Citation de pad74 le 27 décembre 2005, 15 h 08 min

Bonjour à tous,

Mon antivirus AVG détecte le virus rdriv.sys

J’ai vu sur pas mal de forum qu’il n’existait pas une solution miracle pour le détruire et qu’à priori, aucun antivirus ne pouvait le supprimer.

J’ai donc envoyé un scan HijackThis, je voulais savoir si je pouvais avoir votre aide.

D’avance, je vous remercie.

Logfile of HijackThis v1.99.1

Scan saved at 1529, on 27/12/2005

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:WINNTSystem32smss.exe

C:WINNTsystem32winlogon.exe

C:WINNTsystem32services.exe

C:WINNTsystem32lsass.exe

C:WINNTSystem32Ati2evxx.exe

C:WINNTsystem32svchost.exe

C:WINNTSystem32svchost.exe

C:WINNTsystem32spoolsv.exe

C:WINNTsystem32Ati2evxx.exe

C:WINNTExplorer.EXE

C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe

C:PROGRA~1GrisoftAVGFRE~1avgemc.exe

C:Program FilesAnalog DevicesSoundMAXSMTray.exe

C:Program FilesFichiers communsMicrosoft SharedWorks SharedWkUFind.exe

C:Program FilesSpy Emergency 2005SpyEmergency.exe

C:Program FilesInterVideoCommonBinWinCinemaMgr.exe

C:Program FilesPinnacleShared FilesProgramsSchedulerPCLEScheduler.exe

C:Program FilesReality FusionReality Fusion GameCam SEProgramRFTRay.exe

C:Program FilesWebshotsWebshotsTray.exe

C:PROGRA~1GrisoftAVGFRE~1avgamsvr.exe

C:PROGRA~1GrisoftAVGFRE~1avgupsvc.exe

C:Program FilesKerioPersonal Firewallpersfw.exe

C:Program FilesAnalog DevicesSoundMAXSMAgent.exe

C:WINNTSystem32svchost.exe

C:Program FilesInternet Exploreriexplore.exe

D:Mes logicielsHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.fr/

R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 5.0ReaderActiveXAcroIEHelper.ocx

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINNTSystem32msdxm.ocx

O4 - HKLM..Run: [Synchronization Manager] mobsync.exe /logon

O4 - HKLM..Run: [ATIPTA] C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe

O4 - HKLM..Run: [AVG7_CC] C:PROGRA~1GrisoftAVGFRE~1avgcc.exe /STARTUP

O4 - HKLM..Run: [AVG7_EMC] C:PROGRA~1GrisoftAVGFRE~1avgemc.exe

O4 - HKLM..Run: [Smapp] C:Program FilesAnalog DevicesSoundMAXSMTray.exe

O4 - HKLM..Run: [PinnacleDriverCheck] C:WINNTSystem32PSDrvCheck.exe -CheckReg

O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime

O4 - HKLM..Run: [Microsoft Works Update Detection] C:Program FilesFichiers communsMicrosoft SharedWorks SharedWkUFind.exe

O4 - HKLM..Run: [NeroFilterCheck] C:WINNTsystem32NeroCheck.exe

O4 - HKCU..Run: [SpyEmergency] "C:Program FilesSpy Emergency 2005SpyEmergency.exe"

O4 - HKCU..Run: [eMuleAutoStart] C:Program FileseMuleemule.exe -AutoStart

O4 - Startup: Webshots.lnk = C:Program FilesWebshotsWebshotsTray.exe

O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:Program FilesInterVideoCommonBinWinCinemaMgr.exe

O4 - Global Startup: Pinnacle Scheduler.lnk = ?

O4 - Global Startup: Reality Fusion GameCam SE.lnk = ?

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~3OFFICE11EXCEL.EXE/3000

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~3OFFICE11REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:WINNTSystem32Shdocvw.dll

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kav...can_unicode.cab

O23 - Service: Ati HotKey Poller - Unknown owner - C:WINNTSystem32Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:WINNTsystem32ati2sgag.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVGFRE~1avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVGFRE~1avgupsvc.exe

O23 - Service: MicroSoft Media Tools - Unknown owner - C:WINNTMSmedia.exe

O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:Program FilesKerioPersonal Firewallpersfw.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:Program FilesAnalog DevicesSoundMAXSMAgent.exe