Trojan Win32:TratBHO[Trj]

salut crousps,

procede comme ceci :

Télécharge HijackThis ici :

-> http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis

Tutoriel d´utilisation (video) :

-> http://pageperso.aol.fr/balltrap34/demohijack.htm

Post le rapport généré ici stp...

et

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

post les deux rapports ici stp

@+

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:04:04, on 18/01/2008
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\csrss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\System32\svchost.exe
D:\Program Files\aswUpdSv.exe
D:\Program Files\ashServ.exe
I:\WINDOWS\Explorer.EXE
I:\WINDOWS\system32\spoolsv.exe
I:\WINDOWS\System32\alg.exe
I:\WINDOWS\System32\FTRTSVC.exe
D:\Program Files\ashWebSv.exe
D:\Program Files\ashMaiSv.exe
C:\Program Files\qttask.exe
D:\PROGRA~1\ashDisp.exe
I:\WINDOWS\Mixer.exe
I:\WINDOWS\System32\ctfmon.exe
I:\PROGRA~1\Wanadoo\TaskBarIcon.exe
E:\Program Files\PeerGuardian2\pg2.exe
I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
I:\Program Files\MSN Messenger\MsnMsgr.Exe
I:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
I:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
I:\PROGRA~1\Wanadoo\ComComp.exe
I:\PROGRA~1\Wanadoo\Toaster.exe
I:\PROGRA~1\Wanadoo\Inactivity.exe
I:\PROGRA~1\Wanadoo\PollingModule.exe
I:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
D:\Program Files\ashSimpl.exe
I:\Program Files\Internet Explorer\iexplore.exe
I:\Program Files\Internet Explorer\iexplore.exe
D:\PeerGuardian pr14\PeerGuardian_1.99b_pr14.exe
I:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis.exe
I:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail?service=communiquer&u=http://webmail.wanadoo.fr/wanadoo/inbox.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - I:\PROGRA~1\Wanadoo\SEARCH~1.DLL
F3 - REG:win.ini: run=
F2 - REG:system.ini: UserInit=I:\WINDOWS\system32\userinit.exe,I:\WINDOWS\System32\ntos.exe,
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - i:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - I:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {CBFA0E8E-7489-4A16-8D6E-0D58BFFB6134} - I:\WINDOWS\System32\gebyxwv.dll
O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684BB} - I:\Program Files\Helper\superfindout.dll
O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684CC} - I:\Program Files\Helper\superfindout.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - I:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - i:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ashDisp.exe
O4 - HKLM\..\Run: [WOOWATCH] I:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] I:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NeroFilterCheck] I:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [PeerGuardian] E:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [WOOKIT] I:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [swg] I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AdobeUpdater] I:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [userinit] I:\WINDOWS\System32\ntos.exe
O4 - HKCU\..\Policies\Explorer\Run: [System Patcher] BTCPatcher.exe
O4 - HKCU\..\Policies\Explorer\Run: [NTSpool] NTSpool.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: LUMIX Simple Viewer.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = I:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - I:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - I:\WINDOWS\web\related.htm
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - I:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

ComboFix 08-01-18.4 - jean-michel 2008-01-18 16:33:59.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.0.1252.1.1036.18.49 [GMT 1:00]
Running from: I:\Documents and Settings\jean-michel\Bureau\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

I:\Program Files\Helper
I:\Program Files\Helper\superfinderusa.dll
I:\Program Files\Helper\superfindout.dll
I:\Program Files\Internet Explorer\setupapi.dll
I:\WINDOWS\system32\gebyxwv.dll
I:\WINDOWS\system32\khfddcy.dll
I:\WINDOWS\system32\ntos.exe
I:\WINDOWS\system32\urqppnn.dll
I:\WINDOWS\system32\wsnpoem\audio.dll
I:\WINDOWS\system32\wsnpoem\video.dll
I:\WINDOWS\system32\wsnpoem

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-18 to 2008-01-18 ))))))))))))))))))))))))))))))))))))
.

2008-01-18 16:32 . 2000-08-31 08:00 51,200 --a------ I:\WINDOWS\NirCmd.exe
2008-01-18 12:25 . 2008-01-18 14:46 <REP> d-------- I:\VundoFix Backups
2008-01-13 19:34 . 2008-01-13 19:34 268 --ah----- I:\sqmdata01.sqm
2008-01-13 19:34 . 2008-01-13 19:34 244 --ah----- I:\sqmnoopt01.sqm
2008-01-12 19:54 . 2008-01-12 19:54 244 --ah----- I:\sqmnoopt00.sqm
2008-01-12 19:54 . 2008-01-12 19:54 232 --ah----- I:\sqmdata00.sqm
2008-01-11 20:42 . 2008-01-11 20:42 54,764 --a------ I:\WINDOWS\system32\dxdss.sys
2008-01-11 20:42 . 2008-01-11 20:42 8 --a------ I:\WINDOWS\system32\-1136357504
2008-01-10 12:39 . 2008-01-10 12:39 <REP> d-------- I:\WINDOWS\system32\Kaspersky Lab
2008-01-06 15:48 . 2008-01-18 16:43 <REP> d-a------ I:\Documents and Settings\All Users\Application Data\TEMP
2008-01-06 15:48 . 2004-08-30 21:00 1,499,136 --a------ I:\WINDOWS\system32\BTCPatcher.exe
2008-01-06 15:48 . 2008-01-06 18:17 39,936 --a------ I:\WINDOWS\system32\NTSpool.exe
2008-01-06 15:48 . 2008-01-06 15:48 37,888 --a------ I:\WINDOWS\system32\rar.exe
2008-01-01 21:27 . 2008-01-01 21:27 0 --ah----- I:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-01-01 21:27 . 2008-01-01 21:27 0 --ah----- I:\WINDOWS\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
2008-01-01 21:26 . 2006-10-08 21:51 23,856 --a------ I:\WINDOWS\system32\spupdsvc.exe
2008-01-01 21:13 . 2006-11-13 14:45 1,419,232 --a------ I:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-01-01 21:13 . 2007-02-27 14:31 21,504 --a------ I:\WINDOWS\system32\drivers\motmodem.sys
2008-01-01 21:12 . 2008-01-01 21:12 <REP> d-------- I:\Program Files\Fichiers communs\Motorola Shared
2008-01-01 21:01 . 2008-01-01 21:15 <REP> d-------- I:\Program Files\Motorola Phone Tools
2008-01-01 21:01 . 2008-01-17 22:56 <REP> d-------- I:\Documents and Settings\All Users\Application Data\BVRP Software
2007-12-31 14:34 . 2007-12-31 14:34 54,156 --ah----- I:\WINDOWS\QTFont.qfn
2007-12-31 14:34 . 2007-12-31 14:34 1,409 --a------ I:\WINDOWS\QTFont.for
2007-12-31 13:21 . 2007-12-31 13:21 <REP> d-------- I:\Documents and Settings\jean-michel\Application Data\Arcsoft
2007-12-31 12:50 . 2007-12-31 12:50 <REP> d-------- I:\Documents and Settings\jean-michel\Application Data\Panasonic
2007-12-31 12:04 . 2007-12-31 12:04 <REP> d-------- I:\WINDOWS\Cache
2007-12-31 12:03 . 2007-12-31 12:03 <REP> d-------- I:\Program Files\Fichiers communs\ArcSoft
2007-12-31 12:03 . 2005-02-23 14:58 11,776 --a------ I:\WINDOWS\system32\drivers\afc.sys
2007-12-31 12:01 . 2007-12-31 12:01 <REP> d-------- I:\Program Files\ArcSoft
2007-12-31 12:01 . 2004-05-04 11:53 1,645,320 --a------ I:\WINDOWS\system32\gdiplus.dll
2007-12-31 12:01 . 1995-08-01 04:44 212,480 --a------ I:\WINDOWS\PCDLIB32.DLL
2007-12-31 12:01 . 2005-01-24 17:16 143,360 --a------ I:\WINDOWS\system32\PhotoBase Screen Saver.scr
2007-12-31 12:01 . 2003-09-20 08:45 21,248 --a------ I:\WINDOWS\system32\drivers\pfc.sys
2007-12-31 11:58 . 2007-12-31 11:58 <REP> d-------- I:\Program Files\Panasonic
2007-12-24 22:54 . 2007-12-24 22:57 <REP> d-------- I:\Documents and Settings\jean-michel\Contacts
2007-12-24 22:50 . 2008-01-01 21:13 <REP> d----c--- I:\WINDOWS\system32\DRVSTORE
2007-12-24 21:57 . 2007-12-24 22:52 <REP> d-------- I:\Program Files\MSN Messenger
2007-12-19 14:48 . 2001-08-23 17:04 12,288 --a------ I:\WINDOWS\system32\drivers\mouhid.sys
2007-12-19 14:48 . 2001-08-23 17:04 12,288 --a--c--- I:\WINDOWS\system32\dllcache\mouhid.sys
2007-12-19 14:48 . 2001-08-17 22:02 9,600 --a------ I:\WINDOWS\system32\drivers\hidusb.sys
2007-12-19 14:48 . 2001-08-17 22:02 9,600 --a--c--- I:\WINDOWS\system32\dllcache\hidusb.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-18 15:43 --------- d-----w I:\Program Files\Wanadoo
2008-01-17 21:56 --------- d--h--w I:\Program Files\InstallShield Installation Information
2008-01-05 23:14 --------- d-----w I:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-01 20:01 92,064 ----a-w I:\Documents and Settings\jean-michel\mqdmmdm.sys
2008-01-01 20:01 9,232 ----a-w I:\Documents and Settings\jean-michel\mqdmmdfl.sys
2008-01-01 20:01 79,328 ----a-w I:\Documents and Settings\jean-michel\mqdmserd.sys
2008-01-01 20:01 66,656 ----a-w I:\Documents and Settings\jean-michel\mqdmbus.sys
2008-01-01 20:01 6,208 ----a-w I:\Documents and Settings\jean-michel\mqdmcmnt.sys
2008-01-01 20:01 5,936 ----a-w I:\Documents and Settings\jean-michel\mqdmwhnt.sys
2008-01-01 20:01 4,048 ----a-w I:\Documents and Settings\jean-michel\mqdmcr.sys
2008-01-01 20:01 25,600 ----a-w I:\Documents and Settings\jean-michel\usbsermptxp.sys
2008-01-01 20:01 22,768 ----a-w I:\Documents and Settings\jean-michel\usbsermpt.sys
2007-12-22 10:48 --------- d-----w I:\Program Files\Google
2007-12-06 20:48 --------- d-----w I:\Program Files\Fichiers communs\Adobe
2007-12-06 17:07 --------- d-----w I:\Documents and Settings\jean-michel\Application Data\AdobeUM
2007-12-06 16:42 --------- d-----w I:\Documents and Settings\jean-michel\Application Data\Microsoft Web Folders
2007-12-06 16:40 --------- d-----w I:\Program Files\microsoft frontpage
2007-12-04 14:56 93,264 ----a-w I:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w I:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w I:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w I:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w I:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w I:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w I:\WINDOWS\system32\AVASTSS.scr
2007-11-29 16:17 --------- d-----w I:\Program Files\Fichiers communs\Ahead
2007-11-24 14:56 --------- d-----w I:\Program Files\Fichiers communs\InstallShield
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="I:\WINDOWS\System32\ctfmon.exe" [2001-08-28 13:00 13312]
"PeerGuardian"="E:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824]
"WOOKIT"="I:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]
"swg"="I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-22 11:48 68856]
"AdobeUpdater"="I:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 10:37 2321600]
"MsnMsgr"="I:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\qttask.exe" [2007-04-27 09:41 282624]
"avast!"="D:\PROGRA~1\ashDisp.exe" [2007-12-04 14:00 79224]
"WOOWATCH"="I:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="I:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"C-Media Mixer"="Mixer.exe" [2002-03-25 15:02 1228800 I:\WINDOWS\mixer.exe]
"NeroFilterCheck"="I:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"Adobe Reader Speed Launcher"="I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="I:\WINDOWS\System32\CTFMON.EXE" [2001-08-28 13:00 13312]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"System Patcher"= BTCPatcher.exe
"NTSpool"= NTSpool.exe

R3 WlanUIG;Sagem 802.11g Wireless LAN USB Adapter Driver;I:\WINDOWS\System32\DRIVERS\WlanUIG.sys [2005-06-17 10:27]
S3 motmodem;Motorola USB CDC ACM Driver;I:\WINDOWS\System32\DRIVERS\motmodem.sys [2007-02-27 14:31]
S3 SE2Ebus;Sony Ericsson Device 046 Driver driver (WDM);I:\WINDOWS\System32\DRIVERS\SE2Ebus.sys [2006-11-10 18:23]
S3 SE2Emdfl;Sony Ericsson Device 046 USB WMC Modem Filter;I:\WINDOWS\System32\DRIVERS\SE2Emdfl.sys [2006-11-10 18:23]
S3 SE2Emdm;Sony Ericsson Device 046 USB WMC Modem Driver;I:\WINDOWS\System32\DRIVERS\SE2Emdm.sys [2006-11-10 18:23]
S3 sea1bus;Sony Ericsson Device 0A1 driver (WDM);I:\WINDOWS\System32\DRIVERS\sea1bus.sys [2007-01-04 12:01]

*Newly Created Service* - PGFILTER
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-01-14 21:45:16 I:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- I:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-18 16:43:32
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-18 16:44:49 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-18 15:44:38

voila c'est fait.et maintenant que dois je faire?

merci encore g!rly . a priori mon probleme avec ce mechant cheval de troie est resolu et je ne peux qu'inviter vos lecteurs a se referer a sa soluce.
sympa.

re,

peux tu poster un nouveau hijack this stp

@+

pas de probleme,le voici.Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:12:44, on 18/01/2008
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
D:\Program Files\aswUpdSv.exe
D:\Program Files\ashServ.exe
I:\WINDOWS\system32\spoolsv.exe
I:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\qttask.exe
D:\PROGRA~1\ashDisp.exe
I:\WINDOWS\Mixer.exe
I:\PROGRA~1\Wanadoo\TaskBarIcon.exe
I:\WINDOWS\System32\ctfmon.exe
E:\Program Files\PeerGuardian2\pg2.exe
I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
I:\Program Files\MSN Messenger\MsnMsgr.Exe
I:\WINDOWS\System32\svchost.exe
I:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
I:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
I:\PROGRA~1\Wanadoo\ComComp.exe
I:\PROGRA~1\Wanadoo\Toaster.exe
I:\PROGRA~1\Wanadoo\Inactivity.exe
I:\PROGRA~1\Wanadoo\PollingModule.exe
I:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
D:\Program Files\ashWebSv.exe
I:\PROGRA~1\Wanadoo\Watch.exe
I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
D:\Program Files\ashMaiSv.exe
D:\Program Files\ashSimpl.exe
I:\Program Files\Internet Explorer\iexplore.exe
D:\PeerGuardian pr14\PeerGuardian_1.99b_pr14.exe
I:\Program Files\Internet Explorer\iexplore.exe
I:\WINDOWS\explorer.exe
E:\Program Files\eMule\emule.exe
C:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - I:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - i:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - I:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684CC} - I:\Program Files\Helper\superfindout.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - I:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - i:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ashDisp.exe
O4 - HKLM\..\Run: [WOOWATCH] I:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] I:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NeroFilterCheck] I:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKCU\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [PeerGuardian] E:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [WOOKIT] I:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [swg] I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Policies\Explorer\Run: [System Patcher] BTCPatcher.exe
O4 - HKCU\..\Policies\Explorer\Run: [NTSpool] NTSpool.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: LUMIX Simple Viewer.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = I:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - I:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - I:\WINDOWS\web\related.htm
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - I:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

re,

peux tu egalement refaire un combofix et le poster, car il me manque des infos pour la suite.

@+

pas de probleme .ComboFix 08-01-18.4 - jean-michel 2008-01-18 19:25:10.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.0.1252.1.1036.18.39 [GMT 1:00]
Running from: I:\Documents and Settings\jean-michel\Bureau\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

I:\Program Files\Helper
I:\Program Files\Helper\superfindout.dll

.
((((((((((((((((((((((((((((( Fichiers créés 2007-12-18 to 2008-01-18 ))))))))))))))))))))))))))))))))))))
.

2008-01-18 17:01 . 2008-01-18 17:01 <REP> d-------- I:\Documents and Settings\jean-michel\Application Data\Simply Super Software
2008-01-18 17:01 . 2003-02-02 19:06 153,088 --a------ I:\WINDOWS\system32\UNRAR3.dll
2008-01-18 17:01 . 2002-03-06 00:00 75,264 --a------ I:\WINDOWS\system32\unacev2.dll
2008-01-18 16:32 . 2000-08-31 08:00 51,200 --a------ I:\WINDOWS\NirCmd.exe
2008-01-18 12:25 . 2008-01-18 14:46 <REP> d-------- I:\VundoFix Backups
2008-01-13 19:34 . 2008-01-13 19:34 268 --ah----- I:\sqmdata01.sqm
2008-01-13 19:34 . 2008-01-13 19:34 244 --ah----- I:\sqmnoopt01.sqm
2008-01-12 19:54 . 2008-01-12 19:54 244 --ah----- I:\sqmnoopt00.sqm
2008-01-12 19:54 . 2008-01-12 19:54 232 --ah----- I:\sqmdata00.sqm
2008-01-11 20:42 . 2008-01-11 20:42 54,764 --a------ I:\WINDOWS\system32\dxdss.sys
2008-01-11 20:42 . 2008-01-11 20:42 8 --a------ I:\WINDOWS\system32\-1136357504
2008-01-10 12:39 . 2008-01-10 12:39 <REP> d-------- I:\WINDOWS\system32\Kaspersky Lab
2008-01-06 15:48 . 2008-01-18 17:52 <REP> d-a------ I:\Documents and Settings\All Users\Application Data\TEMP
2008-01-06 15:48 . 2004-08-30 21:00 1,499,136 --a------ I:\WINDOWS\system32\BTCPatcher.exe
2008-01-06 15:48 . 2008-01-06 18:17 39,936 --a------ I:\WINDOWS\system32\NTSpool.exe
2008-01-06 15:48 . 2008-01-06 15:48 37,888 --a------ I:\WINDOWS\system32\rar.exe
2008-01-01 21:27 . 2008-01-01 21:27 0 --ah----- I:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-01-01 21:27 . 2008-01-01 21:27 0 --ah----- I:\WINDOWS\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
2008-01-01 21:26 . 2006-10-08 21:51 23,856 --a------ I:\WINDOWS\system32\spupdsvc.exe
2008-01-01 21:13 . 2006-11-13 14:45 1,419,232 --a------ I:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-01-01 21:13 . 2007-02-27 14:31 21,504 --a------ I:\WINDOWS\system32\drivers\motmodem.sys
2008-01-01 21:12 . 2008-01-01 21:12 <REP> d-------- I:\Program Files\Fichiers communs\Motorola Shared
2008-01-01 21:01 . 2008-01-01 21:15 <REP> d-------- I:\Program Files\Motorola Phone Tools
2008-01-01 21:01 . 2008-01-17 22:56 <REP> d-------- I:\Documents and Settings\All Users\Application Data\BVRP Software
2007-12-31 14:34 . 2007-12-31 14:34 54,156 --ah----- I:\WINDOWS\QTFont.qfn
2007-12-31 14:34 . 2007-12-31 14:34 1,409 --a------ I:\WINDOWS\QTFont.for
2007-12-31 13:21 . 2007-12-31 13:21 <REP> d-------- I:\Documents and Settings\jean-michel\Application Data\Arcsoft
2007-12-31 12:50 . 2007-12-31 12:50 <REP> d-------- I:\Documents and Settings\jean-michel\Application Data\Panasonic
2007-12-31 12:04 . 2007-12-31 12:04 <REP> d-------- I:\WINDOWS\Cache
2007-12-31 12:03 . 2007-12-31 12:03 <REP> d-------- I:\Program Files\Fichiers communs\ArcSoft
2007-12-31 12:03 . 2005-02-23 14:58 11,776 --a------ I:\WINDOWS\system32\drivers\afc.sys
2007-12-31 12:01 . 2007-12-31 12:01 <REP> d-------- I:\Program Files\ArcSoft
2007-12-31 12:01 . 2004-05-04 11:53 1,645,320 --a------ I:\WINDOWS\system32\gdiplus.dll
2007-12-31 12:01 . 1995-08-01 04:44 212,480 --a------ I:\WINDOWS\PCDLIB32.DLL
2007-12-31 12:01 . 2005-01-24 17:16 143,360 --a------ I:\WINDOWS\system32\PhotoBase Screen Saver.scr
2007-12-31 12:01 . 2003-09-20 08:45 21,248 --a------ I:\WINDOWS\system32\drivers\pfc.sys
2007-12-31 11:58 . 2007-12-31 11:58 <REP> d-------- I:\Program Files\Panasonic
2007-12-24 22:54 . 2007-12-24 22:57 <REP> d-------- I:\Documents and Settings\jean-michel\Contacts
2007-12-24 22:50 . 2008-01-01 21:13 <REP> d----c--- I:\WINDOWS\system32\DRVSTORE
2007-12-24 21:57 . 2007-12-24 22:52 <REP> d-------- I:\Program Files\MSN Messenger
2007-12-19 14:48 . 2001-08-23 17:04 12,288 --a------ I:\WINDOWS\system32\drivers\mouhid.sys
2007-12-19 14:48 . 2001-08-23 17:04 12,288 --a--c--- I:\WINDOWS\system32\dllcache\mouhid.sys
2007-12-19 14:48 . 2001-08-17 22:02 9,600 --a------ I:\WINDOWS\system32\drivers\hidusb.sys
2007-12-19 14:48 . 2001-08-17 22:02 9,600 --a--c--- I:\WINDOWS\system32\dllcache\hidusb.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-18 18:08 --------- d-----w I:\Program Files\Wanadoo
2008-01-17 21:56 --------- d--h--w I:\Program Files\InstallShield Installation Information
2008-01-05 23:14 --------- d-----w I:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-01 20:01 92,064 ----a-w I:\Documents and Settings\jean-michel\mqdmmdm.sys
2008-01-01 20:01 9,232 ----a-w I:\Documents and Settings\jean-michel\mqdmmdfl.sys
2008-01-01 20:01 79,328 ----a-w I:\Documents and Settings\jean-michel\mqdmserd.sys
2008-01-01 20:01 66,656 ----a-w I:\Documents and Settings\jean-michel\mqdmbus.sys
2008-01-01 20:01 6,208 ----a-w I:\Documents and Settings\jean-michel\mqdmcmnt.sys
2008-01-01 20:01 5,936 ----a-w I:\Documents and Settings\jean-michel\mqdmwhnt.sys
2008-01-01 20:01 4,048 ----a-w I:\Documents and Settings\jean-michel\mqdmcr.sys
2008-01-01 20:01 25,600 ----a-w I:\Documents and Settings\jean-michel\usbsermptxp.sys
2008-01-01 20:01 22,768 ----a-w I:\Documents and Settings\jean-michel\usbsermpt.sys
2007-12-22 10:48 --------- d-----w I:\Program Files\Google
2007-12-06 20:48 --------- d-----w I:\Program Files\Fichiers communs\Adobe
2007-12-06 17:07 --------- d-----w I:\Documents and Settings\jean-michel\Application Data\AdobeUM
2007-12-06 16:42 --------- d-----w I:\Documents and Settings\jean-michel\Application Data\Microsoft Web Folders
2007-12-06 16:40 --------- d-----w I:\Program Files\microsoft frontpage
2007-12-04 14:56 93,264 ----a-w I:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w I:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w I:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w I:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w I:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w I:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w I:\WINDOWS\system32\AVASTSS.scr
2007-11-29 16:17 --------- d-----w I:\Program Files\Fichiers communs\Ahead
2007-11-24 14:56 --------- d-----w I:\Program Files\Fichiers communs\InstallShield
.

((((((((((((((((((((((((((((( snapshot@2008-01-18_16.44.19.26 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-18 13:49:00 16,384 ----a-w I:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-01-18 15:42:45 16,384 ----a-w I:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-01-18 13:49:00 32,768 ----a-w I:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
+ 2008-01-18 15:42:45 32,768 ----a-w I:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
- 2008-01-18 13:49:00 32,768 ----a-w I:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-01-18 15:42:45 32,768 ----a-w I:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-01-18 16:52:04 16,384 ----atw I:\WINDOWS\Temp\Perflib_Perfdata_5e0.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="I:\WINDOWS\System32\ctfmon.exe" [2001-08-28 13:00 13312]
"PeerGuardian"="E:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824]
"WOOKIT"="I:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]
"swg"="I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-22 11:48 68856]
"MsnMsgr"="I:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\qttask.exe" [2007-04-27 09:41 282624]
"avast!"="D:\PROGRA~1\ashDisp.exe" [2007-12-04 14:00 79224]
"WOOWATCH"="I:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="I:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"C-Media Mixer"="Mixer.exe" [2002-03-25 15:02 1228800 I:\WINDOWS\mixer.exe]
"NeroFilterCheck"="I:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"Adobe Reader Speed Launcher"="I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048]
"TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2008-01-18 17:01 737872]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="I:\WINDOWS\System32\CTFMON.EXE" [2001-08-28 13:00 13312]

I:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
LUMIX Simple Viewer.lnk - I:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [2007-12-31 11:58:56]
Microsoft Office.lnk - I:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56]
Utilitaire r‚seau pour SAGEM Wi-Fi 11g USB adapter.lnk - I:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe [2007-11-15 16:53:17]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"System Patcher"= BTCPatcher.exe
"NTSpool"= NTSpool.exe

R3 WlanUIG;Sagem 802.11g Wireless LAN USB Adapter Driver;I:\WINDOWS\System32\DRIVERS\WlanUIG.sys [2005-06-17 10:27]
S3 motmodem;Motorola USB CDC ACM Driver;I:\WINDOWS\System32\DRIVERS\motmodem.sys [2007-02-27 14:31]
S3 SE2Ebus;Sony Ericsson Device 046 Driver driver (WDM);I:\WINDOWS\System32\DRIVERS\SE2Ebus.sys [2006-11-10 18:23]
S3 SE2Emdfl;Sony Ericsson Device 046 USB WMC Modem Filter;I:\WINDOWS\System32\DRIVERS\SE2Emdfl.sys [2006-11-10 18:23]
S3 SE2Emdm;Sony Ericsson Device 046 USB WMC Modem Driver;I:\WINDOWS\System32\DRIVERS\SE2Emdm.sys [2006-11-10 18:23]
S3 sea1bus;Sony Ericsson Device 0A1 driver (WDM);I:\WINDOWS\System32\DRIVERS\sea1bus.sys [2007-01-04 12:01]

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-01-14 21:45:16 I:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- I:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-18 19:30:43
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2008-01-18 19:32:43
ComboFix-quarantined-files.txt 2008-01-18 18:31:47
ComboFix2.txt 2008-01-18 15:44:50

ok

instales un de ces deux par feu :

par feu : kerio

http://www.malekal.com/kerio_firewall.php#mozTocId721480

https://www.vulgarisation-informatique.com/kerio.php

ou zone alarm plus facil a configurer mais moins performant

http://www.kachouri.com/tuto/tuto-143-zonealarm-installation-du-firewall--pare-feu.html

a l´aide de hijack this coche et fix ceci :

O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684CC} - I:\Program Files\Helper\superfindout.dll
O4 - HKCU\..\Policies\Explorer\Run: [System Patcher] BTCPatcher.exe
O4 - HKCU\..\Policies\Explorer\Run: [NTSpool] NTSpool.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - I:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - I:\WINDOWS\web\related.htm
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - I:\WINDOWS\System32\FTRTSVC.exe

comment fixer :

Tutoriel d´utilisation (video) :

-> http://pageperso.aol.fr/balltrap34/demohijack.htm

puis

click sur demarrer > executer > dans la boite de dialogue > tape : services.msc et valide par ok
dans la fenetre des services arrete ce service

France Telecom Routing Table Service (FTRTSVC)

en clickant droit dessus et en choisissant "arreter"

puis

Copie le texte ci-dessous :

File::
I:\WINDOWS\system32\NTSpool.exe
I:\WINDOWS\system32\BTCPatcher.exe
I:\Program Files\Helper\superfindout.dll

Folder::
I:\VundoFix Backups
I:\Program Files\Helper

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F10587E9-0E47-4CBE-84AE-7DD20B8684CC}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"NTSpool"=-
"System Patcher"=-

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

Cela va relancer Combofix,

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

S'il n'y a pas de rédémarrage, poste quand même les rapports.

@+

d'accord,je vais faire ce que tu me dis,mais juste pour info,j'ai recu il y a 2-3 minutes une alerte par rapport a ce fichu cheval de troie(toujours dans windows system32).
en tout cas merci encore de ta gentillesse,de ta disponibilite et de ton talent.
bye (si tout va bien).

re,

oui fais ce que je t´ai demandé, on verras apres si tu as encore des alertes...

@+

j'ai fait ce que tu m'as dit sauf que le fichier etait absent (bon signe ?).
O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684CC} - I:\Program Files\Helper\superfindout.dll
ComboFix 08-01-18.4 - jean-michel 2008-01-18 20:49:57.3 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.0.1252.1.1036.18.60 [GMT 1:00]
Running from: I:\Documents and Settings\jean-michel\Bureau\ComboFix.exe
Command switches used :: I:\Documents and Settings\jean-michel\CFScript.txt
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]

FILE
I:\Program Files\Helper\superfindout.dll
I:\WINDOWS\system32\BTCPatcher.exe
I:\WINDOWS\system32\NTSpool.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

I:\VundoFix Backups
I:\VundoFix Backups\awvvs.dll.bad
I:\VundoFix Backups\ddcde.dll.bad
I:\VundoFix Backups\fccbyab.dll.bad
I:\VundoFix Backups\fcywv.dll.bad
I:\VundoFix Backups\gebyxwv.dll.bad
I:\VundoFix Backups\hgdab.dll.bad
I:\VundoFix Backups\hggecbc.dll.bad
I:\VundoFix Backups\iiffc.dll.bad
I:\VundoFix Backups\khfff.dll.bad
I:\VundoFix Backups\ljjhh.dll.bad
I:\VundoFix Backups\ljjjihi.dll.bad
I:\VundoFix Backups\mljgdbc.dll.bad
I:\VundoFix Backups\nnnml.dll.bad
I:\VundoFix Backups\opnml.dll.bad
I:\VundoFix Backups\oppqo.dll.bad
I:\VundoFix Backups\pmnkifc.dll.bad
I:\VundoFix Backups\qomkk.dll.bad
I:\VundoFix Backups\qomnk.dll.bad
I:\VundoFix Backups\ssttt.dll.bad
I:\VundoFix Backups\wvwxv.dll.bad
I:\VundoFix Backups\xxyvv.dll.bad
I:\VundoFix Backups\yabxx.dll.bad
I:\VundoFix Backups\yayvwww.dll.bad
I:\WINDOWS\system32\BTCPatcher.exe
I:\WINDOWS\system32\nnnkhff.dll
I:\WINDOWS\system32\NTSpool.exe

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-18 to 2008-01-18 ))))))))))))))))))))))))))))))))))))
.

2008-01-18 20:27 . 2008-01-18 20:27 <REP> d-------- I:\Program Files\Trend Micro
2008-01-18 17:01 . 2008-01-18 17:01 <REP> d-------- I:\Documents and Settings\jean-michel\Application Data\Simply Super Software
2008-01-18 17:01 . 2003-02-02 19:06 153,088 --a------ I:\WINDOWS\system32\UNRAR3.dll
2008-01-18 17:01 . 2002-03-06 00:00 75,264 --a------ I:\WINDOWS\system32\unacev2.dll
2008-01-18 16:32 . 2000-08-31 08:00 51,200 --a------ I:\WINDOWS\NirCmd.exe
2008-01-13 19:34 . 2008-01-13 19:34 268 --ah----- I:\sqmdata01.sqm
2008-01-13 19:34 . 2008-01-13 19:34 244 --ah----- I:\sqmnoopt01.sqm
2008-01-12 19:54 . 2008-01-12 19:54 244 --ah----- I:\sqmnoopt00.sqm
2008-01-12 19:54 . 2008-01-12 19:54 232 --ah----- I:\sqmdata00.sqm
2008-01-11 20:42 . 2008-01-11 20:42 54,764 --a------ I:\WINDOWS\system32\dxdss.sys
2008-01-11 20:42 . 2008-01-11 20:42 8 --a------ I:\WINDOWS\system32\-1136357504
2008-01-10 12:39 . 2008-01-10 12:39 <REP> d-------- I:\WINDOWS\system32\Kaspersky Lab
2008-01-06 15:48 . 2008-01-18 17:52 <REP> d-a------ I:\Documents and Settings\All Users\Application Data\TEMP
2008-01-06 15:48 . 2008-01-06 15:48 37,888 --a------ I:\WINDOWS\system32\rar.exe
2008-01-01 21:27 . 2008-01-01 21:27 0 --ah----- I:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-01-01 21:27 . 2008-01-01 21:27 0 --ah----- I:\WINDOWS\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
2008-01-01 21:26 . 2006-10-08 21:51 23,856 --a------ I:\WINDOWS\system32\spupdsvc.exe
2008-01-01 21:13 . 2006-11-13 14:45 1,419,232 --a------ I:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-01-01 21:13 . 2007-02-27 14:31 21,504 --a------ I:\WINDOWS\system32\drivers\motmodem.sys
2008-01-01 21:12 . 2008-01-01 21:12 <REP> d-------- I:\Program Files\Fichiers communs\Motorola Shared
2008-01-01 21:01 . 2008-01-01 21:15 <REP> d-------- I:\Program Files\Motorola Phone Tools
2008-01-01 21:01 . 2008-01-17 22:56 <REP> d-------- I:\Documents and Settings\All Users\Application Data\BVRP Software
2007-12-31 14:34 . 2007-12-31 14:34 54,156 --ah----- I:\WINDOWS\QTFont.qfn
2007-12-31 14:34 . 2007-12-31 14:34 1,409 --a------ I:\WINDOWS\QTFont.for
2007-12-31 13:21 . 2007-12-31 13:21 <REP> d-------- I:\Documents and Settings\jean-michel\Application Data\Arcsoft
2007-12-31 12:50 . 2007-12-31 12:50 <REP> d-------- I:\Documents and Settings\jean-michel\Application Data\Panasonic
2007-12-31 12:04 . 2007-12-31 12:04 <REP> d-------- I:\WINDOWS\Cache
2007-12-31 12:03 . 2007-12-31 12:03 <REP> d-------- I:\Program Files\Fichiers communs\ArcSoft
2007-12-31 12:03 . 2005-02-23 14:58 11,776 --a------ I:\WINDOWS\system32\drivers\afc.sys
2007-12-31 12:01 . 2007-12-31 12:01 <REP> d-------- I:\Program Files\ArcSoft
2007-12-31 12:01 . 2004-05-04 11:53 1,645,320 --a------ I:\WINDOWS\system32\gdiplus.dll
2007-12-31 12:01 . 1995-08-01 04:44 212,480 --a------ I:\WINDOWS\PCDLIB32.DLL
2007-12-31 12:01 . 2005-01-24 17:16 143,360 --a------ I:\WINDOWS\system32\PhotoBase Screen Saver.scr
2007-12-31 12:01 . 2003-09-20 08:45 21,248 --a------ I:\WINDOWS\system32\drivers\pfc.sys
2007-12-31 11:58 . 2007-12-31 11:58 <REP> d-------- I:\Program Files\Panasonic
2007-12-24 22:54 . 2007-12-24 22:57 <REP> d-------- I:\Documents and Settings\jean-michel\Contacts
2007-12-24 22:50 . 2008-01-01 21:13 <REP> d----c--- I:\WINDOWS\system32\DRVSTORE
2007-12-24 21:57 . 2007-12-24 22:52 <REP> d-------- I:\Program Files\MSN Messenger
2007-12-19 14:48 . 2001-08-23 17:04 12,288 --a------ I:\WINDOWS\system32\drivers\mouhid.sys
2007-12-19 14:48 . 2001-08-23 17:04 12,288 --a--c--- I:\WINDOWS\system32\dllcache\mouhid.sys
2007-12-19 14:48 . 2001-08-17 22:02 9,600 --a------ I:\WINDOWS\system32\drivers\hidusb.sys
2007-12-19 14:48 . 2001-08-17 22:02 9,600 --a--c--- I:\WINDOWS\system32\dllcache\hidusb.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-18 19:54 --------- d-----w I:\Program Files\Wanadoo
2008-01-17 21:56 --------- d--h--w I:\Program Files\InstallShield Installation Information
2008-01-05 23:14 --------- d-----w I:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-01 20:01 92,064 ----a-w I:\Documents and Settings\jean-michel\mqdmmdm.sys
2008-01-01 20:01 9,232 ----a-w I:\Documents and Settings\jean-michel\mqdmmdfl.sys
2008-01-01 20:01 79,328 ----a-w I:\Documents and Settings\jean-michel\mqdmserd.sys
2008-01-01 20:01 66,656 ----a-w I:\Documents and Settings\jean-michel\mqdmbus.sys
2008-01-01 20:01 6,208 ----a-w I:\Documents and Settings\jean-michel\mqdmcmnt.sys
2008-01-01 20:01 5,936 ----a-w I:\Documents and Settings\jean-michel\mqdmwhnt.sys
2008-01-01 20:01 4,048 ----a-w I:\Documents and Settings\jean-michel\mqdmcr.sys
2008-01-01 20:01 25,600 ----a-w I:\Documents and Settings\jean-michel\usbsermptxp.sys
2008-01-01 20:01 22,768 ----a-w I:\Documents and Settings\jean-michel\usbsermpt.sys
2007-12-22 10:48 --------- d-----w I:\Program Files\Google
2007-12-06 20:48 --------- d-----w I:\Program Files\Fichiers communs\Adobe
2007-12-06 17:07 --------- d-----w I:\Documents and Settings\jean-michel\Application Data\AdobeUM
2007-12-06 16:42 --------- d-----w I:\Documents and Settings\jean-michel\Application Data\Microsoft Web Folders
2007-12-06 16:40 --------- d-----w I:\Program Files\microsoft frontpage
2007-12-04 14:56 93,264 ----a-w I:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w I:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w I:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w I:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w I:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-29 16:17 --------- d-----w I:\Program Files\Fichiers communs\Ahead
2007-11-24 14:56 --------- d-----w I:\Program Files\Fichiers communs\InstallShield
.

((((((((((((((((((((((((((((( snapshot@2008-01-18_16.44.19.26 )))))))))))))))))))))))))))))))))))))))))
.
+ 2000-08-31 07:00:00 163,328 ----a-w I:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
+ 2008-01-18 19:49:41 237,568 ----a-w I:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-01-18 19:49:41 8,192 ----a-w I:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-01-18 19:49:41 237,568 ----a-w I:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT
+ 2008-01-18 19:49:41 8,192 ----a-w I:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat
+ 2008-01-18 19:49:41 2,310,144 ----a-w I:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\NTUSER.DAT
+ 2008-01-18 19:49:41 8,192 ----a-w I:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat
- 2008-01-18 13:49:00 16,384 ----a-w I:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-01-18 15:42:45 16,384 ----a-w I:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-01-18 13:49:00 32,768 ----a-w I:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
+ 2008-01-18 15:42:45 32,768 ----a-w I:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
- 2008-01-18 13:49:00 32,768 ----a-w I:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-01-18 15:42:45 32,768 ----a-w I:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-01-18 16:52:04 16,384 ----atw I:\WINDOWS\Temp\Perflib_Perfdata_5e0.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F10587E9-0E47-4CBE-84AE-7DD20B8684CC}]
2008-01-18 20:55 15872 --a------ I:\Program Files\Helper\superfindout.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="I:\WINDOWS\System32\ctfmon.exe" [2001-08-28 13:00 13312]
"PeerGuardian"="E:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824]
"WOOKIT"="I:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]
"swg"="I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-22 11:48 68856]
"MsnMsgr"="I:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\qttask.exe" [2007-04-27 09:41 282624]
"avast!"="D:\PROGRA~1\ashDisp.exe" [2007-12-04 14:00 79224]
"WOOWATCH"="I:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="I:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"C-Media Mixer"="Mixer.exe" [2002-03-25 15:02 1228800 I:\WINDOWS\mixer.exe]
"NeroFilterCheck"="I:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"Adobe Reader Speed Launcher"="I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048]
"TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2008-01-18 17:01 737872]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="I:\WINDOWS\System32\CTFMON.EXE" [2001-08-28 13:00 13312]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5E85C971-F9E7-4F4D-A059-14FA00220C7A}"= I:\WINDOWS\System32\nnnkhff.dll [ ]

R3 WlanUIG;Sagem 802.11g Wireless LAN USB Adapter Driver;I:\WINDOWS\System32\DRIVERS\WlanUIG.sys [2005-06-17 10:27]
S3 motmodem;Motorola USB CDC ACM Driver;I:\WINDOWS\System32\DRIVERS\motmodem.sys [2007-02-27 14:31]
S3 SE2Ebus;Sony Ericsson Device 046 Driver driver (WDM);I:\WINDOWS\System32\DRIVERS\SE2Ebus.sys [2006-11-10 18:23]
S3 SE2Emdfl;Sony Ericsson Device 046 USB WMC Modem Filter;I:\WINDOWS\System32\DRIVERS\SE2Emdfl.sys [2006-11-10 18:23]
S3 SE2Emdm;Sony Ericsson Device 046 USB WMC Modem Driver;I:\WINDOWS\System32\DRIVERS\SE2Emdm.sys [2006-11-10 18:23]
S3 sea1bus;Sony Ericsson Device 0A1 driver (WDM);I:\WINDOWS\System32\DRIVERS\sea1bus.sys [2007-01-04 12:01]

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-01-14 21:45:16 I:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- I:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-18 20:54:39
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-18 20:56:10 - machine was rebooted [jean-michel]
ComboFix-quarantined-files.txt 2008-01-18 19:55:59
ComboFix2.txt 2008-01-18 18:32:45
ComboFix3.txt 2008-01-18 15:44:50
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:08:01, on 18/01/2008
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
D:\Program Files\aswUpdSv.exe
D:\Program Files\ashServ.exe
I:\WINDOWS\Explorer.EXE
I:\WINDOWS\system32\spoolsv.exe
C:\Program Files\qttask.exe
D:\PROGRA~1\ashDisp.exe
I:\WINDOWS\Mixer.exe
I:\PROGRA~1\Wanadoo\TaskBarIcon.exe
I:\WINDOWS\System32\ctfmon.exe
E:\Program Files\PeerGuardian2\pg2.exe
I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
I:\Program Files\MSN Messenger\MsnMsgr.Exe
I:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe
I:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
I:\PROGRA~1\Wanadoo\Toaster.exe
I:\PROGRA~1\Wanadoo\Inactivity.exe
I:\PROGRA~1\Wanadoo\PollingModule.exe
I:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
D:\Program Files\ashWebSv.exe
I:\WINDOWS\system32\notepad.exe
D:\Program Files\ashMaiSv.exe
I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
D:\Program Files\ashSimpl.exe
I:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
I:\PROGRA~1\Wanadoo\ComComp.exe
I:\PROGRA~1\Wanadoo\Watch.exe
I:\Program Files\Internet Explorer\iexplore.exe
D:\PeerGuardian pr14\PeerGuardian_1.99b_pr14.exe
I:\Program Files\Internet Explorer\iexplore.exe
I:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - I:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - i:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - I:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - I:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - i:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ashDisp.exe
O4 - HKLM\..\Run: [WOOWATCH] I:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] I:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NeroFilterCheck] I:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKCU\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [PeerGuardian] E:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [WOOKIT] I:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [swg] I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: LUMIX Simple Viewer.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = I:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

par contre g!rly est ce qu'un pare feu est indispensable car d'abord je n'arrive pas a ouvrir kerio(il me met un message d'erreur) et j'ai deja utilise zone alarm,mais avec emule c'est pas le grand amour.alors comme protection,je me sert d'avast et de peer guardian et c'est vrai que jusqu'a present je n'avais jamais eu de soucis.

re,

oui c´est mieux ;-)

maintenant :

tu surf avec internet explorer 6.0 = failles de securitées importantes

alors fais les mises a jour windows : tu veux la version 7.0

et pourquoi ne pas surfer avec firefox? = plus sur, tout en gardant ie 7.0 pour les mises a jour windows car impossible a effectuer sous firefox

http://www.firefox.fr/

ta version de acrobat reader n´est pas a jour, tu veux la version 8.1 derniere en date alors desinstale ta version par le panneau de configuration / ajoue et suppression de programme

et instale la derniere :

https://get2.adobe.com/reader/otherversions/

ou foxit plus léger :

https://www.clubic.com/telecharger-fiche13808-foxit-reader.html

tu n´as pas de par feu :
instales un des deux ci dessosus

par feu : kerio

http://www.malekal.com/kerio_firewall.php#mozTocId721480

https://www.vulgarisation-informatique.com/kerio.php

ou zone alarm plus facil a configurer mais moins performant

http://www.kachouri.com/tuto/tuto-143-zonealarm-installation-du-firewall--pare-feu.html

puis :

regarde ceci concernant avast :

antivir vs avast :

-> http://forum.malekal.com/ftopic3528.php

alors je te conseille de le desinstaller et d´installer antivir a la place

Telecharge et instal l'antivirus Antivir Personal Edition Classic :

->https://www.malekal.com/avira-free-security-antivirus-gratuit/

https://www.avira.com/en/prime

http://mickael.barroux.free.fr/securite/antivir.php <- tutoriel configuration du scanner...

une fois antivir ouvert click sur configuration et coche la case "expert mode" puis click sur l´onglet scanner dans la fenetre du dessous tu va voir : rootkit search click sur le petit + pour deployer et coche la case a coté de ton disk dur
puis click sur configuration en haut a droite puis dans la nouvelle fenetre a gauche >scanner > scan all files et en dessous >scanner priority = High
toujours a gauche > scan > deploie > heuristique > macrovirus heuristic = coché et en dessous > win32 heuristic la case coché et high detection level

je te dis ca car j´aimerais que tu fasse un scan complet de ta machine et que tu post le rapport ici

donc post le rapport d´antivir dans ta preochaine réponse.

@+

bon c'est toi le ou la specialiste alors je vais suivre tes conseils et recommander tes soluces a ceux ou celles qui auraient le meme probleme.et je voudrais encore te dire merci pour tout et bonne continuation.(je noublie pas de poster le rapport d'antivir).bye.

ok

bonne soirée`

@+

bonjour g!rly
voici le rapport d'antivir que tu m'as demande.

AntiVir PersonalEdition Classic
Report file date: vendredi 18 janvier 2008 23:27

Scanning for 1056958 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (plain) [5.1.2600]
Username: jean-michel
Computer name: LOLO-NF9R3QWUIE

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 22:14:01
ANTIVIR2.VDF : 7.0.2.0 948736 Bytes 15/01/2008 22:14:01
ANTIVIR3.VDF : 7.0.2.20 225792 Bytes 18/01/2008 22:14:01
AVEWIN32.DLL : 7.6.0.48 3080704 Bytes 18/01/2008 22:14:01
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 18/01/2008 22:14:01
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Manual Selection
Configuration file...............: I:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\folder.avp
Logging..........................: low
Primary action...................: repair
Secondary action.................: delete
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: J:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: vendredi 18 janvier 2008 23:27

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'PeerGuardian_1.99b_pr14.exe' - '1' Module(s) have been scanned
Scan process 'pg2.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'ALERTM~1.EXE' - '1' Module(s) have been scanned
Scan process 'PollingModule.exe' - '1' Module(s) have been scanned
Scan process 'Inactivity.exe' - '1' Module(s) have been scanned
Scan process 'Toaster.exe' - '1' Module(s) have been scanned
Scan process 'ComComp.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'EspaceWanadoo.exe' - '1' Module(s) have been scanned
Scan process 'WLANUTL.exe' - '1' Module(s) have been scanned
Scan process 'PhLeAutoRun.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'mixer.exe' - '1' Module(s) have been scanned
Scan process 'qttask.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
34 processes with 34 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'D:\'
[NOTE] No virus was found!
Boot sector 'E:\'
[NOTE] No virus was found!
Boot sector 'F:\'
[NOTE] No virus was found!
Boot sector 'I:\'
[NOTE] No virus was found!
Boot sector 'J:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '36' files ).

Starting the file scan:

Begin scan in 'C:\'
C:\imvmi.exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] A backup was created as '48072838.qua' ( QUARANTINE )
[INFO] The file was deleted!
C:\ugmsfom.exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] A backup was created as '47fe2833.qua' ( QUARANTINE )
[INFO] The file was deleted!
C:\yamwm.exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] A backup was created as '47fe282d.qua' ( QUARANTINE )
[INFO] The file was deleted!
Begin scan in 'D:\' <DRV2_VOL1>
Begin scan in 'E:\'
E:\Program Files\eMule\Temp\011.part
[0] Archive type: ACE
--> Breakaway Angel\01-Puttin' Out Fires.mp3
[WARNING] Error creating the file
[WARNING] Error creating the file
E:\Program Files\eMule\Temp\018.part
[0] Archive type: ACE
--> nils lofgren\Nils Lofgren - Code of the Road - Code of the Road.mp3
[WARNING] Error creating the file
--> nils lofgren\Nils Lofgren - Code of the Road - Shine silently.mp3
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
Begin scan in 'F:\'
F:\Documents and Settings\jm\Local Settings\Temp\update_12.exe
[DETECTION] Contains detection pattern of the dropper DR/WinFetcher.C
[INFO] A backup was created as '47f5748c.qua' ( QUARANTINE )
[INFO] The file was deleted!
Begin scan in 'I:\' <DRV2_VOL2>
I:\pagefile.sys
[WARNING] The file could not be opened!
I:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\INFECTED\47fe282d.qua
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] A backup was created as '47f78156.qua' ( QUARANTINE )
[INFO] The file was deleted!
I:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\INFECTED\48072838.qua
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] A backup was created as '47c18158.qua' ( QUARANTINE )
[INFO] The file was deleted!
I:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CTO1AHG3\df34[1].htm
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47c481e0.qua'!
I:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\G7A7EBQL\df34[1].htm
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '46adc549.qua'!
I:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\GLIFMDUP\sdfsdf[1].htm
[DETECTION] Is the Trojan horse TR/Agent.131072.D.2
[INFO] A backup was created as '47f781de.qua' ( QUARANTINE )
[INFO] The file was deleted!
I:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Y5KXAH0Z\sdfsdf[1].htm
[DETECTION] Is the Trojan horse TR/Agent.131072.D.2
[INFO] A backup was created as '47f781df.qua' ( QUARANTINE )
[WARNING] The file could not be deleted!
I:\program1\Adobe Photoshop CS3 Crack.rar
[0] Archive type: CAB (Microsoft)
--> BTCPatcher.exe
[DETECTION] Is the Trojan horse TR/Drop.Age.1499136
[INFO] A backup was created as '48008444.qua' ( QUARANTINE )
[INFO] The file was deleted!
I:\program1\DVD Cloner II v2.35+ Dvd Fab Gold + Platinum.zip
[0] Archive type: ZIP
--> DVD Fab Platinum-Gold-Express 2.70 (With Key Generator).rar
[1] Archive type: RAR
--> Keygen.exe
[DETECTION] Is the Trojan horse TR/Agent.361747
[INFO] A backup was created as '47d58474.qua' ( QUARANTINE )
[INFO] The file was deleted!
I:\QooBox\Quarantine\catchme2008-01-18_164244.56.zip
[0] Archive type: ZIP
--> ntos.exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] A backup was created as '48058c69.qua' ( QUARANTINE )
[INFO] The file was deleted!
I:\QooBox\Quarantine\I\Program Files\Internet Explorer\setupapi.dll.vir
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] A backup was created as '48058c6e.qua' ( QUARANTINE )
[INFO] The file was deleted!
I:\QooBox\Quarantine\I\VundoFix Backups\fccbyab.dll.bad.vir
[DETECTION] Is the Trojan horse TR/Drop.Vundo.dvo
[INFO] A backup was created as '47f48c6d.qua' ( QUARANTINE )
[INFO] The file was deleted!
I:\QooBox\Quarantine\I\VundoFix Backups\hggecbc.dll.bad.vir
[DETECTION] Is the Trojan horse TR/Drop.Vundo.dvo
[INFO] A backup was created as '47f88c72.qua' ( QUARANTINE )
[INFO] The file was deleted!
I:\QooBox\Quarantine\I\VundoFix Backups\pmnkifc.dll.bad.vir
[DETECTION] Is the Trojan horse TR/Drop.Vundo.dvo
[INFO] A backup was created as '47ff8c7a.qua' ( QUARANTINE )
[INFO] The file was deleted!
I:\QooBox\Quarantine\I\VundoFix Backups\yayvwww.dll.bad.vir
[DETECTION] Is the Trojan horse TR/Vundo.dvo.5
[INFO] A backup was created as '480a8c6f.qua' ( QUARANTINE )
[INFO] The file was deleted!
I:\QooBox\Quarantine\I\WINDOWS\system32\BTCPatcher.exe.vir
[DETECTION] Is the Trojan horse TR/Drop.Age.1499136
[INFO] A backup was created as '47d48c63.qua' ( QUARANTINE )
[INFO] The file was deleted!
I:\QooBox\Quarantine\I\WINDOWS\system32\khfddcy.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.Small.hoo.1
[INFO] A backup was created as '47f78c77.qua' ( QUARANTINE )
[INFO] The file was deleted!
I:\QooBox\Quarantine\I\WINDOWS\system32\nnnkhff.dll.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[INFO] A backup was created as '47ff8c7d.qua' ( QUARANTINE )
[INFO] The file was deleted!
I:\QooBox\Quarantine\I\WINDOWS\system32\ntos.exe.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[INFO] A backup was created as '48008c84.qua' ( QUARANTINE )
[INFO] The file was deleted!
I:\QooBox\Quarantine\I\WINDOWS\system32\urqppnn.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.Small.hoo.1
[INFO] A backup was created as '48028c82.qua' ( QUARANTINE )
[INFO] The file was deleted!
I:\WINDOWS\system32\dxdss.sys
[WARNING] The file could not be opened!
I:\WINDOWS\Temp\76906FCF.exe
[WARNING] The file could not be opened!
I:\WINDOWS\Temp\CF7DAB1A.exe
[DETECTION] Is the Trojan horse TR/Agent.131072.D.2
[INFO] A backup was created as '47c88eed.qua' ( QUARANTINE )
[INFO] The file was deleted!
I:\zic\Le Petit Roi - Jean-Pierre Ferland(320KBPS).ace
[0] Archive type: ACE
--> Le Petit Roi - Jean-Pierre Ferland\05 - Le Chat Du Caf‚ Des Artistes.mp3
[WARNING] Error creating the file
--> Le Petit Roi - Jean-Pierre Ferland\06 - Les Immortelles.mp3
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
Begin scan in 'J:\' <DRV2_VOL3>
J:\tele\Les Rita Mitsouko - La femme trombone Lame - 192kbps.ace
[0] Archive type: ACE
--> Les Rita Mitsouko\La Femme Trombone\01-Les Rita Mitsouko-La Femme Trombone-entr‚e.mp3
[WARNING] Error creating the file
--> Les Rita Mitsouko\La Femme Trombone\02-Les Rita Mitsouko-La Femme Trombone-‚vasion.mp3
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed

End of the scan: samedi 19 janvier 2008 08:43
Used time: 9:15:58 min

The scan has been done completely.

11946 Scanning directories
735681 Files were scanned
22 viruses and/or unwanted programs were found
2 Files were classified as suspicious:
21 files were deleted
0 files were repaired
24 files were moved to quarantine
0 files were renamed
3 Files cannot be scanned
735659 Files not concerned
7548 Archives were scanned
16 Warnings
4 Notes

bonjour, fais ceci :

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

@+

ok mais avant de faire tout ca,est ce que je dois supprimer les virus detecter par antivir ou n'est ce pas necessaire?