:53:35 | 000,000,000 | ---D | M]

[2009/07/02 17:40:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Etienne Diouf\Application Data\Mozilla\Extensions
[2010/02/23 14:46:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Etienne Diouf\Application Data\Mozilla\Firefox\Profiles\7scadlup.default\extensions
[2009/07/19 11:48:57 | 000,000,000 | ---D | M] (PitchDark) -- C:\Documents and Settings\Etienne Diouf\Application Data\Mozilla\Firefox\Profiles\7scadlup.default\extensions\{c1dffba0-628e-11d9-9669-0800200c9a66}
[2009/11/01 19:15:24 | 000,000,000 | ---D | M] (myFireFox) -- C:\Documents and Settings\Etienne Diouf\Application Data\Mozilla\Firefox\Profiles\7scadlup.default\extensions\{e213bb8f-8ebd-11db-96b7-005056c00008}
[2009/07/02 17:47:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Etienne Diouf\Application Data\Mozilla\Firefox\Profiles\7scadlup.default\extensions\ChoiceGuard@Microsoft
[2009/11/10 23:23:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Etienne Diouf\Application Data\Mozilla\Firefox\Profiles\7scadlup.default\extensions\illimitux@illimitux.net
[2010/02/23 14:46:50 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/02/21 21:53:27 | 000,001,516 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-france.xml
[2010/02/21 21:53:28 | 000,001,822 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\cnrtl-tlfi-fr.xml
[2010/02/21 21:53:28 | 000,000,757 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-france.xml
[2010/02/21 21:53:28 | 000,001,426 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-fr.xml
[2010/02/21 21:53:28 | 000,000,652 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-france.xml

O1 HOSTS File: ([2008/04/14 13:00:00 | 000,000,790 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (IEPlugin Class) - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\Program Files\ArcSoft\Media Converter for Philips\Internet Video Downloader\ArcURLRecord.dll (ArcSoft, Inc.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Programme d'aide de l'Assistant de connexion Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe (Labtec Inc.)
O4 - HKLM..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe (Labtec Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [BitTorrent] C:\Program Files\BitTorrent\bittorrent.exe (BitTorrent, Inc.)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Philips GoGear VIBE Device Manager.lnk = C:\Program Files\Philips\GoGear VIBE Device Manager\GoGear_Vibe_DeviceManager.exe (Philips)
O4 - Startup: C:\Documents and Settings\Etienne Diouf\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Documents and Settings\Etienne Diouf\Menu Démarrer\Programmes\Démarrage\RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe ()
O4 - Startup: C:\Documents and Settings\Etienne Diouf\Menu Démarrer\Programmes\Démarrage\Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe (Y'z@Home)
O4 - Startup: C:\Documents and Settings\Etienne Diouf\Menu Démarrer\Programmes\Démarrage\Yahoo! Widgets.lnk = C:\Program Files\Transform XP to Vista\Yahoo! Widgets\Widgets\YahooWidgets.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.240 212.27.40.241
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - File not found
O24 - Desktop Components:0 (Ma page d'accueil) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Etienne Diouf\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Etienne Diouf\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/07/02 12:05:04 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

========== Files/Folders - Created Within 14 Days ==========

[2010/02/24 11:57:51 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2010/02/22 18:57:59 | 000,000,000 | ---D | C] -- C:\_OTL
[2010/02/22 18:56:04 | 000,549,376 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Etienne Diouf\Bureau\OTL.exe
[2010/02/21 23:46:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\appmgmt
[2009/12/28 13:12:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/12/27 21:18:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\ArcSoft
[2009/12/27 21:18:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ArcSoft
[2009/11/10 19:31:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Sun
[2009/11/08 14:04:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Malwarebytes
[2009/11/08 14:03:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Identities
[2009/08/15 16:51:58 | 000,155,136 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347bus.sys
[2009/08/15 16:51:58 | 000,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347prt.sys
[2009/07/02 12:08:44 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2009/07/02 12:08:17 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/07/02 12:08:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft

========== Files - Modified Within 14 Days ==========

[2010/02/24 12:01:14 | 000,000,448 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{2C2C0835-91AD-411B-A421-6271D7EFB0D6}.job
[2010/02/24 11:53:08 | 000,007,883 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010/02/24 11:52:59 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/02/24 11:52:50 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/02/23 22:00:32 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/02/23 14:59:22 | 003,932,160 | -H-- | M] () -- C:\Documents and Settings\Etienne Diouf\NTUSER.DAT
[2010/02/23 14:59:22 | 000,000,184 | -HS- | M] () -- C:\Documents and Settings\Etienne Diouf\ntuser.ini
[2010/02/22 23:06:52 | 000,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\iTunes.lnk
[2010/02/22 19:41:00 | 000,070,397 | ---- | M] () -- C:\Documents and Settings\Etienne Diouf\Bureau\burncdcc.zip
[2010/02/22 19:31:55 | 000,000,121 | ---- | M] () -- C:\WINDOWS\bdagent.INI
[2010/02/22 19:31:53 | 000,081,984 | ---- | M] () -- C:\WINDOWS\System32\bdod.bin
[2010/02/21 14:29:35 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Etienne Diouf\Bureau\OTL.exe
[2010/02/21 13:54:21 | 000,305,152 | ---- | M] () -- C:\Documents and Settings\Etienne Diouf\Bureau\windiag.iso
[2010/02/20 21:11:01 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/02/13 22:32:39 | 000,003,121 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/02/11 19:53:57 | 000,038,848 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\avastSS.scr
[2010/02/11 19:53:36 | 000,153,184 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\aswBoot.exe
[2010/02/11 19:42:34 | 000,046,672 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2010/02/11 19:42:13 | 000,162,512 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2010/02/11 19:39:01 | 000,023,376 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2010/02/11 19:38:34 | 000,100,432 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2010/02/11 19:38:31 | 000,094,800 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2010/02/11 19:38:23 | 000,019,024 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010/02/11 19:38:07 | 000,028,880 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys

========== Files Created - No Company Name ==========

[2010/02/23 22:00:31 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2010/02/22 19:41:00 | 000,070,397 | ---- | C] () -- C:\Documents and Settings\Etienne Diouf\Bureau\burncdcc.zip
[2010/02/21 13:54:21 | 000,305,152 | ---- | C] () -- C:\Documents and Settings\Etienne Diouf\Bureau\windiag.iso
[2009/12/13 16:50:06 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2009/11/21 14:50:09 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\vbzlib1.dll
[2009/11/03 00:20:45 | 000,141,552 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/09/19 13:43:34 | 000,134,671 | ---- | C] () -- C:\WINDOWS\System32\winstanew.dll
[2009/09/19 13:43:34 | 000,000,236 | -H-- | C] () -- C:\Program Files\Fichiers communs\dx.reg
[2009/09/19 13:43:33 | 001,584,149 | ---- | C] () -- C:\WINDOWS\System32\setupapinew.dll
[2009/09/19 13:43:33 | 000,874,502 | ---- | C] () -- C:\WINDOWS\System32\kernel32new.dll
[2009/09/19 13:43:33 | 000,789,525 | ---- | C] () -- C:\WINDOWS\System32\rpcrt4new.dll
[2009/09/19 13:43:33 | 000,681,478 | ---- | C] () -- C:\WINDOWS\System32\msvcrtnew.dll
[2009/09/19 13:43:33 | 000,633,871 | ---- | C] () -- C:\WINDOWS\System32\user32new.dll
[2009/09/19 13:43:33 | 000,376,832 | ---- | C] () -- C:\WINDOWS\System32\M2000Twn.dll
[2009/09/19 13:43:33 | 000,167,948 | ---- | C] () -- C:\WINDOWS\System32\dxgi.dll
[2009/09/19 13:43:33 | 000,096,783 | ---- | C] () -- C:\WINDOWS\System32\powrprofnew.dll
[2009/09/19 13:43:33 | 000,087,558 | ---- | C] () -- C:\WINDOWS\System32\ntdsapinew.dll
[2009/09/19 13:43:33 | 000,072,707 | ---- | C] () -- C:\WINDOWS\System32\secur32new.dll
[2009/09/19 13:43:33 | 000,039,948 | ---- | C] () -- C:\WINDOWS\System32\dwmapi.dll
[2009/09/19 13:43:33 | 000,025,037 | ---- | C] () -- C:\WINDOWS\System32\Nucleus.dll
[2009/09/19 13:43:31 | 001,029,126 | ---- | C] () -- C:\WINDOWS\System32\d3d10.dll
[2009/09/19 13:43:31 | 000,974,354 | ---- | C] () -- C:\WINDOWS\System32\crypt32new.dll
[2009/09/19 13:43:31 | 000,770,069 | ---- | C] () -- C:\WINDOWS\System32\advapi32new.dll
[2009/09/19 13:43:31 | 000,187,398 | ---- | C] () -- C:\WINDOWS\System32\d3d10core.dll
[2009/09/19 13:43:31 | 000,171,023 | ---- | C] () -- C:\WINDOWS\System32\apphelpnew.dll
[2009/08/14 20:14:39 | 000,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009/08/14 20:14:39 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009/07/28 13:59:33 | 000,017,191 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2009/07/21 15:32:12 | 000,000,136 | ---- | C] () -- C:\Documents and Settings\Etienne Diouf\Local Settings\Application Data\fusioncache.dat
[2009/07/11 21:27:13 | 000,014,848 | ---- | C] () -- C:\Documents and Settings\Etienne Diouf\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/07/04 18:36:58 | 000,000,033 | ---- | C] () -- C:\WINDOWS\Multimedia manager.INI
[2009/07/04 11:18:01 | 000,000,000 | ---- | C] () -- C:\WINDOWS\optiflash.INI
[2009/07/02 20:40:03 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\LauncherAccess.dt
[2009/07/02 20:35:27 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2009/07/02 16:47:21 | 000,000,133 | ---- | C] () -- C:\WINDOWS\msicpl.ini
[2009/07/02 16:35:31 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\memtest.dll
[2009/07/02 16:35:30 | 000,039,372 | R--- | C] () -- C:\WINDOWS\System32\drivers\vgauti.sys
[2009/07/02 16:35:30 | 000,039,372 | R--- | C] () -- C:\WINDOWS\System32\drivers\msicpl.sys
[2009/07/02 12:49:15 | 000,000,121 | ---- | C] () -- C:\WINDOWS\bdagent.INI
[2009/07/02 12:14:53 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2009/07/02 12:12:37 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2009/07/02 12:12:35 | 000,005,282 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2009/07/02 12:12:32 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2009/06/19 20:06:22 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
[2009/06/19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2009/06/19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2009/06/19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2009/06/19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2009/06/19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2009/06/19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2009/06/19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2009/06/19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2009/06/19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2004/08/22 16:04:56 | 000,069,120 | ---- | C] () -- C:\WINDOWS\daemon.dll
[2002/11/18 13:29:28 | 000,368,640 | ---- | C] () -- C:\WINDOWS\System32\nvimage.dll
[2002/11/18 13:29:28 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\stereoi.dll
[1999/01/27 12:39:06 | 000,065,024 | ---- | C] () -- C:\WINDOWS\System32\indounin.dll
[1997/06/13 06:56:08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll
[1996/04/03 20:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys

========== LOP Check ==========

[2010/01/28 18:49:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2009/08/06 17:14:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GreenPrint
[2010/01/29 22:11:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
[2009/12/20 16:11:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TrackMania
[2009/09/18 23:02:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/07/02 18:45:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010/01/09 00:12:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Etienne Diouf\Application Data\albumart
[2010/02/24 12:03:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Etienne Diouf\Application Data\BitTorrent
[2009/11/21 14:50:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Etienne Diouf\Application Data\Desktopicon
[2009/08/24 11:46:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Etienne Diouf\Application Data\DisplayTune
[2009/07/13 11:57:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Etienne Diouf\Application Data\EoRezo
[2009/07/10 15:49:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Etienne Diouf\Application Data\OpenOffice.org
[2009/07/02 21:31:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Etienne Diouf\Application Data\Samsung
[2009/11/26 16:24:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Etienne Diouf\Application Data\TeamViewer
[2010/02/24 12:01:14 | 000,000,448 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{2C2C0835-91AD-411B-A421-6271D7EFB0D6}.job

========== Purity Check ==========


< End of report >

Salut

Toujours des soucis, même en ayant qu'un seul antivirus ?

Télécharge Combofix sur ton bureau depuis un de ces deux liens
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe

Ferme toutes tes fenêtres, désactive tes logiciels de sécurité.

Double clique sur Combofix pour le lancer et suis les instructions à l'écran. Pendant qu'il travaillera, ne touche plus à rien.
A priori il va redémarrer la machine, laisse le faire.
A la fin, il te fournira un rapport dont j'aurai besoin, copie/colle son contenu ici svp.

Une aide en image disponible ici

++

Bonsoir,
Pour l'anti virus apparemment oui...
Voici le rapport ComboFix:
_______________________________________________________________
ComboFix 10-02-24.01 - Etienne Diouf 24/02/2010 22:29:37.1.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1023.628 [GMT 1:00]
Lancé depuis: c:\documents and settings\Etienne Diouf\Bureau\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Etienne Diouf\Application Data\Desktopicon
c:\documents and settings\Etienne Diouf\Application Data\Desktopicon\eBay.ico
c:\documents and settings\Etienne Diouf\Application Data\Desktopicon\uninst.exe
c:\windows\system32\advapi32new.dll
c:\windows\system32\apphelpnew.dll
c:\windows\system32\crypt32new.dll
c:\windows\system32\d3d10core.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\kernel32new.dll
c:\windows\system32\msvcrtnew.dll
c:\windows\system32\ntdsapinew.dll
c:\windows\system32\powrprofnew.dll
c:\windows\system32\secur32new.dll
c:\windows\system32\user32new.dll
c:\windows\system32\vbzlib1.dll
c:\windows\system32\winstanew.dll

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_WINSVC


((((((((((((((((((((((((((((( Fichiers créés du 2010-01-24 au 2010-02-24 ))))))))))))))))))))))))))))))))))))
.

2010-02-24 12:03 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-02-24 10:57 . 2010-02-24 10:59 -------- d-----w- c:\windows\system32\NtmsData
2010-02-22 17:57 . 2010-02-22 17:57 -------- d-----w- C:\_OTL
2010-02-06 12:23 . 2010-02-06 12:23 -------- d-----w- c:\program files\iPod
2010-02-06 12:22 . 2010-02-06 12:24 -------- d-----w- c:\program files\iTunes
2010-02-06 12:00 . 2010-02-06 12:00 72488 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-01-29 16:05 . 2010-01-29 16:05 -------- d-----w- c:\program files\Ask Search Assistant
2010-01-28 17:50 . 2010-02-11 18:38 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-01-28 17:50 . 2010-02-11 18:42 162512 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-01-28 17:50 . 2010-02-11 18:39 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-01-28 17:50 . 2010-02-11 18:42 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-01-28 17:50 . 2010-02-11 18:38 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-01-28 17:50 . 2010-02-11 18:38 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-01-28 17:50 . 2010-02-11 18:38 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-01-28 17:50 . 2010-02-11 18:53 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-01-28 17:50 . 2010-02-11 18:53 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-01-28 17:49 . 2010-01-28 17:49 -------- d-----w- c:\program files\Alwil Software
2010-01-28 17:49 . 2010-01-28 17:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-24 21:35 . 2009-12-29 22:09 -------- d-----w- c:\documents and settings\Etienne Diouf\Application Data\BitTorrent
2010-02-22 18:31 . 2009-07-02 11:49 81984 ----a-w- c:\windows\system32\bdod.bin
2010-02-21 23:44 . 2009-12-08 19:50 -------- d-----w- c:\program files\Creative
2010-02-21 22:45 . 2009-12-26 14:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Creative
2010-02-21 22:40 . 2009-11-26 16:11 -------- d-----w- c:\program files\TeamViewer
2010-02-21 22:39 . 2009-08-03 13:37 -------- d-----w- c:\program files\SpeedFan
2010-02-21 22:35 . 2009-07-02 11:14 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-06 12:23 . 2009-07-02 17:43 -------- d-----w- c:\program files\Fichiers communs\Apple
2010-02-06 12:11 . 2009-09-18 21:58 -------- d-----w- c:\program files\QuickTime
2010-01-29 21:11 . 2009-07-03 10:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2010-01-29 16:05 . 2009-07-02 16:50 -------- d-----w- c:\program files\Messenger Plus! Live
2010-01-10 20:46 . 2010-01-10 20:46 -------- d-----w- c:\documents and settings\Etienne Diouf\Application Data\Creative
2010-01-10 15:57 . 2009-08-30 13:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-10 15:57 . 2009-10-27 12:00 5115824 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-08 23:22 . 2009-11-02 23:20 141552 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-01-08 23:12 . 2010-01-08 23:06 -------- d-----w- c:\documents and settings\Etienne Diouf\Application Data\albumart
2010-01-08 21:20 . 2009-07-10 14:50 1 ----a-w- c:\documents and settings\Etienne Diouf\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-01-08 18:47 . 2010-01-08 18:47 -------- d-----w- c:\program files\Free M4a to MP3 Converter
2010-01-07 20:47 . 2009-12-27 13:23 -------- d-----w- c:\documents and settings\Joseph Diouf\Application Data\ArcSoft
2010-01-07 15:07 . 2009-08-30 13:15 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2009-08-30 13:15 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-31 19:04 . 2009-07-11 15:49 -------- d-----w- c:\documents and settings\Joseph Diouf\Application Data\LimeWire
2009-12-31 16:50 . 2008-04-14 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-29 22:08 . 2009-12-29 22:08 -------- d-----w- c:\program files\BitTorrent
2009-12-29 18:21 . 2009-07-26 12:43 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-12-27 21:55 . 2009-12-27 13:18 -------- d--h--w- c:\documents and settings\All Users\Application Data\ArcSoft
2009-12-27 21:37 . 2009-12-27 21:37 -------- d-----w- c:\program files\Windows Media Connect 2
2009-12-27 20:54 . 2009-12-27 14:41 -------- d-----w- c:\documents and settings\Etienne Diouf\Application Data\ArcSoft
2009-12-27 20:18 . 2009-12-27 20:17 -------- d-----w- c:\documents and settings\LocalService\Application Data\ArcSoft
2009-12-27 13:18 . 2009-12-27 13:18 -------- d-----w- c:\program files\Fichiers communs\ArcSoft
2009-12-27 13:18 . 2009-12-27 13:18 -------- d-----w- c:\program files\ArcSoft
2009-12-27 13:10 . 2009-12-27 13:10 -------- d-----w- c:\program files\Philips
2009-12-27 13:10 . 2009-12-27 13:10 -------- d-----w- c:\documents and settings\Joseph Diouf\Application Data\InstallShield
2009-12-21 19:07 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-17 07:41 . 2009-07-02 11:00 347648 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:09 . 2008-04-14 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-11 16:07 . 2008-04-14 12:00 80318 ----a-w- c:\windows\system32\perfc00C.dat
2009-12-11 16:07 . 2008-04-14 12:00 501352 ----a-w- c:\windows\system32\perfh00C.dat
2009-12-09 10:08 . 2008-04-14 12:00 2147328 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-09 10:08 . 2008-04-13 19:07 2025984 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2008-04-14 12:00 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:13 . 2008-04-14 12:00 1297920 ----a-w- c:\windows\system32\quartz.dll
2009-11-27 17:13 . 2008-04-13 19:33 17920 ----a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:08 . 2008-04-14 12:00 85504 ----a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:08 . 2008-04-14 12:00 28672 ----a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:08 . 2008-04-14 12:00 11264 ----a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:08 . 2008-04-13 19:33 48128 ----a-w- c:\windows\system32\iyuv_32.dll
2009-11-27 16:08 . 2001-08-23 17:47 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2008-03-09 05:25 . 2009-09-19 12:43 236 ---ha-w- c:\program files\Fichiers communs\dx.reg
.

------- Sigcheck -------

[-] 2008-04-14 . 3EFE912DD25D2586E6A0341DB0A66F69 . 979968 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-14 . 3EFE912DD25D2586E6A0341DB0A66F69 . 979968 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-04 39408]
"BitTorrent"="c:\program files\BitTorrent\bittorrent.exe" [2009-10-21 654128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-09-30 4603904]
"nwiz"="nwiz.exe" [2004-09-30 921600]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2004-09-30 86016]
"AlcWzrd"="ALCWZRD.EXE" [2005-05-04 2805248]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2004-02-12 188416]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2004-02-12 77824]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"ArcSoft Connection Service"="c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2009-10-10 203264]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-02-11 2756488]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-22 141608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Joseph Diouf\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\documents and settings\Th‚ophile Diouf\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\documents and settings\Etienne Diouf\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]
RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-3-18 630784]
Y'z Shadow.lnk - c:\windows\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-5-21 155648]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Philips GoGear VIBE Device Manager.lnk - c:\program files\Philips\GoGear VIBE Device Manager\GoGear_Vibe_DeviceManager.exe [2009-12-27 1611152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
2004-08-22 15:05 81920 ----a-w- c:\program files\D-Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C46 Series]
2004-01-14 01:00 99840 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I0T1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C46 Series (Copie 1)]
2004-01-14 01:00 99840 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I0T1.EXE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Documents and Settings\\Etienne Diouf\\temp\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [15/08/2009 16:51 155136]
R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [15/08/2009 16:51 5248]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [28/01/2010 18:50 162512]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [28/01/2010 18:50 19024]
R2 GreenPrint;GreenPrint;c:\program files\GreenPrint\gpsrht01.exe [06/08/2009 17:09 417792]
R2 PdiService;Portrait Displays SDK Service;c:\program files\Fichiers communs\Portrait Displays\Drivers\pdisrvc.exe [02/07/2009 17:16 109096]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [30/08/2009 14:15 38224]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]
.
Contenu du dossier 'Tâches planifiées'

2009-07-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2010-02-24 c:\windows\Tasks\User_Feed_Synchronization-{2C2C0835-91AD-411B-A421-6271D7EFB0D6}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\Etienne Diouf\Application Data\Mozilla\Firefox\Profiles\7scadlup.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch
FF - prefs.js: browser.startup.homepage - fr.msn.com
FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v2.01.01);user_pref(general.useragent.extra.zencast, .
- - - - ORPHELINS SUPPRIMES - - - -

AddRemove-eBay Icon - c:\documents and settings\Etienne Diouf\Application Data\Desktopicon\uninst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-24 22:35
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x86CDF760]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf75acf28
\Driver\ACPI -> ACPI.sys @ 0xf74f8cb8
\Driver\atapi -> 0x86cdf760
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
NDIS: Marvell Yukon 88E8053 PCI-E Gigabit Ethernet Controller -> SendCompleteHandler -> NDIS.sys @ 0xf737ebb0
PacketIndicateHandler -> NDIS.sys @ 0xf738ba21
SendHandler -> NDIS.sys @ 0xf736987b
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,de,6f,99,e8,9c,54,d8,47,93,5f,75,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,de,6f,99,e8,9c,54,d8,47,93,5f,75,\

[HKEY_LOCAL_MACHINE\software\GreenPrint\Azara]
@Denied: (A D 2 3 4 5 6) (Everyone)
@="c:\\Documents and Settings\\All Users\\Application Data\\GreenPrint\\Common\\Data\\TPDC-72312.XML"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'lsass.exe'(788)
c:\windows\system32\scecli.dll

- - - - - - - > 'explorer.exe'(2076)
c:\windows\system32\SHDOCVW.dll
c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
c:\windows\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.dll
c:\program files\Windows Media Player\wmpband.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\msi.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\GreenPrint\gpsrdg01.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\ALCWZRD.EXE
c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ArcCon.ac
c:\windows\system32\LVComS.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Heure de fin: 2010-02-24 22:40:06 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-02-24 21:40

Avant-CF: 67 105 583 104 octets libres
Après-CF: 67 446 583 296 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

- - End Of File - - 9BC3566276643B3832B0F736265AB117

Re

Si tu as tout ces problèmes depuis que tu as installés Avast, essaie voir de le désinstaller et d'en mettre un autre ...


Etape 1

Quelques suppressions

1. Ouvre le bloc note
Si tu ne sais pas faire, clique sur démarrer, puis sur exécuter, et tape notepad.exe dans la fenêtre qui s'ouvre, valide.

Copie/colle le contenu du cadre ci dessous dans le bloc note que tu viens d'ouvrir

Citation :

Folder::
C:\Documents and Settings\Etienne Diouf\Application Data\EoRezo
c:\program files\Ask Search Assistant

Enregistre le bloc note sous le nom CFScript.txt sur le bureau

2. Ferme toutes fenêtres.

3. Désactive à nouveau tous tes logiciels de sécurité pour que ceux ci n'interfèrent pas avec Combofix

4. Clique sur CFScript.txt et fais le glisser sur Combofix.exe


Combofix va se relancer, ne touche plus à rien, laisse le travailler

Quand il aura fini, un rapport sera créé, poste le moi svp (tu le trouveras aussi ici C:\ComboFix.txt).


Etape 2

J'aimerais que tu analyses 2 fichiers pour moi
c:\windows\explorer.exe
c:\windows\system32\dllcache\explorer.exe
Voici comment faire : http://www.bibou0007.com/scans-en-ligne-f75/tutorial-sur-virustotal-t190.htm
Si le site te dit que les fichiers ont déjà été analysés, réanalyse les toi même


Etape 3

Un scan antirootkit supplémentaire ...

Télécharge RootRepeal en cliquant sur un des liens ci dessous et sauvegarde le sur ton bureau :

Lien 1
Lien 2

• Double clique sur RootRepeal pour le lancer
  Vista : clique droit sur l'icône > lancer en tant qu'administrateur
  
  
• Clique sur l'onglet Report (en bas)
  
• Clique sur le bouton scan
  
• coche :
  
  *Drivers
  *Files
  *Processes
  *SSDT
  *Stealth Objects
  *Hidden Services
  *Shadow SSDT
  
  
• Clique sur le bouton OK.
  
• Fenêtre suivante, sélectionne tous tes lecteurs. Clique sur OK pour lancer le scan.
  Patiente le temps du scan et ne touche plus à rien
  
  
• A la fin, clique sur le bouton Save Report et sauvegarde le sur le bureau.

Quitte le programme


Etape 4

Copie/colle les rapports suivants dans ta prochaine réponse svp
- Combofix
- les 2 rapports de VirusTotal
- RootRepeal

Bonsoir,
Etape 1: rapport ComboFix
__________________________________________________________________
ComboFix 10-02-25.02 - Etienne Diouf 25/02/2010 22:17:55.4.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1023.646 [GMT 1:00]
Lancé depuis: c:\documents and settings\Etienne Diouf\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Etienne Diouf\Bureau\CFscript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Etienne Diouf\Application Data\EoRezo
c:\documents and settings\Etienne Diouf\Application Data\EoRezo\cache
c:\documents and settings\Etienne Diouf\Application Data\EoRezo\cmhost.cyp
c:\documents and settings\Etienne Diouf\Application Data\EoRezo\ConfMedia.cyp
c:\documents and settings\Etienne Diouf\Application Data\EoRezo\eoDesktop\config.xml
c:\documents and settings\Etienne Diouf\Application Data\EoRezo\eoDesktop\eoDesktop.html
c:\documents and settings\Etienne Diouf\Application Data\EoRezo\eoDesktop\userConfig.xml
c:\documents and settings\Etienne Diouf\Application Data\EoRezo\eoStats\eoStats.txt
c:\documents and settings\Etienne Diouf\Application Data\EoRezo\host.cyp
c:\documents and settings\Etienne Diouf\Application Data\EoRezo\user.cyp
c:\program files\Ask Search Assistant
c:\program files\Ask Search Assistant\ask.ico
c:\program files\Ask Search Assistant\AskSearchAsst.ini
c:\program files\Ask Search Assistant\Install.asa.log
c:\program files\Ask Search Assistant\uninst.exe
.
---- Exécution préalable -------
.
c:\windows\srchasst\nls302en.lex

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-01-25 au 2010-02-25 ))))))))))))))))))))))))))))))))))))
.

2010-02-24 12:03 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-02-24 10:57 . 2010-02-24 10:59 -------- d-----w- c:\windows\system32\NtmsData
2010-02-22 17:57 . 2010-02-22 17:57 -------- d-----w- C:\_OTL
2010-02-06 12:23 . 2010-02-06 12:23 -------- d-----w- c:\program files\iPod
2010-02-06 12:22 . 2010-02-06 12:24 -------- d-----w- c:\program files\iTunes
2010-02-06 12:00 . 2010-02-06 12:00 72488 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-01-28 17:50 . 2010-02-11 18:38 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-01-28 17:50 . 2010-02-11 18:42 162512 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-01-28 17:50 . 2010-02-11 18:39 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-01-28 17:50 . 2010-02-11 18:42 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-01-28 17:50 . 2010-02-11 18:38 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-01-28 17:50 . 2010-02-11 18:38 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-01-28 17:50 . 2010-02-11 18:38 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-01-28 17:50 . 2010-02-11 18:53 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-01-28 17:50 . 2010-02-11 18:53 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-01-28 17:49 . 2010-01-28 17:49 -------- d-----w- c:\program files\Alwil Software
2010-01-28 17:49 . 2010-01-28 17:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-25 21:14 . 2009-12-29 22:09 -------- d-----w- c:\documents and settings\Etienne Diouf\Application Data\BitTorrent
2010-02-22 18:31 . 2009-07-02 11:49 81984 ----a-w- c:\windows\system32\bdod.bin
2010-02-21 23:44 . 2009-12-08 19:50 -------- d-----w- c:\program files\Creative
2010-02-21 22:45 . 2009-12-26 14:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Creative
2010-02-21 22:40 . 2009-11-26 16:11 -------- d-----w- c:\program files\TeamViewer
2010-02-21 22:39 . 2009-08-03 13:37 -------- d-----w- c:\program files\SpeedFan
2010-02-21 22:35 . 2009-07-02 11:14 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-06 12:23 . 2009-07-02 17:43 -------- d-----w- c:\program files\Fichiers communs\Apple
2010-02-06 12:11 . 2009-09-18 21:58 -------- d-----w- c:\program files\QuickTime
2010-01-29 21:11 . 2009-07-03 10:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2010-01-29 16:05 . 2009-07-02 16:50 -------- d-----w- c:\program files\Messenger Plus! Live
2010-01-10 20:46 . 2010-01-10 20:46 -------- d-----w- c:\documents and settings\Etienne Diouf\Application Data\Creative
2010-01-10 15:57 . 2009-08-30 13:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-10 15:57 . 2009-10-27 12:00 5115824 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-08 23:22 . 2009-11-02 23:20 141552 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-01-08 23:12 . 2010-01-08 23:06 -------- d-----w- c:\documents and settings\Etienne Diouf\Application Data\albumart
2010-01-08 21:20 . 2009-07-10 14:50 1 ----a-w- c:\documents and settings\Etienne Diouf\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-01-08 18:47 . 2010-01-08 18:47 -------- d-----w- c:\program files\Free M4a to MP3 Converter
2010-01-07 20:47 . 2009-12-27 13:23 -------- d-----w- c:\documents and settings\Joseph Diouf\Application Data\ArcSoft
2010-01-07 15:07 . 2009-08-30 13:15 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2009-08-30 13:15 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-31 19:04 . 2009-07-11 15:49 -------- d-----w- c:\documents and settings\Joseph Diouf\Application Data\LimeWire
2009-12-31 16:50 . 2008-04-14 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-29 22:08 . 2009-12-29 22:08 -------- d-----w- c:\program files\BitTorrent
2009-12-29 18:21 . 2009-07-26 12:43 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-12-27 21:55 . 2009-12-27 13:18 -------- d--h--w- c:\documents and settings\All Users\Application Data\ArcSoft
2009-12-27 21:37 . 2009-12-27 21:37 -------- d-----w- c:\program files\Windows Media Connect 2
2009-12-21 19:07 . 2008-04-14 12:00 916480 ------w- c:\windows\system32\wininet.dll
2009-12-17 07:41 . 2009-07-02 11:00 347648 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:09 . 2008-04-14 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-11 16:07 . 2008-04-14 12:00 80318 ----a-w- c:\windows\system32\perfc00C.dat
2009-12-11 16:07 . 2008-04-14 12:00 501352 ----a-w- c:\windows\system32\perfh00C.dat
2009-12-09 10:08 . 2008-04-14 12:00 2147328 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-09 10:08 . 2008-04-13 19:07 2025984 ------w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2008-04-14 12:00 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2008-03-09 05:25 . 2009-09-19 12:43 236 ---ha-w- c:\program files\Fichiers communs\dx.reg
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-04 39408]
"BitTorrent"="c:\program files\BitTorrent\bittorrent.exe" [2009-10-21 654128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-09-30 4603904]
"nwiz"="nwiz.exe" [2004-09-30 921600]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2004-09-30 86016]
"AlcWzrd"="ALCWZRD.EXE" [2005-05-04 2805248]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2004-02-12 188416]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2004-02-12 77824]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"ArcSoft Connection Service"="c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2009-10-10 203264]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-02-11 2756488]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-22 141608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Joseph Diouf\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\documents and settings\Th‚ophile Diouf\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\documents and settings\Etienne Diouf\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Philips GoGear VIBE Device Manager.lnk - c:\program files\Philips\GoGear VIBE Device Manager\GoGear_Vibe_DeviceManager.exe [2009-12-27 1611152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
2004-08-22 15:05 81920 ----a-w- c:\program files\D-Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C46 Series]
2004-01-14 01:00 99840 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I0T1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C46 Series (Copie 1)]
2004-01-14 01:00 99840 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I0T1.EXE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Documents and Settings\\Etienne Diouf\\temp\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [15/08/2009 16:51 155136]
R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [15/08/2009 16:51 5248]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [28/01/2010 18:50 162512]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [28/01/2010 18:50 19024]
R2 GreenPrint;GreenPrint;c:\program files\GreenPrint\gpsrht01.exe [06/08/2009 17:09 417792]
R2 PdiService;Portrait Displays SDK Service;c:\program files\Fichiers communs\Portrait Displays\Drivers\pdisrvc.exe [02/07/2009 17:16 109096]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [30/08/2009 14:15 38224]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]
.
Contenu du dossier 'Tâches planifiées'

2009-07-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2010-02-25 c:\windows\Tasks\User_Feed_Synchronization-{2C2C0835-91AD-411B-A421-6271D7EFB0D6}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\Etienne Diouf\Application Data\Mozilla\Firefox\Profiles\7scadlup.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch
FF - prefs.js: browser.startup.homepage - fr.msn.com
FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v2.01.01);user_pref(general.useragent.extra.zencast, .
- - - - ORPHELINS SUPPRIMES - - - -

AddRemove-Ask.com Search Assistant - c:\program files\Ask Search Assistant\uninst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-25 22:22
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x86B81698]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7573f28
\Driver\ACPI -> ACPI.sys @ 0xf74bfcb8
\Driver\atapi -> 0x86b81698
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
NDIS: Marvell Yukon 88E8053 PCI-E Gigabit Ethernet Controller -> SendCompleteHandler -> NDIS.sys @ 0xf7345bb0
PacketIndicateHandler -> NDIS.sys @ 0xf7352a21
SendHandler -> NDIS.sys @ 0xf733087b
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,de,6f,99,e8,9c,54,d8,47,93,5f,75,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,de,6f,99,e8,9c,54,d8,47,93,5f,75,\

[HKEY_LOCAL_MACHINE\software\GreenPrint\Azara]
@Denied: (A D 2 3 4 5 6) (Everyone)
@="c:\\Documents and Settings\\All Users\\Application Data\\GreenPrint\\Common\\Data\\TPDC-94140.XML"
.
Heure de fin: 2010-02-25 22:24:25
ComboFix-quarantined-files.txt 2010-02-25 21:24
ComboFix2.txt 2010-02-24 21:40

Avant-CF: 67 201 994 752 octets libres
Après-CF: 67 160 813 568 octets libres

- - End Of File - - 63BC1FE447C206FD45BBBB11A65502AD

Salut Etienne

Ok, j'attends le rapport de Rootrepeal.

Bonne fin d'après midi.

Bonsoir,
Etape 3: Rapport RootRepeeal
___________________________________________________________
ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2010/02/26 23:33
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================

Drivers
-------------------
Name:
Image Path:
Address: 0xF744B000 Size: 98304 File Visible: No Signed: -
Status: -

Name:
Image Path:
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -

Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF3AB9000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF7A7B000 Size: 8192 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xEEA45000 Size: 49152 File Visible: No Signed: -
Status: -

Hidden/Locked Files
-------------------
Path: C:\RootRepeal report 02-26-10 (23-33-13).txt
Status: Visible to the Windows API, but not on disk.

Path: c:\documents and settings\etienne diouf\application data\bittorrent\resume.dat
Status: Size mismatch (API: 42027, Raw: 42207)

Path: C:\Documents and Settings\Etienne Diouf\Application Data\BitTorrent\sessionstore.js
Status: Locked to the Windows API!

Path: c:\documents and settings\etienne diouf\application data\bittorrent\settings.dat.old
Status: Allocation size mismatch (API: 45056, Raw: 4096)

Path: c:\documents and settings\etienne diouf\local settings\temp\fla37.tmp
Status: Allocation size mismatch (API: 4521984, Raw: 4390912)

Path: c:\documents and settings\etienne diouf\local settings\temp\flab.tmp
Status: Allocation size mismatch (API: 1114112, Raw: 0)

Path: C:\Documents and Settings\Etienne Diouf\Application Data\Mozilla\Firefox\Profiles\7scadlup.default\plugin-onair-6.xml
Status: Locked to the Windows API!

Path: c:\documents and settings\etienne diouf\local settings\application data\mozilla\firefox\profiles\7scadlup.default\cache\_cache_003_
Status: Size mismatch (API: 2026706, Raw: 1950776)

SSDT
-------------------
#: 025 Function Name: NtClose
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xf3ad9c5a

#: 041 Function Name: NtCreateKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xf3ad9b16

#: 045 Function Name: NtCreatePagingFile
Status: Hooked by "d347bus.sys" at address 0xf74e9a20

#: 063 Function Name: NtDeleteKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xf3ada0ca

#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xf3ad9ff4

#: 068 Function Name: NtDuplicateObject
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xf3ad96ec

#: 071 Function Name: NtEnumerateKey
Status: Hooked by "d347bus.sys" at address 0xf74ea2a8

#: 073 Function Name: NtEnumerateValueKey
Status: Hooked by "d347bus.sys" at address 0xf74f5910

#: 119 Function Name: NtOpenKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xf3ad9bf0

#: 122 Function Name: NtOpenProcess
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xf3ad962c

#: 128 Function Name: NtOpenThread
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xf3ad9690

#: 160 Function Name: NtQueryKey
Status: Hooked by "d347bus.sys" at address 0xf74ea2c8

#: 177 Function Name: NtQueryValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xf3ad9d10

#: 192 Function Name: NtRenameKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xf3ada198

#: 204 Function Name: NtRestoreKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xf3ad9cd0

#: 241 Function Name: NtSetSystemPowerState
Status: Hooked by "d347bus.sys" at address 0xf74f50b0

#: 247 Function Name: NtSetValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xf3ad9e50

Stealth Objects
-------------------
Object: Hidden Code [Driver: Ntfs, IRP_MJ_READ]
Process: System Address: 0x86f54260 Size: 11

Object: Hidden Code [Driver: atapi, IRP_MJ_CREATE]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_CREATE_NAMED_PIPE]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_CLOSE]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_READ]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_WRITE]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_QUERY_EA]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_SET_EA]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_SHUTDOWN]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_CLEANUP]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_CREATE_MAILSLOT]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_SET_SECURITY]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_POWER]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_DEVICE_CHANGE]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_SET_QUOTA]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: atapi, IRP_MJ_PNP]
Process: System Address: 0x86d34008 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_CREATE]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_CREATE_NAMED_PIPE]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_CLOSE]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_READ]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_WRITE]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_QUERY_EA]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_SET_EA]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_SHUTDOWN]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_CLEANUP]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_CREATE_MAILSLOT]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_SET_SECURITY]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_POWER]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_DEVICE_CHANGE]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_SET_QUOTA]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: Cdrom, IRP_MJ_PNP]
Process: System Address: 0x86d34e48 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_CREATE]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_CREATE_NAMED_PIPE]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_CLOSE]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_READ]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_WRITE]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_QUERY_EA]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_SET_EA]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_SHUTDOWN]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_CLEANUP]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_CREATE_MAILSLOT]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_SET_SECURITY]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_POWER]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_DEVICE_CHANGE]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_SET_QUOTA]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: d347prt, IRP_MJ_PNP]
Process: System Address: 0x86cd8dd8 Size: 99

Object: Hidden Code [Driver: Rdbss, IRP_MJ_READ]
Process: System Address: 0x867fac18 Size: 11

Object: Hidden Code [Driver: Srv, IRP_MJ_READ]
Process: System Address: 0x86c53b28 Size: 11

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_READ]
Process: System Address: 0x86c5ec98 Size: 11

Object: Hidden Code [Driver: Npfsȅ఍浗灩벼Processor_, IRP_MJ_READ]
Process: System Address: 0x867e5d08 Size: 11

Object: Hidden Code [Driver: Msfs؅
卆浩؁ఐ卆浩, IRP_MJ_READ]
Process: System Address: 0x867f67f0 Size: 11

Object: Hidden Code [Driver: Fs_Rec, IRP_MJ_READ]
Process: System Address: 0x86c657b8 Size: 11

Object: Hidden Code [Driver: CdfsЅఅ瑁䅭咸쀇
ँFileNa, IRP_MJ_READ]
Process: System Address: 0x8678ad98 Size: 11

==EOF==

Salut Etienne, et bien si tu as des virus, ils sont bien cachés.

Je pencherais plus pour un problème logiciel ou matériel ...


Un scan supplémentaire parce que ce serait bête de passer à côté de quelque chose. Ensuite on y va pour un scan global.

Etape 1

Télécharge TDSSKiller depuis ce lien et place le sur ton bureau.
http://support.kaspersky.com/downloads/utils/tdsskiller.zip

• Décompresse le fichier TDSSKiller et place le aussi sur ton bureau.
  
• Double clique sur TDSSKiller.exe et patiente quelques instants.
  Note : utilisateur de vista, clique droit sur le programme et sélectionne "Exécuter en tant qu'administrateur"

A la fin, un rapport sera créé à la racine du disque C: il se nomme à peu près comme ça C:\TDSSKiller.2.2.0_28.01.2010_22.10.43_log.txt. Copie ce rapport ici svp

Une aide en image ici : http://support.kaspersky.com/viruses/solutions?qid=208280684


Etape 2

Clique ici pour télécharger TFC (de Old Timer) sur le bureau

• Double clique sur TFC.exe pour le lancer
  
• Clique sur le bouton Start et patiente quelques instants.
  
• Une fois le nettoyage terminé, ton pc va redémarrer. S'il ne le fait pas, redémarre le toi même pour terminer le nettoyage

Etape 3

Clique ici pour télécharger MalwareByte's Anti-Malware sur ton bureau.

• Relance Malwarebyte et mets à jour la base de définition en allant dans l'onglet "Mise à jour" puis "Recherche de mise à jour".
  
• Choisis "Exécuter un examen rapide" puis "Rechercher"
  
• Laisse l'analyse se faire (cela peut durer longtemps).
  
  Une fois le scan terminé, clique sur "Afficher les résultats", vérifie que les éléments trouvés soient cochés puis sur "Supprimer la sélection" en bas.
  
  
• Un redémarrage peut être nécessaire.

Un rapport va s'afficher, enregistre-le sur ton bureau. Sinon, après le démarrage, il se trouvera dans l'onglet Rapports/logs de Malwarebyte.
Et poste le rapport svp


Etape 4

Poste les rapports suivants svp
- tdsskiller
- malwarebyte

Comment va ton pc ?


Bonne journée

Salut Etienne


Toujours avec nous ?

Salut

GrosBébé a écrit:

A la fin, un rapport sera créé à la racine du disque C: il se nomme à peu près comme ça C:\TDSSKiller.2.2.0_28.01.2010_22.10.43_log.txt. Copie ce rapport ici svp

Regarde si tu trouves ce rapport.

Ensuite, que tu trouves ou pas ce rapport, passe à l'étape suivante


Bonne journée

Ha oui...
______________________________________________________________
22:59:12:293 4036 TDSS rootkit removing tool 2.2.7.1 Feb 27 2010 13:29:25
22:59:12:293 4036 ================================================================================
22:59:12:293 4036 SystemInfo:

22:59:12:293 4036 OS Version: 5.1.2600 ServicePack: 3.0
22:59:12:293 4036 Product type: Workstation
22:59:12:293 4036 ComputerName: DIOUF-5A8C6EC0D
22:59:12:293 4036 UserName: Etienne Diouf
22:59:12:293 4036 Windows directory: C:\WINDOWS
22:59:12:293 4036 Processor architecture: Intel x86
22:59:12:293 4036 Number of processors: 2
22:59:12:293 4036 Page size: 0x1000
22:59:12:293 4036 Boot type: Normal boot
22:59:12:293 4036 ================================================================================
22:59:12:324 4036 UnloadDriverW: NtUnloadDriver error 2
22:59:12:324 4036 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2
22:59:12:387 4036 Initialize success
22:59:12:387 4036
22:59:12:387 4036 Scanning Services ...
22:59:12:387 4036 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system
22:59:12:387 4036 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
22:59:12:387 4036 wfopen_ex: Trying to KLMD file open
22:59:12:387 4036 wfopen_ex: File opened ok (Flags 2)
22:59:12:387 4036 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software
22:59:12:387 4036 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
22:59:12:387 4036 wfopen_ex: Trying to KLMD file open
22:59:12:387 4036 wfopen_ex: File opened ok (Flags 2)
22:59:12:934 4036 GetAdvancedServicesInfo: Raw services enum returned 342 services
22:59:12:949 4036 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system
22:59:12:949 4036 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software
22:59:12:949 4036
22:59:12:949 4036 Scanning Kernel memory ...
22:59:12:949 4036 Devices to scan: 2
22:59:12:949 4036
22:59:12:949 4036 Driver Name: Disk
22:59:12:949 4036 IRP_MJ_CREATE : F7575BB0
22:59:12:949 4036 IRP_MJ_CREATE_NAMED_PIPE : 804F9759
22:59:12:949 4036 IRP_MJ_CLOSE : F7575BB0
22:59:12:949 4036 IRP_MJ_READ : F756FD1F
22:59:12:949 4036 IRP_MJ_WRITE : F756FD1F
22:59:12:949 4036 IRP_MJ_QUERY_INFORMATION : 804F9759
22:59:12:949 4036 IRP_MJ_SET_INFORMATION : 804F9759
22:59:12:949 4036 IRP_MJ_QUERY_EA : 804F9759
22:59:12:949 4036 IRP_MJ_SET_EA : 804F9759
22:59:12:949 4036 IRP_MJ_FLUSH_BUFFERS : F75702E2
22:59:12:949 4036 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9759
22:59:12:949 4036 IRP_MJ_SET_VOLUME_INFORMATION : 804F9759
22:59:12:949 4036 IRP_MJ_DIRECTORY_CONTROL : 804F9759
22:59:12:949 4036 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9759
22:59:12:949 4036 IRP_MJ_DEVICE_CONTROL : F75703BB
22:59:12:949 4036 IRP_MJ_INTERNAL_DEVICE_CONTROL : F7573F28
22:59:12:949 4036 IRP_MJ_SHUTDOWN : F75702E2
22:59:12:949 4036 IRP_MJ_LOCK_CONTROL : 804F9759
22:59:12:949 4036 IRP_MJ_CLEANUP : 804F9759
22:59:12:949 4036 IRP_MJ_CREATE_MAILSLOT : 804F9759
22:59:12:949 4036 IRP_MJ_QUERY_SECURITY : 804F9759
22:59:12:949 4036 IRP_MJ_SET_SECURITY : 804F9759
22:59:12:949 4036 IRP_MJ_POWER : F7571C82
22:59:12:949 4036 IRP_MJ_SYSTEM_CONTROL : F757699E
22:59:12:949 4036 IRP_MJ_DEVICE_CHANGE : 804F9759
22:59:12:949 4036 IRP_MJ_QUERY_QUOTA : 804F9759
22:59:12:949 4036 IRP_MJ_SET_QUOTA : 804F9759
22:59:12:965 4036 TDL3_StartIoLastChanceHookDetect: Unable to dump StartIo handler code
22:59:12:965 4036 sion
22:59:12:965 4036 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
22:59:12:965 4036
22:59:12:965 4036 Driver Name: atapi
22:59:12:965 4036 IRP_MJ_CREATE : 86C38D68
22:59:12:965 4036 IRP_MJ_CREATE_NAMED_PIPE : 86C38D68
22:59:12:965 4036 IRP_MJ_CLOSE : 86C38D68
22:59:12:965 4036 IRP_MJ_READ : 86C38D68
22:59:12:965 4036 IRP_MJ_WRITE : 86C38D68
22:59:12:965 4036 IRP_MJ_QUERY_INFORMATION : 86C38D68
22:59:12:965 4036 IRP_MJ_SET_INFORMATION : 86C38D68
22:59:12:965 4036 IRP_MJ_QUERY_EA : 86C38D68
22:59:12:965 4036 IRP_MJ_SET_EA : 86C38D68
22:59:12:965 4036 IRP_MJ_FLUSH_BUFFERS : 86C38D68
22:59:12:965 4036 IRP_MJ_QUERY_VOLUME_INFORMATION : 86C38D68
22:59:12:965 4036 IRP_MJ_SET_VOLUME_INFORMATION : 86C38D68
22:59:12:965 4036 IRP_MJ_DIRECTORY_CONTROL : 86C38D68
22:59:12:965 4036 IRP_MJ_FILE_SYSTEM_CONTROL : 86C38D68
22:59:12:965 4036 IRP_MJ_DEVICE_CONTROL : 86C38D68
22:59:12:965 4036 IRP_MJ_INTERNAL_DEVICE_CONTROL : 86C38D68
22:59:12:965 4036 IRP_MJ_SHUTDOWN : 86C38D68
22:59:12:965 4036 IRP_MJ_LOCK_CONTROL : 86C38D68
22:59:12:965 4036 IRP_MJ_CLEANUP : 86C38D68
22:59:12:965 4036 IRP_MJ_CREATE_MAILSLOT : 86C38D68
22:59:12:965 4036 IRP_MJ_QUERY_SECURITY : 86C38D68
22:59:12:965 4036 IRP_MJ_SET_SECURITY : 86C38D68
22:59:12:965 4036 IRP_MJ_POWER : 86C38D68
22:59:12:965 4036 IRP_MJ_SYSTEM_CONTROL : 86C38D68
22:59:12:965 4036 IRP_MJ_DEVICE_CHANGE : 86C38D68
22:59:12:965 4036 IRP_MJ_QUERY_QUOTA : 86C38D68
22:59:12:965 4036 IRP_MJ_SET_QUOTA : 86C38D68
22:59:12:981 4036 ihd: 0, 0, 0, 0, 0, 0, 0
22:59:12:981 4036 siohd: 0
22:59:12:981 4036 C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: Clean
22:59:12:981 4036
22:59:12:981 4036 Completed
22:59:12:981 4036
22:59:12:981 4036 Results:
22:59:12:981 4036 Memory objects infected / cured / cured on reboot: 0 / 0 / 0
22:59:12:981 4036 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
22:59:12:981 4036 File objects infected / cured / cured on reboot: 0 / 0 / 0
22:59:12:981 4036
22:59:13:527 4036 KLMD(ARK) unloaded successfully

Re


Ok, j'attends la suite

Bonjour,
Mon ordinateur continue a redémarer de facon très reguliere, j'ai méme eu du mal a effectuer l'analyse rapide de Malawarebytes...
Voici le rapport :
___________________________________________________________
Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3838
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

08/03/2010 18:44:28
mbam-log-2010-03-08 (18-44-28).txt

Type de recherche: Examen rapide
Eléments examinés: 136339
Temps écoulé: 10 minute(s), 14 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Salut

Je relirai l'ensemble du sujet dès qu'on aura le rapport Kaspersky, pour vérifier que je n'ai rien loupé.

hum oui, pardon, je croyais l'avoir mis dans mon avant dernier message.

Rends toi sur kaspersky online scanner (clique ici)

• Clique sur Accept en bas pour installer le programme.
  
• Ferme toutes tes fenêtres et désactive tes logiciels de sécurité.
  
• Clique sur Exécuter pour lancer le programme.
  Patiente le temps de la mise à jour ...
  
• Clique sur My Computer sous Scan (à gauche)
  Patiente le temps du scan.
  
• Dès que c'est fini, clique sur Report... à gauche, puis clique sur Save Report...

Sauvegarde le rapport sous le nom kaspersky.txt et copie/colle son contenu ici svp.
Réactive ton antivirus.

ps : n'utilise pas ton pc le temps du scan.

Une aide en image ici

Bonsoir,
J'ai essayé une dizaine de fois mais a un certaint moment de l'analyse Mon pc redemarre..
A chaque fois j'ai vraiment forcée mais sa ne marche pas !!

Salut

Citation :

En se qui concerne BitDefender je posséder la version 2008 mais elle vient d'expirer depuis une semaine environ c'est pour sa que j'ai installer avast mais on dirait que depuis que depuis que je l'ai cela me cause des problèmes.

Désinstalle Avast pour voir si c'est mieux.
http://www.01net.com/telecharger/windows/Securite/antivirus-antitrojan/fiches/13198.html

Salut Etienne

Alors qu'est ce que ça donne ?

++

Bonsoir,
au debut aprés la désinstallation il y a eu un mieu mais pendant la semaine sa a recommencer
au redemarrage j'un un rapport d'erreur :
Ensuite une fenetre detailé s'ouvre:
Ou encore celle-ci:
Que dois-je faire !?

Salut,
le problème est survenu qu'à une occasion ou c'est récurrant?
++