gros problème de bougeotte...

mywebsearch...est encore la


Télécharger et enregistrer sur le Bureau
BTFix.zip
= Clic droit et extraire tout ( ou ici)
=double-clic Dossier BTFix
= double-clic BTFix
= Clic Rechercher
= copier/coller le rapport dans la réponse
------
si positif en mode sans échec de préférence
= clic Nettoyer

Bonjour a tous,
Bon ben mon probleme de bougeotte est toujours la je ne men suis pas debarasser tres compliquer de vous ecrire car je ne vois casiement pas lecran tellement il bouge
SOS
Aidez moi
Vicky

as tu fais BTfix ? refais un raapport hijackthis....peut etre que ce n'est pas du au virus mais a des interferences..problemes materiel ou autre..

Bonsoir à tous bon ben jai suivis toutes vos recomadations mais rien ny fais jai vraiment limpression que quelqun est suir mon ordi please aidez moi
merci et bonnes fetes...


Ajout du 28-12-2007 à 18:29:

bonsoir je viens de refaire un nettoyage je vous envois les rapports
Script execute en mode sans echec
Rapport clean par Malekal_morte - http://www.malekal.com
Script execute en mode sans echec 28/12/2007 a 18:21:26,21

Microsoft Windows XP [version 5.1.2600]

*** Suppression des fichiers dans C:

*** Suppression des fichiers dans C:\WINDOWS\

*** Suppression des fichiers dans C:\WINDOWS\system32

*** Suppression des fichiers dans C:\Program Files

*** Suppression des clefs du registre effectuee..
*** Fin du rapport !
BTFix 1.066 (par bibi26) - 28/12/2007 18:20:27 - Nettoyage - Mode sans échec
Lancé depuis C:\Documents and Settings\Vic\Bureau\BTFix\BTFix.exe

---> Fichiers/dossiers supprimés

- Fichiers temporaires effacés
- C:\WINDOWS\Downloaded Program Files\f3initialsetup1.0.0.15-3.inf
- C:\Program Files\Internet Explorer\msimg32.dll

---> Nettoyage terminé
bonne soiree

bonjour

dire si en mode sans échec, tu as le même problème

Télécharger et enregistrer sur le bureau
Combofix

=Double-clic sur Combofix
= Presser 1 quand demandé
= Attendre la fermeture de l’outil ( 5 à 10 mn)
=Copier/coller le rapport dans la réponse
Un rapport dans C:\Combofix.txt à mettre dans la réponse


et refait ensuite un rapport hijack

Salut donc j'ai fais tous ce que tu m'a demander en mode sans echec je t envois les rapports:
07-12-21.4 - Vic 2007-12-29 13:37:28.2 - NTFSx86 MINIMAL
Running from: C:\Documents and Settings\Vic\Bureau\ComboFix.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2007-11-28 to 2007-12-29 ))))))))))))))))))))))))))))))))))))
.

2007-12-28 18:36 . 2007-12-28 18:36 <REP> d-------- C:\Program Files\Five Card Deluxe
2007-12-28 18:33 . 2007-12-28 18:33 <REP> d-------- C:\Program Files\Alice Greenfingers
2007-12-27 10:21 . 2007-12-27 10:21 <REP> d-------- C:\Documents and Settings\Vic\Saved Games
2007-12-27 09:41 . 2007-12-27 09:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\HiddenSecretsNightmare
2007-12-27 09:39 . 2007-12-27 10:16 <REP> d-------- C:\Program Files\Hidden Secrets - The Nightmare
2007-12-27 09:29 . 2007-12-27 09:30 <REP> d-------- C:\Program Files\Dream Day First Home
2007-12-25 20:31 . 2007-12-25 20:31 <REP> d-------- C:\Program Files\Farm Frenzy
2007-12-19 15:07 . 2007-12-19 15:07 <REP> d-------- C:\Documents and Settings\Vic\Application Data\Big Fish Games
2007-12-19 10:57 . 2007-12-19 10:57 <REP> d-------- C:\Program Files\Abra Academy
2007-12-18 20:22 . 2007-12-28 13:46 <REP> d-------- C:\Program Files\Egg vs Chicken
2007-12-18 20:20 . 2007-12-18 20:20 <REP> d-------- C:\Program Files\Clayside
2007-12-18 20:19 . 2007-12-19 14:57 <REP> d-------- C:\Program Files\Digby`s Donuts
2007-12-18 20:17 . 2007-12-18 20:18 <REP> d-------- C:\Program Files\Azada
2007-12-18 20:10 . 2007-12-18 20:10 <REP> d-------- C:\Program Files\bfgclient
2007-12-18 20:10 . 2007-12-18 20:12 <REP> d-------- C:\Documents and Settings\All Users\Application Data\BigFishGamesCache
2007-12-17 09:38 . 2007-12-17 09:38 <REP> d-------- C:\Documents and Settings\Vic\Application Data\Clickteam
2007-12-16 09:03 . 2007-12-16 09:03 <REP> d-------- C:\Documents and Settings\All Users\Application Data\JollyBear
2007-12-15 22:38 . 2007-12-15 22:38 <REP> d-------- C:\Documents and Settings\Vic\Application Data\Oliver Pearl
2007-12-15 21:36 . 2007-12-15 21:36 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Fugazo
2007-12-15 20:23 . 2007-12-15 20:23 <REP> d-------- C:\Documents and Settings\Vic\Application Data\Home Sweet Home
2007-12-13 13:10 . 2007-12-13 13:10 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Gogii
2007-12-13 10:14 . 2007-12-13 10:24 <REP> d-------- C:\Documents and Settings\Cédric\Contacts
2007-12-13 10:14 . 2007-12-13 10:24 <REP> d-------- C:\Documents and Settings\Cédric\Contacts
2007-12-13 09:05 . 2006-10-10 20:51 <REP> d--h----- C:\Documents and Settings\Cédric\Voisinage réseau
2007-12-13 09:05 . 2006-10-10 20:51 <REP> d--h----- C:\Documents and Settings\Cédric\Voisinage réseau
2007-12-13 09:05 . 2006-10-10 20:51 <REP> d--h----- C:\Documents and Settings\Cédric\Voisinage d'impression
2007-12-13 09:05 . 2006-10-10 20:51 <REP> d--h----- C:\Documents and Settings\Cédric\Voisinage d'impression
2007-12-13 09:05 . 2006-10-10 19:01 <REP> d--h----- C:\Documents and Settings\Cédric\Modèles
2007-12-13 09:05 . 2006-10-10 19:01 <REP> d--h----- C:\Documents and Settings\Cédric\Modèles
2007-12-13 09:05 . 2007-12-13 21:35 <REP> dr------- C:\Documents and Settings\Cédric\Mes documents
2007-12-13 09:05 . 2007-12-13 21:35 <REP> dr------- C:\Documents and Settings\Cédric\Mes documents
2007-12-13 09:05 . 2006-10-10 20:51 <REP> dr------- C:\Documents and Settings\Cédric\Menu Démarrer
2007-12-13 09:05 . 2006-10-10 20:51 <REP> dr------- C:\Documents and Settings\Cédric\Menu Démarrer
2007-12-13 09:05 . 2007-12-17 17:56 <REP> dr------- C:\Documents and Settings\Cédric\Favoris
2007-12-13 09:05 . 2007-12-17 17:56 <REP> dr------- C:\Documents and Settings\Cédric\Favoris
2007-12-13 09:05 . 2007-12-13 21:35 <REP> d-------- C:\Documents and Settings\Cédric\Bureau
2007-12-13 09:05 . 2007-12-13 21:35 <REP> d-------- C:\Documents and Settings\Cédric\Bureau
2007-12-13 08:29 . 2007-12-13 08:29 280 --ah----- C:\sqmdata19.sqm
2007-12-13 08:29 . 2007-12-13 08:29 244 --ah----- C:\sqmnoopt19.sqm
2007-12-08 15:02 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-12-08 12:01 . 2007-12-08 12:01 208 --ah----- C:\sqmdata18.sqm
2007-12-08 12:01 . 2007-12-08 12:01 172 --ah----- C:\sqmnoopt18.sqm
2007-12-08 10:35 . 2007-12-08 15:02 <REP> d-------- C:\Program Files\Navilog1
2007-12-08 10:01 . 2007-12-08 10:01 268 --ah----- C:\sqmdata17.sqm
2007-12-08 10:01 . 2007-12-08 10:01 244 --ah----- C:\sqmnoopt17.sqm
2007-12-07 20:45 . 2007-12-07 20:45 <REP> d-------- C:\Program Files\Trend Micro
2007-12-07 10:11 . 2007-12-07 10:11 268 --ah----- C:\sqmdata16.sqm
2007-12-07 10:11 . 2007-12-07 10:11 244 --ah----- C:\sqmnoopt16.sqm
2007-12-06 21:38 . 2007-12-06 21:41 <REP> d-------- C:\Program Files\Windows Live Safety Center
2007-12-04 15:40 . 2007-12-04 15:40 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2007-12-04 15:40 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2007-12-04 15:27 . 2007-12-04 15:29 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2007-12-04 09:55 . 2007-12-04 09:55 <REP> d-------- C:\Program Files\Windows Live Favorites

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-28 17:47 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-28 17:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2007-12-23 12:06 --------- d-----w C:\Program Files\eMule
2007-12-20 12:34 --------- d-----w C:\Program Files\Messenger Plus! Live
2007-12-19 17:03 --------- d-----w C:\Documents and Settings\Vic\Application Data\PlayFirst
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 14:40 --------- d-----w C:\Program Files\Windows Live
2007-12-04 14:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-12-04 08:55 --------- d-----w C:\Program Files\Windows Live Toolbar
2007-11-25 16:07 --------- d-----w C:\Program Files\Picasa2
2007-11-25 09:01 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2007-11-23 19:02 --------- d-----w C:\Program Files\Fichiers communs\Real
2007-11-23 19:00 --------- d-----w C:\Program Files\Player Metaboli
2007-11-15 13:12 --------- d-----w C:\Documents and Settings\Vic\Application Data\GetRight
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-02 11:38 --------- d-----w C:\Documents and Settings\Vic\Application Data\Studio-Scrap
2007-10-30 13:33 --------- d-----w C:\Program Files\Absolutist.com
2007-10-29 22:43 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-28 15:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sandlot Games
2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-23 16:49 586,752 ----a-w C:\WINDOWS\WLXPGSS.SCR
2007-10-15 19:05 71,680 ----a-w C:\WINDOWS\mmfs.dll
2007-10-03 06:41 46,080 ----a-w C:\WINDOWS\system32\ftp.exe
2007-10-03 06:41 17,920 ----a-w C:\WINDOWS\system32\tftp.exe
2007-07-20 12:23 774,144 ----a-w C:\Program Files\RngInterstitial.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 06:00]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-03-31 19:38]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 09:59]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VX1000"="C:\WINDOWS\vVX1000.exe" [2006-10-13 17:04]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2006-10-13 17:01]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 06:00]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 00:15:56]
Outil de mise … jour Google.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-02-25 10:27:56]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\google\google~3\goec62~1.dll, NVDESK32.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Vic^Menu Démarrer^Programmes^Démarrage^Anti-Pub.lnk]
path=C:\Documents and Settings\Vic\Menu Démarrer\Programmes\Démarrage\Anti-Pub.lnk
backup=C:\WINDOWS\pss\Anti-Pub.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-10 18:51 39792 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-03-31 19:38 68856 --a------ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2006-11-03 09:59 204288 -----c--- C:\Program Files\Windows Media Player\WMPNSCFG.exe

S2 LicCtrlService;LicCtrl Service;rundll32.exe C:\WINDOWS\mmfs.dll,Service []
S2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamS32.exe" [2006-10-13 17:01]
S2 X4HSX32;X4HSX32;C:\Program Files\Player Metaboli\X4HSX32.Sys [2006-12-13 08:34]
S3 mdxgthkn;mdxgthkn;C:\DOCUME~1\Vic\LOCALS~1\Temp\mdxgthkn.sys []
S3 VX1000;VX-1000;C:\WINDOWS\system32\DRIVERS\VX1000.sys [2006-10-13 17:04]

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-12-29 12:22:00 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-29 13:39:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-29 13:40:43
C:\ComboFix2.txt ... 2007-12-29 13:08
.
2007-12-13 07:20:43 --- E O F ---
Script execute en mode sans echec
Rapport clean par Malekal_morte - http://www.malekal.com
Script execute en mode sans echec 29/12/2007 a 13:41:30,48

Microsoft Windows XP [version 5.1.2600]

*** Suppression des fichiers dans C:

*** Suppression des fichiers dans C:\WINDOWS\

*** Suppression des fichiers dans C:\WINDOWS\system32

*** Suppression des fichiers dans C:\Program Files

*** Suppression des clefs du registre effectuee..
*** Fin du rapport !
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:41:10, on 29/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Vic\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Grimm's%20Hatchery/Images/stg_drm.ocx
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase4009.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://bmm.imgag.com/imgag/cp/install/crusher-fr.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Delicious%202/Images/armhelper.ocx
O20 - AppInit_DLLs: c:\progra~1\google\google~3\goec62~1.dll, NVDESK32.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - rundll32.exe (file missing)
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/Vic/LOCALS~1/Temp/msoclip1/01/clip_image002.jpg

--
End of file - 6283 bytes
de plus quand l'ecran a la boujotte si je mets le curseur sur la barre des taches ca ne bouge plus et des que je le remets sur l ecran cest reparti pour un tour donc je pense pas que ce sois un probleme de materiel merci beaucoup pour ta reponses et bonnes fetes...


Ajout du 29-12-2007 à 14:20:

Voici encore un autre raport
toujours en mode sans echecs
merci...
BTFix 1.066 (par bibi26) - 29/12/2007 14:15:46 - Nettoyage - Mode sans échec
Lancé depuis C:\Documents and Settings\Vic\Bureau\BTFix\BTFix.exe

---> Fichiers/dossiers supprimés

- Fichiers temporaires effacés

---> Nettoyage terminé

comme je n'ai pas le temps de rechercher dans mes doc,
dit ce que tu connais de ce qui est en gras

si ce n'est pas connu ( jeux ou autre) il faut supprimer

C:\Program Files\Five Card Deluxe
C:\Program Files\Alice Greenfingers

C:\Documents and Settings\All Users\Application Data\HiddenSecretsNightmare
C:\Program Files\Hidden Secrets - The Nightmare
C:\Program Files\Dream Day First Home
C:\Program Files\Farm Frenzy
C:\Documents and Settings\Vic\Application Data\Big Fish Games
C:\Program Files\Abra Academy
C:\Program Files\Egg vs Chicken
C:\Program Files\Clayside
C:\Program Files\Digby`s Donuts
C:\Program Files\Azada
C:\Program Files\bfgclient
C:\Documents and Settings\All Users\Application Data\BigFishGamesCache
C:\Documents and Settings\Vic\Application Data\Clickteam
C:\Documents and Settings\All Users\Application Data\JollyBear
C:\Documents and Settings\Vic\Application Data\Oliver Pearl
C:\Documents and Settings\All Users\Application Data\Fugazo
C:\Documents and Settings\Vic\Application Data\Home Sweet Home
C:\Documents and Settings\All Users\Application Data\Gogii

Salut donc pour la plupart se sont des jeux que j'ai d'ailleur supprimer mais par contre clickteam
oliver pearl
fugazo et home sweet home ca ne me dis rien donc j'ai supprimer aussi je t'ai refait quatre rapports en mode sans echec:
TFix 1.066 (par bibi26) - 30/12/2007 16:42:49 - Nettoyage - Mode sans échec
Lancé depuis C:\Documents and Settings\Vic\Bureau\BTFix\BTFix.exe

---> Fichiers/dossiers supprimés

- Fichiers temporaires effacés

---> Nettoyage terminé
cript execute en mode sans echec
Rapport clean par Malekal_morte - http://www.malekal.com
Script execute en mode sans echec 30/12/2007 a 16:37:42,92

Microsoft Windows XP [version 5.1.2600]

*** Suppression des fichiers dans C:

*** Suppression des fichiers dans C:\WINDOWS\

*** Suppression des fichiers dans C:\WINDOWS\system32

*** Suppression des fichiers dans C:\Program Files

*** Suppression des clefs du registre effectuee..
*** Fin du rapport !
ogfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:43:22, on 30/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Vic\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Grimm's%20Hatchery/Images/stg_drm.ocx
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase4009.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://bmm.imgag.com/imgag/cp/install/crusher-fr.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Delicious%202/Images/armhelper.ocx
O20 - AppInit_DLLs: c:\progra~1\google\google~3\goec62~1.dll, NVDESK32.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - rundll32.exe (file missing)
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/Vic/LOCALS~1/Temp/msoclip1/01/clip_image002.jpg

--
End of file - 6315 bytes
omboFix 07-12-21.4 - Vic 2007-12-30 16:40:32.3 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.359 [GMT 1:00]
Running from: C:\Documents and Settings\Vic\Bureau\ComboFix.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2007-11-28 to 2007-12-30 ))))))))))))))))))))))))))))))))))))
.

2007-12-30 16:08 . 2007-12-30 16:17 125 --a------ C:\ioSpecial.ini
2007-12-28 18:36 . 2007-12-29 14:10 <REP> d-------- C:\Program Files\Five Card Deluxe
2007-12-28 18:33 . 2007-12-28 18:33 <REP> d-------- C:\Program Files\Alice Greenfingers
2007-12-27 10:21 . 2007-12-27 10:21 <REP> d-------- C:\Documents and Settings\Vic\Saved Games
2007-12-19 15:07 . 2007-12-30 16:15 <REP> d-------- C:\Documents and Settings\Vic\Application Data\Big Fish Games
2007-12-18 20:10 . 2007-12-18 20:12 <REP> d-------- C:\Documents and Settings\All Users\Application Data\BigFishGamesCache
2007-12-13 10:14 . 2007-12-13 10:24 <REP> d-------- C:\Documents and Settings\Cédric\Contacts
2007-12-13 10:14 . 2007-12-13 10:24 <REP> d-------- C:\Documents and Settings\Cédric\Contacts
2007-12-13 09:05 . 2006-10-10 20:51 <REP> d--h----- C:\Documents and Settings\Cédric\Voisinage réseau
2007-12-13 09:05 . 2006-10-10 20:51 <REP> d--h----- C:\Documents and Settings\Cédric\Voisinage réseau
2007-12-13 09:05 . 2006-10-10 20:51 <REP> d--h----- C:\Documents and Settings\Cédric\Voisinage d'impression
2007-12-13 09:05 . 2006-10-10 20:51 <REP> d--h----- C:\Documents and Settings\Cédric\Voisinage d'impression
2007-12-13 09:05 . 2006-10-10 19:01 <REP> d--h----- C:\Documents and Settings\Cédric\Modèles
2007-12-13 09:05 . 2006-10-10 19:01 <REP> d--h----- C:\Documents and Settings\Cédric\Modèles
2007-12-13 09:05 . 2007-12-13 21:35 <REP> dr------- C:\Documents and Settings\Cédric\Mes documents
2007-12-13 09:05 . 2007-12-13 21:35 <REP> dr------- C:\Documents and Settings\Cédric\Mes documents
2007-12-13 09:05 . 2006-10-10 20:51 <REP> dr------- C:\Documents and Settings\Cédric\Menu Démarrer
2007-12-13 09:05 . 2006-10-10 20:51 <REP> dr------- C:\Documents and Settings\Cédric\Menu Démarrer
2007-12-13 09:05 . 2007-12-17 17:56 <REP> dr------- C:\Documents and Settings\Cédric\Favoris
2007-12-13 09:05 . 2007-12-17 17:56 <REP> dr------- C:\Documents and Settings\Cédric\Favoris
2007-12-13 09:05 . 2007-12-13 21:35 <REP> d-------- C:\Documents and Settings\Cédric\Bureau
2007-12-13 09:05 . 2007-12-13 21:35 <REP> d-------- C:\Documents and Settings\Cédric\Bureau
2007-12-13 08:29 . 2007-12-13 08:29 280 --ah----- C:\sqmdata19.sqm
2007-12-13 08:29 . 2007-12-13 08:29 244 --ah----- C:\sqmnoopt19.sqm
2007-12-08 15:02 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-12-08 12:01 . 2007-12-08 12:01 208 --ah----- C:\sqmdata18.sqm
2007-12-08 12:01 . 2007-12-08 12:01 172 --ah----- C:\sqmnoopt18.sqm
2007-12-08 10:35 . 2007-12-08 15:02 <REP> d-------- C:\Program Files\Navilog1
2007-12-08 10:01 . 2007-12-08 10:01 268 --ah----- C:\sqmdata17.sqm
2007-12-08 10:01 . 2007-12-08 10:01 244 --ah----- C:\sqmnoopt17.sqm
2007-12-07 20:45 . 2007-12-07 20:45 <REP> d-------- C:\Program Files\Trend Micro
2007-12-07 10:11 . 2007-12-07 10:11 268 --ah----- C:\sqmdata16.sqm
2007-12-07 10:11 . 2007-12-07 10:11 244 --ah----- C:\sqmnoopt16.sqm
2007-12-06 21:38 . 2007-12-06 21:41 <REP> d-------- C:\Program Files\Windows Live Safety Center
2007-12-04 15:40 . 2007-12-04 15:40 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2007-12-04 15:40 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2007-12-04 15:27 . 2007-12-04 15:29 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2007-12-04 09:55 . 2007-12-04 09:55 <REP> d-------- C:\Program Files\Windows Live Favorites
2007-11-23 22:57 . 2007-11-23 22:57 <REP> d-------- C:\My Games
2007-11-23 10:38 . 2007-11-23 10:38 28,672 --a------ C:\WINDOWS\system32\f3PSSavr.scr.xpx
2007-11-20 14:02 . 2007-11-20 14:02 268 --ah----- C:\sqmdata15.sqm
2007-11-20 14:02 . 2007-11-20 14:02 244 --ah----- C:\sqmnoopt15.sqm
2007-11-19 09:21 . 2007-11-19 09:21 268 --ah----- C:\sqmdata14.sqm
2007-11-19 09:21 . 2007-11-19 09:21 244 --ah----- C:\sqmnoopt14.sqm
2007-11-18 18:03 . 2007-11-18 18:03 268 --ah----- C:\sqmdata13.sqm
2007-11-18 18:03 . 2007-11-18 18:03 244 --ah----- C:\sqmnoopt13.sqm
2007-11-18 08:52 . 2007-11-18 08:52 268 --ah----- C:\sqmdata12.sqm
2007-11-18 08:52 . 2007-11-18 08:52 244 --ah----- C:\sqmnoopt12.sqm
2007-11-14 23:36 . 2007-11-14 23:36 268 --ah----- C:\sqmdata11.sqm
2007-11-14 23:36 . 2007-11-14 23:36 244 --ah----- C:\sqmnoopt11.sqm
2007-11-14 09:35 . 2007-11-14 09:35 268 --ah----- C:\sqmdata10.sqm
2007-11-14 09:35 . 2007-11-14 09:35 244 --ah----- C:\sqmnoopt10.sqm
2007-11-13 19:18 . 2007-11-13 19:18 268 --ah----- C:\sqmdata09.sqm
2007-11-13 19:18 . 2007-11-13 19:18 244 --ah----- C:\sqmnoopt09.sqm
2007-11-01 20:31 . 2007-11-01 20:31 <REP> d-------- C:\Intel
2007-11-01 20:19 . 2007-11-02 12:38 <REP> d-------- C:\Documents and Settings\Vic\Application Data\Studio-Scrap
2007-11-01 09:19 . 2007-11-01 09:19 <REP> d-------- C:\NVIDIA

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-30 15:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\NannyMania
2007-12-30 15:16 --------- d-----w C:\Documents and Settings\Vic\Application Data\PlayFirst
2007-12-30 10:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2007-12-29 13:10 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-23 12:06 --------- d-----w C:\Program Files\eMule
2007-12-20 12:34 --------- d-----w C:\Program Files\Messenger Plus! Live
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 14:40 --------- d-----w C:\Program Files\Windows Live
2007-12-04 14:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-12-04 08:55 --------- d-----w C:\Program Files\Windows Live Toolbar
2007-11-25 16:07 --------- d-----w C:\Program Files\Picasa2
2007-11-25 09:01 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2007-11-23 19:02 --------- d-----w C:\Program Files\Fichiers communs\Real
2007-11-23 19:00 --------- d-----w C:\Program Files\Player Metaboli
2007-11-15 13:12 --------- d-----w C:\Documents and Settings\Vic\Application Data\GetRight
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-30 13:33 --------- d-----w C:\Program Files\Absolutist.com
2007-10-29 22:43 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-28 15:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sandlot Games
2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-23 16:49 586,752 ----a-w C:\WINDOWS\WLXPGSS.SCR
2007-10-15 19:05 71,680 ----a-w C:\WINDOWS\mmfs.dll
2007-10-03 06:41 46,080 ----a-w C:\WINDOWS\system32\ftp.exe
2007-10-03 06:41 17,920 ----a-w C:\WINDOWS\system32\tftp.exe
2007-09-28 08:24 966,973 ----a-w C:\WINDOWS\system32\DieuxDuStade.scr
2007-07-20 12:23 774,144 ----a-w C:\Program Files\RngInterstitial.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 06:00]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-03-31 19:38]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 09:59]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VX1000"="C:\WINDOWS\vVX1000.exe" [2006-10-13 17:04]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2006-10-13 17:01]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 06:00]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 00:15:56]
Outil de mise … jour Google.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-02-25 10:27:56]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\google\google~3\goec62~1.dll, NVDESK32.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Vic^Menu Démarrer^Programmes^Démarrage^Anti-Pub.lnk]
path=C:\Documents and Settings\Vic\Menu Démarrer\Programmes\Démarrage\Anti-Pub.lnk
backup=C:\WINDOWS\pss\Anti-Pub.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-10 18:51 39792 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-03-31 19:38 68856 --a------ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2006-11-03 09:59 204288 -----c--- C:\Program Files\Windows Media Player\WMPNSCFG.exe

S2 LicCtrlService;LicCtrl Service;rundll32.exe C:\WINDOWS\mmfs.dll,Service []
S2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamS32.exe" [2006-10-13 17:01]
S2 X4HSX32;X4HSX32;C:\Program Files\Player Metaboli\X4HSX32.Sys [2006-12-13 08:34]
S3 mdxgthkn;mdxgthkn;C:\DOCUME~1\Vic\LOCALS~1\Temp\mdxgthkn.sys []
S3 VX1000;VX-1000;C:\WINDOWS\system32\DRIVERS\VX1000.sys [2006-10-13 17:04]

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-12-30 15:22:02 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-30 16:41:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-30 16:42:30
C:\ComboFix2.txt ... 2007-12-29 13:40
C:\ComboFix3.txt ... 2007-12-29 13:08
.
2007-12-13 07:20:43 --- E O F ---
voila la je vais faire un nettoyage du disque et une defragmentation dis moi ce que tu en pense en tout cas la bougeotte est toujours la même si j'ai l'impression que ca le fais moins
Merci beaucoup...



Ajout du 30-12-2007 à 18:15:




Ajout du 30-12-2007 à 21:40:

J'ai trouvé se dossier peux tu me dire ce que c'est et si je peux l'effacer.
PS: j'en mets qu'une petite partie car c'est vraiment gros...
Microsoft (R) DrWtsn32
Copyright (C) 1985-2001 Microsoft Corp. Tous droits réservés.



Une exception d'application s'est produite :
App : C:\WINDOWS\Explorer.EXE (pid=1784)
Lorsque : 13/10/2006 @ 20:36:31.796
Numéro d'exception : c0000005 (violation d'accès)

*----> Informations système <----*
Nom ordinateur : HOME
Nom utilisateur : Bibi
ID de la session Terminal : 0
Nombre de processeurs : 2
Type de processeur : x86 Family 15 Model 4 Stepping 1
Version de Windows : 5.1
Numéro actuel : 2600
Service Pack : 2
Type actuel : Multiprocessor Free
Organisation enregistrée :
Propriétaire enregistré : Toto

*----> Liste des tâches <----*
0 System Process
4 System
304 smss.exe
352 csrss.exe
376 winlogon.exe
420 services.exe
432 lsass.exe
596 svchost.exe
644 svchost.exe
696 svchost.exe
748 svchost.exe
792 svchost.exe
924 spoolsv.exe
1096 nod32krn.exe
1428 alg.exe
1644 wscntfy.exe
1764 userinit.exe
1784 Explorer.EXE
1880 QuickTour2.exe
1972 hkcmd.exe
2024 nod32kui.exe
2032 smax4pnp.exe
208 mmtask.exe
220 mm_tray.exe
324 SuperCopier.exe
836 KEM.exe
1124 drwtsn32.exe
1136 MMDiag.exe
1188 Error 0x80070005
1484 KHALMNPR.EXE

*----> Liste des modules <----*
(0000000001000000 - 0000000001100000: C:\WINDOWS\Explorer.EXE
(000000000ffd0000 - 000000000fff8000: C:\WINDOWS\system32\rsaenh.dll
(0000000020000000 - 00000000202da000: C:\WINDOWS\system32\xpsp2res.dll
(0000000056780000 - 000000005678c000: C:\Program Files\SuperCopier\SCHook.DLL
(0000000058b50000 - 0000000058be7000: C:\WINDOWS\system32\comctl32.dll
(0000000059000000 - 000000005900e000: C:\WINDOWS\system32\wshFR.DLL
(00000000595b0000 - 000000005977a000: C:\WINDOWS\AppPatch\AcGenral.DLL
(000000005b090000 - 000000005b0c8000: C:\WINDOWS\system32\UxTheme.dll
(000000005b950000 - 000000005b9c3000: C:\WINDOWS\system32\themeui.dll
(000000005cea0000 - 000000005cec6000: C:\WINDOWS\system32\ShimEng.dll
(0000000060990000 - 000000006099e000: C:\WINDOWS\system32\MSISIP.DLL
(0000000061d70000 - 0000000061d7e000: C:\WINDOWS\system32\MFC42LOC.DLL
(00000000698e0000 - 00000000698f6000: C:\WINDOWS\system32\faultrep.dll
(000000006fee0000 - 000000006ff34000: C:\WINDOWS\system32\NETAPI32.dll
(00000000719e0000 - 00000000719e8000: C:\WINDOWS\system32\WS2HELP.dll
(00000000719f0000 - 0000000071a07000: C:\WINDOWS\system32\WS2_32.dll
(0000000071ca0000 - 0000000071cbc000: C:\WINDOWS\system32\actxprxy.dll
(0000000072c60000 - 0000000072c68000: C:\WINDOWS\system32\msacm32.drv
(0000000072c70000 - 0000000072c79000: C:\WINDOWS\system32\wdmaud.drv
(0000000073d20000 - 0000000073e1e000: C:\WINDOWS\system32\MFC42.DLL
(0000000074e10000 - 0000000074e20000: C:\WINDOWS\system32\wshext.dll
(0000000075f10000 - 000000007600c000: C:\WINDOWS\system32\BROWSEUI.dll
(00000000762f0000 - 0000000076300000: C:\WINDOWS\system32\WINSTA.dll
(0000000076310000 - 0000000076315000: C:\WINDOWS\system32\MSIMG32.dll
(0000000076340000 - 000000007638a000: C:\WINDOWS\system32\comdlg32.dll
(0000000076390000 - 000000007653a000: C:\WINDOWS\system32\NETSHELL.dll
(0000000076590000 - 00000000765ad000: C:\WINDOWS\System32\CSCDLL.dll
(00000000765b0000 - 0000000076606000: C:\WINDOWS\System32\cscui.dll
(0000000076610000 - 0000000076694000: C:\WINDOWS\system32\CRYPTUI.dll
(0000000076920000 - 0000000076928000: C:\WINDOWS\system32\LINKINFO.dll
(0000000076930000 - 0000000076956000: C:\WINDOWS\system32\ntshrui.dll
(0000000076960000 - 0000000076a15000: C:\WINDOWS\system32\USERENV.dll
(0000000076ac0000 - 0000000076ad1000: C:\WINDOWS\system32\ATL.DLL
(0000000076ae0000 - 0000000076b0f000: C:\WINDOWS\system32\WINMM.dll
(0000000076bb0000 - 0000000076bdf000: C:\WINDOWS\system32\credui.dll
(0000000076be0000 - 0000000076c0e000: C:\WINDOWS\system32\WINTRUST.dll
(0000000076c40000 - 0000000076c68000: C:\WINDOWS\system32\IMAGEHLP.dll
(0000000076d10000 - 0000000076d29000: C:\WINDOWS\system32\iphlpapi.dll
(0000000076e30000 - 0000000076e3e000: C:\WINDOWS\system32\rtutils.dll
(0000000076f00000 - 0000000076f08000: C:\WINDOWS\system32\WTSAPI32.dll
(0000000076f10000 - 0000000076f3d000: C:\WINDOWS\system32\WLDAP32.dll
(0000000076f80000 - 0000000076fff000: C:\WINDOWS\system32\CLBCATQ.DLL
(0000000077000000 - 00000000770d4000: C:\WINDOWS\system32\COMRes.dll
(00000000770e0000 - 000000007716c000: C:\WINDOWS\system32\OLEAUT32.dll
(0000000077170000 - 000000007720d000: C:\WINDOWS\system32\urlmon.dll
(0000000077390000 - 0000000077492000: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
(00000000774a0000 - 00000000775dc000: C:\WINDOWS\system32\ole32.dll
(0000000077720000 - 000000007788c000: C:\WINDOWS\system32\SHDOCVW.dll
(00000000778e0000 - 00000000779d8000: C:\WINDOWS\system32\SETUPAPI.dll
(00000000779e0000 - 0000000077a76000: C:\WINDOWS\system32\CRYPT32.dll
(0000000077a80000 - 0000000077a92000: C:\WINDOWS\system32\MSASN1.dll
(0000000077aa0000 - 0000000077b47000: C:\WINDOWS\system32\WININET.dll
(0000000077b50000 - 0000000077b72000: C:\WINDOWS\system32\appHelp.dll
(0000000077ba0000 - 0000000077ba7000: C:\WINDOWS\system32\midimap.dll
(0000000077bb0000 - 0000000077bc5000: C:\WINDOWS\system32\MSACM32.dll
(0000000077bd0000 - 0000000077bd8000: C:\WINDOWS\system32\VERSION.dll
(0000000077be0000 - 0000000077c38000: C:\WINDOWS\system32\msvcrt.dll
(0000000077d10000 - 0000000077da0000: C:\WINDOWS\system32\USER32.dll
(0000000077da0000 - 0000000077e4c000: C:\WINDOWS\system32\ADVAPI32.dll
(0000000077e50000 - 0000000077ee1000: C:\WINDOWS\system32\RPCRT4.dll
(0000000077ef0000 - 0000000077f36000: C:\WINDOWS\system32\GDI32.dll
(0000000077f40000 - 0000000077fb6000: C:\WINDOWS\system32\SHLWAPI.dll
(0000000077fc0000 - 0000000077fd1000: C:\WINDOWS\system32\Secur32.dll
(000000007c800000 - 000000007c904000: C:\WINDOWS\system32\kernel32.dll
(000000007c910000 - 000000007c9c7000: C:\WINDOWS\system32\ntdll.dll
(000000007c9d0000 - 000000007d1f2000: C:\WINDOWS\system32\SHELL32.dll
(000000007d200000 - 000000007d4b2000: C:\WINDOWS\system32\msi.dll

*----> Vidage de l'état de la thread 0x6fc <----*

eax=bc64de00 ebx=00000000 ecx=bf813d52 edx=81ac7450 esi=00191e9c edi=00191e9c
eip=7c91eb94 esp=0007f508 ebp=0007f7d0 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0a5b es=01d7 fs=003b gs=0296 efl=00000202

*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\ntdll.dll -
fonction : ntdll!KiFastSystemCallRet
7c91eb89 90 nop
7c91eb8a 90 nop
ntdll!KiFastSystemCall:
7c91eb8b 8bd4 mov edx,esp
7c91eb8d 0f34 sysenter
7c91eb8f 90 nop
7c91eb90 90 nop
7c91eb91 90 nop
7c91eb92 90 nop
7c91eb93 90 nop
ntdll!KiFastSystemCallRet:
7c91eb94 c3 ret
7c91eb95 8da42400000000 lea esp,[esp]
7c91eb9c 8d642400 lea esp,[esp]
7c91eba0 90 nop
7c91eba1 90 nop
7c91eba2 90 nop
7c91eba3 90 nop
7c91eba4 90 nop
ntdll!KiIntSystemCall:
7c91eba5 8d542408 lea edx,[esp+0x8]
7c91eba9 cd2e int 2e

*----> Suivi arrière de la pile <----*
WARNING: Stack unwind information not available. Following frames may be wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\kernel32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\USER32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\SHELL32.dll -
*** ERROR: Module load completed but symbols could not be loaded for C:\WINDOWS\Explorer.EXE
ChildEBP RetAddr Args to Child
0007f7d0 7c926042 0011bf88 0007f848 00000000 ntdll!KiFastSystemCallRet
0007fa8c 7c9262da 00000000 0011bf88 0007fd80 ntdll!RtlValidateUnicodeString+0x3d0
0007fd34 7c801bb9 0011bf88 0007fd80 0007fd60 ntdll!LdrLoadDll+0x110
0007fd9c 77d3dcb6 0007fe00 00000000 00000008 kernel32!LoadLibraryExW+0xc8
0007fdc8 7c91eae3 0007fdd8 00000088 00000088 USER32!EnumClipboardFormats+0x245
0007fe88 77d193df 0007fed4 00000000 00000000 ntdll!KiUserCallbackDispatcher+0x13
0007feb4 7ca49612 0007fed4 00000000 00000000 USER32!PeekMessageW+0x167
0007fef0 7ca495d2 7c8092ac 000dc950 000dc950 SHELL32!Ordinal733+0x2c1
0007ff08 7ca42c57 00000000 0007ff5c 01016e95 SHELL32!Ordinal733+0x281
0007ff14 01016e95 000dc950 7ffdf000 0007ffc0 SHELL32!Ordinal201+0x28
0007ff5c 0101e2b6 00000000 00000000 000205e2 Explorer+0x16e95
0007ffc0 7c816d4f 00000002 58b53c48 7ffdf000 Explorer+0x1e2b6
0007fff0 00000000 0101e24e 00000000 78746341 kernel32!RegisterWaitForInputIdle+0x49

*----> Vidage brut de la pile <----*
000000000007f508 09 dd 91 7c ec 6f 92 7c - 84 f5 07 00 20 00 10 00 ...|.o.|.... ...
000000000007f518 3c f5 07 00 5c f5 07 00 - 05 00 00 00 60 00 00 00 <...\.......`...
000000000007f528 16 02 00 00 60 fd 07 00 - 00 00 00 00 98 50 0e 00 ....`........P..
000000000007f538 ac 50 0e 00 18 00 00 00 - 00 00 00 00 68 f5 07 00 .P..........h...
000000000007f548 40 00 00 00 00 00 00 00 - 00 00 00 00 94 04 d4 77 @..............w
000000000007f558 58 b2 d1 77 ff ff ff ff - 50 b2 d1 77 9d 17 75 77 X..w....P..w..uw
000000000007f568 66 00 1a 02 a0 20 09 00 - b8 00 01 00 54 f8 07 00 f.... ......T...
000000000007f578 88 bf 11 00 70 c9 0d 00 - 20 00 00 00 00 00 00 00 ....p... .......
000000000007f588 d9 2c f1 75 00 00 00 00 - 5e 00 60 00 a0 f5 07 00 .,.u....^.`.....
000000000007f598 b8 00 01 00 01 00 01 00 - 43 00 3a 00 5c 00 50 00 ........C.:.\.P.
000000000007f5a8 72 00 6f 00 67 00 72 00 - 61 00 6d 00 20 00 46 00 r.o.g.r.a.m. .F.
000000000007f5b8 69 00 6c 00 65 00 73 00 - 5c 00 4c 00 6f 00 67 00 i.l.e.s.\.L.o.g.
000000000007f5c8 69 00 74 00 65 00 63 00 - 68 00 5c 00 53 00 65 00 i.t.e.c.h.\.S.e.
000000000007f5d8 74 00 50 00 6f 00 69 00 - 6e 00 74 00 5c 00 6c 00 t.P.o.i.n.t.\.l.
000000000007f5e8 67 00 73 00 63 00 72 00 - 6f 00 6c 00 6c 00 2e 00 g.s.c.r.o.l.l...
000000000007f5f8 64 00 6c 00 6c 00 00 00 - 00 00 00 00 00 00 00 00 d.l.l...........
000000000007f608 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000007f618 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000007f628 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000007f638 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................

*----> Vidage de l'état de la thread 0x708 <----*

eax=77e56bf0 ebx=00000000 ecx=00000009 edx=7c920732 esi=000b2c98 edi=00000100
eip=7c91eb94 esp=00e3fe1c ebp=00e3ff80 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

fonction : ntdll!KiFastSystemCallRet
7c91eb89 90 nop
7c91eb8a 90 nop
ntdll!KiFastSystemCall:
7c91eb8b 8bd4 mov edx,esp
7c91eb8d 0f34 sysenter
7c91eb8f 90 nop
7c91eb90 90 nop
7c91eb91 90 nop
7c91eb92 90 nop
7c91eb93 90 nop
ntdll!KiFastSystemCallRet:
7c91eb94 c3 ret
7c91eb95 8da42400000000 lea esp,[esp]
7c91eb9c 8d642400 lea esp,[esp]
7c91eba0 90 nop
7c91eba1 90 nop
7c91eba2 90 nop
7c91eba3 90 nop
7c91eba4 90 nop
ntdll!KiIntSystemCall:
7c91eba5 8d542408 lea edx,[esp+0x8]
7c91eba9 cd2e int 2e

*----> Suivi arrière de la pile <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\RPCRT4.dll -
WARNING: Stack unwind information not available. Following frames may be wrong.
ChildEBP RetAddr Args to Child
00e3ff80 77e56c22 00e3ffa8 77e56a3b 000b2c98 ntdll!KiFastSystemCallRet
00e3ff88 77e56a3b 000b2c98 00000000 00ddeef8 RPCRT4!I_RpcBCacheFree+0x5ea
00e3ffa8 77e56c0a 000b2b50 00e3ffec 7c80b50b RPCRT4!I_RpcBCacheFree+0x403
00e3ffb4 7c80b50b 000bda68 00000000 00ddeef8 RPCRT4!I_RpcBCacheFree+0x5d2
00e3ffec 00000000 77e56bf0 000bda68 00000000 kernel32!GetModuleFileNameA+0x1b4

*----> Vidage brut de la pile <----*
0000000000e3fe1c 99 e3 91 7c 03 67 e5 77 - 9c 01 00 00 70 ff e3 00 ...|.g.w....p...
0000000000e3fe2c 00 00 00 00 c0 e0 0b 00 - 54 ff e3 00 3c 9d 96 aa ........T...<...
0000000000e3fe3c a0 8a 53 80 d0 cf 4d 80 - ff ff ff ff 2e 6b 53 80 ..S...M......kS.
0000000000e3fe4c 86 f8 60 80 53 06 61 80 - 64 9d 96 aa 78 f4 07 00 ..`.S.a.d...x...
0000000000e3fe5c e0 f7 60 80 40 a6 5e e2 - 44 a6 5e e2 50 74 ac 81 ..`.@.^.D.^.Pt..
0000000000e3fe6c 00 00 00 00 d4 ea fb 81 - 00 a6 5e e2 cc 9b 96 aa ..........^.....
0000000000e3fe7c 65 ba 5b 80 f8 59 b2 81 - 40 00 00 00 06 02 00 00 e.[..Y..@.......
0000000000e3fe8c f4 ee 4f 80 8b fa 53 80 - 40 78 ab 81 28 9c 96 aa ..O...S.@x..(...
0000000000e3fe9c 00 41 6e 80 43 4d 6e 80 - 28 9c 96 aa 27 44 6e 80 .An.CMn.(...'Dn.
0000000000e3feac 00 0d db ba 00 00 00 00 - 8b fa 53 80 00 0d db ba ..........S.....
0000000000e3febc 81 28 55 80 00 0d db ba - 00 00 00 00 b8 7a ab 81 .(U..........z..
0000000000e3fecc 88 9c 96 aa 00 00 00 00 - a0 7b ab 81 01 15 00 00 .........{......
0000000000e3fedc a0 9c 96 aa 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000e3feec 81 28 55 80 ff ff ff ff - 40 55 70 f8 00 00 00 00 .(U.....@Up.....
0000000000e3fefc 10 44 6e 80 dc 79 ab 81 - 28 9c 96 aa 00 00 00 00 .Dn..y..(.......
0000000000e3ff0c 27 44 6e 80 08 00 00 00 - 46 02 00 00 39 2b 50 80 'Dn.....F...9+P.
0000000000e3ff1c b0 78 ab 81 40 78 ab 81 - 6c ad 4f 80 ac 79 ab 81 .x..@x..l.O..y..
0000000000e3ff2c 40 78 ab 81 80 ff e3 00 - 99 66 e5 77 4c ff e3 00 @x.......f.wL...
0000000000e3ff3c a9 66 e5 77 ed 10 91 7c - 60 d3 0b 00 68 da 0b 00 .f.w...|`...h...
0000000000e3ff4c 00 a2 2f 4d ff ff ff ff - 00 5d 1e ee ff ff ff ff ../M.....]......

*----> Vidage de l'état de la thread 0x70c <----*

eax=774b319a ebx=00007530 ecx=7ffdf000 edx=00000000 esi=00000000 edi=00e7ff50
eip=7c91eb94 esp=00e7ff20 ebp=00e7ff78 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206

fonction : ntdll!KiFastSystemCallRet
7c91eb89 90 nop
7c91eb8a 90 nop
ntdll!KiFastSystemCall:
7c91eb8b 8bd4 mov edx,esp
7c91eb8d 0f34 sysenter
7c91eb8f 90 nop
7c91eb90 90 nop
7c91eb91 90 nop
7c91eb92 90 nop
7c91eb93 90 nop
ntdll!KiFastSystemCallRet:
7c91eb94 c3 ret
7c91eb95 8da42400000000 lea esp,[esp]
7c91eb9c 8d642400 lea esp,[esp]
7c91eba0 90 nop
7c91eba1 90 nop
7c91eba2 90 nop
7c91eba3 90 nop
7c91eba4 90 nop
ntdll!KiIntSystemCall:
7c91eba5 8d542408 lea edx,[esp+0x8]
7c91eba9 cd2e int 2e

*----> Suivi arrière de la pile <----*
WARNING: Stack unwind information not available. Following frames may be wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\ole32.dll -
ChildEBP RetAddr Args to Child
00e7ff78 7c802451 0000ea60 00000000 00e7ffb4 ntdll!KiFastSystemCallRet
00e7ff88 774b2fcb 0000ea60 000c0238 774b314d kernel32!Sleep+0xf
00e7ffb4 7c80b50b 000c0238 00000000 7c92094e ole32!StringFromGUID2+0x2d1
00e7ffec 00000000 774b319a 000c0238 00000000 kernel32!GetModuleFileNameA+0x1b4

*----> Vidage brut de la pile <----*
0000000000e7ff20 5c d8 91 7c ed 23 80 7c - 00 00 00 00 50 ff e7 00 \..|.#.|....P...
0000000000e7ff30 50 25 80 7c f0 56 5c 77 - 30 75 00 00 14 00 00 00 P%.|.V\w0u......
0000000000e7ff40 01 00 00 00 00 00 00 00 - 00 00 00 00 10 00 00 00 ................
0000000000e7ff50 00 ba 3c dc ff ff ff ff - 08 4f 4a 77 50 ff e7 00 ..<......OJwP...
0000000000e7ff60 30 ff e7 00 88 28 0b 00 - dc ff e7 00 f3 99 83 7c 0....(.........|
0000000000e7ff70 58 24 80 7c 00 00 00 00 - 88 ff e7 00 51 24 80 7c X$.|........Q$.|
0000000000e7ff80 60 ea 00 00 00 00 00 00 - b4 ff e7 00 cb 2f 4b 77 `............/Kw
0000000000e7ff90 60 ea 00 00 38 02 0c 00 - 4d 31 4b 77 00 00 00 00 `...8...M1Kw....
0000000000e7ffa0 00 00 00 00 38 02 0c 00 - 00 00 4a 77 b5 31 4b 77 ....8.....Jw.1Kw
0000000000e7ffb0 4e 09 92 7c ec ff e7 00 - 0b b5 80 7c 38 02 0c 00 N..|.......|8...
0000000000e7ffc0 00 00 00 00 4e 09 92 7c - 38 02 0c 00 00 b0 fd 7f ....N..|8.......
0000000000e7ffd0 00 06 fc 81 c0 ff e7 00 - 28 18 af 81 ff ff ff ff ........(.......
0000000000e7ffe0 f3 99 83 7c 18 b5 80 7c - 00 00 00 00 00 00 00 00 ...|...|........
0000000000e7fff0 00 00 00 00 9a 31 4b 77 - 38 02 0c 00 00 00 00 00 .....1Kw8.......
0000000000e80000 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000e80010 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000e80020 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000e80030 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000e80040 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000e80050 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................

*----> Vidage de l'état de la thread 0x778 <----*

eax=aa5fd548 ebx=00000000 ecx=e2926790 edx=00000000 esi=7c98c0d8 edi=00000000
eip=7c91eb94 esp=00eef33c ebp=00eef3c4 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=a944 es=ffff fs=003b gs=1bf0 efl=00000246

fonction : ntdll!KiFastSystemCallRet
7c91eb89 90 nop
7c91eb8a 90 nop
ntdll!KiFastSystemCall:
7c91eb8b 8bd4 mov edx,esp
7c91eb8d 0f34 sysenter
7c91eb8f 90 nop
7c91eb90 90 nop
7c91eb91 90 nop
7c91eb92 90 nop
7c91eb93 90 nop
ntdll!KiFastSystemCallRet:
7c91eb94 c3 ret
7c91eb95 8da42400000000 lea esp,[esp]
7c91eb9c 8d642400 lea esp,[esp]
7c91eba0 90 nop
7c91eba1 90 nop
7c91eba2 90 nop
7c91eba3 90 nop
7c91eba4 90 nop
ntdll!KiIntSystemCall:
7c91eba5 8d542408 lea edx,[esp+0x8]
7c91eba9 cd2e int 2e

*----> Suivi arrière de la pile <----*
WARNING: Stack unwind information not available. Following frames may be wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\SHLWAPI.dll -
ChildEBP RetAddr Args to Child
00eef3c4 7c91104b 0198c0d8 7c9231dc 7c98c0d8 ntdll!KiFastSystemCallRet
00eef408 7c926298 00000001 00000000 00eef468 ntdll!RtlEnterCriticalSection+0x46
00eef6a4 7c801bb9 0011a4e8 00eef6f0 00eef6d0 ntdll!LdrLoadDll+0xce
00eef70c 77d3dcb6 00eef770 00000000 00000008 kernel32!LoadLibraryExW+0xc8
00eef738 7c91eae3 00eef748 00000088 00000088 USER32!EnumClipboardFormats+0x245
00eef808 77d1b7ab 00545e90 00000418 00000000 ntdll!KiUserCallbackDispatcher+0x13
00eef828 01007523 00010094 00000418 00000000 USER32!SendMessageW+0x49
00eef84c 01007596 00000002 ffffffff 00eefaf4 Explorer+0x7523
00eef864 0100785f 00010168 00007f05 00000000 Explorer+0x7596
00eef88c 01007808 00eefaec 00eef910 00eef960 Explorer+0x785f
00eef89c 010077bc 0001008e 00010168 00eefad4 Explorer+0x7808
00eef960 01001b5e 00040038 0000004a 00010168 Explorer+0x77bc
00eef984 77d18709 00040038 0000004a 00010168 Explorer+0x1b5e
00eef9b0 77d187eb 01001b1f 00040038 0000004a USER32!GetDC+0x72
00eefa18 77d1b368 0009f778 01001b1f 00040038 USER32!GetDC+0x154
00eefa6c 77d3f575 00545950 0000004a 00010168 USER32!DefWindowProcW+0x183
00eefa9c 7c91eae3 00eefaac 00000400 00000400 USER32!LoadAcceleratorsA+0x68
00eefed4 77d193df 00eeff28 00000000 00000000 ntdll!KiUserCallbackDispatcher+0x13
00eeff00 010019c1 00eeff28 00000000 00000000 USER32!PeekMessageW+0x167
00eeff44 01011e8b 00000000 00eeffb4 77f5f5de Explorer+0x19c1
00eeff50 77f5f5de 010460d8 0000005c 00840043 Explorer+0x11e8b
00eeffb4 7c80b50b 00000000 0000005c 00840043 SHLWAPI!Ordinal505+0x369
00eeffec 00000000 77f5f56f 0007fdbc 00000000 kernel32!GetModuleFileNameA+0x1b4

*----> Vidage brut de la pile <----*
0000000000eef33c c0 e9 91 7c 1b 90 92 7c - a0 02 00 00 00 00 00 00 ...|...|........
0000000000eef34c 00 00 00 00 68 f4 ee 00 - 00 00 00 00 01 00 00 00 ....h...........
0000000000eef35c 61 00 6d 00 20 00 46 00 - 69 00 6c 00 65 00 73 00 a.m. .F.i.l.e.s.
0000000000eef36c 5c 00 4c 00 6f 00 67 00 - 69 00 74 00 65 00 63 00 \.L.o.g.i.t.e.c.
0000000000eef37c 68 00 5c 00 53 00 65 00 - 74 00 50 00 6f 00 69 00 h.\.S.e.t.P.o.i.
0000000000eef38c 6e 00 74 00 5c 00 6c 00 - 67 00 73 00 63 00 72 00 n.t.\.l.g.s.c.r.
0000000000eef39c 6f 00 6c 00 6c 00 2e 00 - 64 00 6c 00 6c 00 00 00 o.l.l...d.l.l...
0000000000eef3ac 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000eef3bc 00 00 00 00 a0 02 00 00 - 08 f4 ee 00 4b 10 91 7c ............K..|
0000000000eef3cc d8 c0 98 01 dc 31 92 7c - d8 c0 98 7c 08 00 15 c0 .....1.|...|....
0000000000eef3dc 01 00 00 00 00 00 00 00 - f4 f4 ee 00 6b 1e 3a 77 ............k.:w
0000000000eef3ec 68 10 00 00 d8 f3 ee 00 - 78 62 92 7c 94 f6 ee 00 h.......xb.|....
0000000000eef3fc 18 ee 91 7c 18 32 92 7c - ff ff ff ff a4 f6 ee 00 ...|.2.|........
0000000000eef40c 98 62 92 7c 01 00 00 00 - 00 00 00 00 68 f4 ee 00 .b.|........h...
0000000000eef41c 00 00 00 00 48 f7 ee 00 - 70 f7 ee 00 6b 1e 3a 77 ....H...p...k.:w
0000000000eef42c 00 20 3a 77 48 f9 0c 00 - 94 00 01 00 3a 04 00 00 . :wH.......:...
0000000000eef43c 00 00 00 00 c3 ca 00 00 - 70 f4 ee 00 09 87 d1 77 ........p......w
0000000000eef44c 94 00 01 00 18 04 00 00 - f0 f6 ee 00 e8 a4 11 00 ................
0000000000eef45c ec f6 ee 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000eef46c 00 00 08 02 80 f4 ee 00 - 00 00 00 00 00 00 00 00 ................

*----> Vidage de l'état de la thread 0x77c <----*

eax=7c93798d ebx=00000000 ecx=77da6a51 edx=77da6a18 esi=ffffffff edi=7c91fb78
eip=7c91eb94 esp=00f2ff9c ebp=00f2ffb4 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

fonction : ntdll!KiFastSystemCallRet
7c91eb89 90 nop
7c91eb8a 90 nop
ntdll!KiFastSystemCall:
7c91eb8b 8bd4 mov edx,esp
7c91eb8d 0f34 sysenter
7c91eb8f 90 nop
BONNE SOIREE ET MERCI

Télécharger sur le bureau
SdFix
= Double-clic SDFix.
= Clic Install
------
= Redémarrer en mode Sans Échec (le démarrage peut prendre plusieurs minutes)
Attention, pas d’accès à internet dans ce mode. Enregistrer ou imprimer les consignes. Relancer le Pc et tapoter la touche F8 ( ou F5, 2 ou 4 pour certains) , jusqu’à l’apparition des inscriptions avec choix de démarrage
Avec les touches « flèches », sélectionner Mode sans échec ==> entrée ==>nom utilisateur habituel
--------
= Double-clic sur le nouveau dossier SDFix qui est dans C:\
= Double-clic RunThis
= Presser Y
= A l’invitation ==> appuyer sur une touche pour redémarrer
= Redémarrage ( qui sera plus long ,car nettoyage en cours )
Continuer si un message d’erreur apparaît ,dans ce cas aller directement au rapport dans SDfix
= apparition de Finished
= Appuyer sur une touche
= Dans SDFix , un rapport Report.
= Copier/coller le rapport dans la réponse

Salut, comme prevus je t'envois les rapports qui on ete fais en mode sans echec:
SDFix: Version 1.120

Run by Vic on 31/12/2007 at 15:47

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


C:\WINDOWS\system32\Microsoft\backup.ftp Found
C:\WINDOWS\system32\Microsoft\backup.tftp Found

Checking files:

Genuine:
C:\WINDOWS\system32\Microsoft\backup.ftp
C:\WINDOWS\system32\Microsoft\backup.tftp

Dummy:
C:\WINDOWS\system32\ftp.exe
C:\WINDOWS\system32\tftp.exe
C:\WINDOWS\system32\dllcache\ftp.exe
C:\WINDOWS\system32\dllcache\tftp.exe

Files copied to SDFix\Backups

Restoring files if backups are found

Final Check:

Genuine:
C:\WINDOWS\system32\Microsoft\backup.ftp
C:\WINDOWS\system32\Microsoft\backup.tftp
C:\WINDOWS\system32\ftp.exe
C:\WINDOWS\system32\tftp.exe
C:\WINDOWS\system32\dllcache\ftp.exe
C:\WINDOWS\system32\dllcache\tftp.exe

Dummy:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\system32\Microsoft\backup.ftp - Deleted
C:\WINDOWS\system32\Microsoft\backup.tftp - Deleted



Folder C:\Program Files\Fichiers communs\Carlson - Removed

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-31 15:52:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...


scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 408


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Fri 12 Oct 2007 5,903,928 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Mon 5 Mar 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 25 Feb 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Thu 15 Nov 2007 133,632 ...H. --- "C:\Documents and Settings\Vic\Application Data\Microsoft\Word\~WRL1433.tmp"
Thu 15 Nov 2007 129,536 ...H. --- "C:\Documents and Settings\Vic\Application Data\Microsoft\Word\~WRL1943.tmp"
Thu 15 Nov 2007 129,024 ...H. --- "C:\Documents and Settings\Vic\Application Data\Microsoft\Word\~WRL2280.tmp"

Finished!
catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-31 15:52:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...


scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 408
merci beaucoup pour votre aide