Bonjour, je sais pas pourquoi, mais ma page de démarrage est bloquée sur: ://files/Internet%20Explorer/IEXPLORE.EXE
Je peux la changer dans mes options, mais l'ouverture se fait toujours à la même enseigne!
J'ai scanné avec spybot, Norton, et scan online (panda) sans succès.




Est-ce que le csrss.exe d'I Explorer à sa raison d'être au démarrage?


J'ai la même chose avec Mozilla.

_________________
Plus on partage, plus on possède.
Ils ne savaient pas que c'était impossible...ils l'ont fait!

en fait, je suis pas sur d'avoir une merdouille, mais toujours est-il que ma page d'ouverture ce lance automatiquement sur cette coordonnée et je dois cliquer sur l'icone de démarrage pour ouvrir mon adresse désignée.

_________________
Plus on partage, plus on possède.
Ils ne savaient pas que c'était impossible...ils l'ont fait!

Ce processus n'a rien à faire au menu démarrage de windows.... c'est un service légitime mais tel qu'illustré, c'est sans doute un virus.

Essaie un autre anti-virus pour tester....

;^)

OK, j'essaye d'autres avenues.

Kaspersky et Spysweeper en ont trouvé, j'ai éliminer ceux de Kaspersky, mais rien n'a changé:

Kaspersky Anti-Virus database records: 266143
Scan Statistics:
Total number of scanned objects: 86141
Number of viruses found: 2
Number of infected objects: 2 / 0
Number of suspicious objects: 0
Duration of the scan process: 03:01:51

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\InboxLOG.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\OutboxLOG.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Phil\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Phil\Local Settings\Application Data\ApplicationHistory\CLI.EXE.c88dbd71.ini.inuse Object is locked skipped
C:\Documents and Settings\Phil\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db Object is locked skipped
C:\Documents and Settings\Phil\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db.shadow Object is locked skipped
C:\Documents and Settings\Phil\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Phil\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Phil\Local Settings\Historique\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Phil\Local Settings\Historique\History.IE5\MSHist012007020820070209\index.dat Object is locked skipped
C:\Documents and Settings\Phil\Local Settings\Temp\Perflib_Perfdata_1a0.dat Object is locked skipped
C:\Documents and Settings\Phil\Local Settings\Temp\~DF30A9.tmp Object is locked skipped
C:\Documents and Settings\Phil\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Phil\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Phil\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Phil\UserData\index.dat Object is locked skipped
C:\RECYCLER\NPROTECT\NPROTECT.LOG Object is locked skipped
C:\System Volume Information\catalog.wci\00000002.ps1 Object is locked skipped
C:\System Volume Information\catalog.wci\00000002.ps2 Object is locked skipped
C:\System Volume Information\catalog.wci\00010011.ci Object is locked skipped
C:\System Volume Information\catalog.wci\cicat.fid Object is locked skipped
C:\System Volume Information\catalog.wci\cicat.hsh Object is locked skipped
C:\System Volume Information\catalog.wci\CiCL0001.000 Object is locked skipped
C:\System Volume Information\catalog.wci\CiP10000.000 Object is locked skipped
C:\System Volume Information\catalog.wci\CiP20000.000 Object is locked skipped
C:\System Volume Information\catalog.wci\CiPT0000.000 Object is locked skipped
C:\System Volume Information\catalog.wci\CiSL0001.000 Object is locked skipped
C:\System Volume Information\catalog.wci\CiSP0000.000 Object is locked skipped
C:\System Volume Information\catalog.wci\CiST0000.000 Object is locked skipped
C:\System Volume Information\catalog.wci\CiVP0000.000 Object is locked skipped
C:\System Volume Information\catalog.wci\INDEX.000 Object is locked skipped
C:\System Volume Information\catalog.wci\propstor.bk1 Object is locked skipped
C:\System Volume Information\catalog.wci\propstor.bk2 Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\WINDOWS\CSC\00000001 Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\ModemLog_SoftV90 Data Fax Voice Modem.txt Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\atapi.sys Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\spool\PRINTERS\00003.SPL Object is locked skipped
C:\WINDOWS\system32\unsvchosts.exe Infected: not-a-virus:RiskTool.Win32.Starter.a skippedC:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_958.dat Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\Program Files\Norton SystemWorks\Norton Antivirus\AVApp.log Object is locked skipped
D:\Program Files\Norton SystemWorks\Norton Antivirus\AVError.log Object is locked skipped
D:\Program Files\Norton SystemWorks\Norton Antivirus\AVVirus.log Object is locked skipped
D:\RECYCLER\NPROTECT\00024177.exe Infected: Trojan-Clicker.Win32.Agent.is skippedD:\RECYCLER\NPROTECT\NPROTECT.LOG Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped


Spy Sweeper Début de session, 8 février 2007

12:34: Analyse lancée avec la version des définitions 855
12:34: Démarrage de l’analyse de la mémoire
12:51: Démarrage de l’analyse du Registre
12:53: Trouvé Adware: delfin
12:53: HKCR\clsid\{39d37d53-eab9-4e04-9ac2-1d72f051590c}\ (1 traces secondaires) (ID = 886194)
12:53: HKCR\clsid\{baa62b4f-5e59-40cc-b2ec-0e19b8776fa2}\ (1 traces secondaires) (ID = 886262)
12:53: HKLM\software\classes\clsid\{39d37d53-eab9-4e04-9ac2-1d72f051590c}\ (1 traces secondaires) (ID = 886636)
12:53: HKLM\software\classes\clsid\{baa62b4f-5e59-40cc-b2ec-0e19b8776fa2}\ (1 traces secondaires) (ID = 886704)
12:53: Trouvé Adware: command
12:53: HKLM\system\currentcontrolset\enum\root\legacy_cmdservice\ (8 traces secondaires) (ID = 1016072)
12:53: HKCR\appid\pedev.dll\ (1 traces secondaires) (ID = 1350894)
12:53: HKCR\appid\{07d6c807-5aa2-420d-beaf-8fac74790512}\ (1 traces secondaires) (ID = 1350898)
12:53: HKCR\clsid\{5e47627b-d89e-442b-82a6-f2fab368621b}\ (9 traces secondaires) (ID = 1350914)
12:53: HKCR\pedev_bho.pedev\ (5 traces secondaires) (ID = 1351026)
12:53: HKCR\pedev_bho.pedev.1\ (3 traces secondaires) (ID = 1351032)
12:53: HKCR\typelib\{43a1c50a-0683-4caf-8066-3184184dfdb9}\ (9 traces secondaires) (ID = 1351045)
12:53: HKLM\software\classes\appid\pedev.dll\ (1 traces secondaires) (ID = 1351059)
12:53: HKLM\software\classes\appid\{07d6c807-5aa2-420d-beaf-8fac74790512}\ (1 traces secondaires) (ID = 1351063)
12:53: HKLM\software\classes\clsid\{5e47627b-d89e-442b-82a6-f2fab368621b}\ (9 traces secondaires) (ID = 1351079)
12:53: HKLM\software\classes\pedev_bho.pedev\ (5 traces secondaires) (ID = 1351191)
12:53: HKLM\software\classes\pedev_bho.pedev.1\ (3 traces secondaires) (ID = 1351197)
12:53: HKLM\software\classes\typelib\{43a1c50a-0683-4caf-8066-3184184dfdb9}\ (9 traces secondaires) (ID = 1351210)
12:53: HKLM\system\controlset001\enum\root\legacy_cmdservice\ (8 traces secondaires) (ID = 1556665)
12:54: Trouvé Adware: virtumonde
12:54: HKLM\system\controlset001\enum\root\legacy_com+_messages\ (8 traces secondaires) (ID = 1895850)
12:54: HKLM\system\controlset002\enum\root\legacy_com+_messages\ (8 traces secondaires) (ID = 1895874)
12:54: Trouvé Adware: targetsaver
12:54: HKU\S-1-5-21-1454471165-1035525444-839522115-1003\software\idl\ (1 traces secondaires) (ID = 1351285)
12:55: Analyse du Registre terminée, temps passé :00:03:44
12:55: Démarrage de l’analyse des cookies
12:55: Analyse des cookies terminée, temps passé : 00:00:00
12:55: Démarrage de l’analyse des fichiers
13:55: Analyse des fichiers terminée, temps passé : 00:59:41
13:55: Analyse complète terminée. Durée 01:21:03
13:55: Traces trouvées : 114
14:15: Processus de suppression lancé.
14:15: Mise en quarantaine de toutes les traces : virtumonde
14:15: Mise en quarantaine de toutes les traces : delfin
14:15: Mise en quarantaine de toutes les traces : targetsaver
14:15: Mise en quarantaine de toutes les traces : command
14:15: Processus de suppression lancé. Durée 00:00:16

_________________
Plus on partage, plus on possède.
Ils ne savaient pas que c'était impossible...ils l'ont fait!

1- désactiver la "restauration système"
2- nettoyer les fichiers de "restauraton système"
3- un coup de PREVX... [url]http://info.prevx.com/downloadprevx1.asp
[/url]
;^)

OK, j'essaye ça.

_________________
Plus on partage, plus on possède.
Ils ne savaient pas que c'était impossible...ils l'ont fait!

Weird! Prevx fait planter mon PC qui redémarre dès que je veux l'exécuter.

_________________
Plus on partage, plus on possède.
Ils ne savaient pas que c'était impossible...ils l'ont fait!

4- un coup de Drweb cure-it (attention, c'est très efficace mais ça peut être long pour scanner le contenu des disques durs)... http://download.drweb.com/drweb+cureit/ le fichier exécutable se trouve à la toute fin de la page..

;^)

J'te remercie, j'ai finalement du reformatter, mais je garde cette info.

_________________
Plus on partage, plus on possède.
Ils ne savaient pas que c'était impossible...ils l'ont fait!