Infection du virus Win32:Small-JMH [Trj]

julie -  
Bonjour à tous, j'ai un problème avec le virus Win32:Small-JMH [Trj] et je ne sais pas comment l'éliminer.

Si il y en a qui ont la solution; merci de me répondre parce que là je suis complètement bloquée..

Merci d'avance.
Configuration: Windows XP
Firefox 2.0.0.12

32 réponses

Résumé de la discussion

Une discussion porte sur une infection par le virus Win32:Small-JMH [Trj] et sur les difficultés à l'éliminer sous Windows XP, avec une configuration Firefox 2.0.0.12 et une demande d'aide claire. Des participants expriment leur impossibilité à résoudre le problème et rapportent être bloqués, tandis que les échanges intègrent des extraits de HijackThis et des listes de processus pour orienter le diagnostic. En parallèle, des extraits de rapport détaillant des éléments système et des éléments de registre apparaissent, suggérant une approche d'analyse plus approfondie mais sans solution immédiate fournie. Pour l'avenir, la discussion illustre l'intérêt d'outils spécialisés et de sources actualisées pour la détection et la suppression de ce type de menace, en complément d'une sauvegarde préalable.

Bobot (l’IA à votre service)
  1. scratt83
    salut , as tu un antivirus si oui lequel?
    0
    1. julie
      merci d'avoir répondu aussi vite, et oui, j'ai un antivirus; avast.
      0
      1. scratt83
        avast detecte t'il ton virus ? si oui tu as juste à faire : mettre en quarantaine!
        0
    2. MARJOLAINE 69
      Bonjour, j'ai le meme problème, j'ai misle virus en quarantaine, mais ca ne le supprime pas définitivement, comment dois je faire??

      Merci d avance
      0
      1. julie
        Oui, mais si je le mets en quarantaine, il revient à chaque démarrage et on me repose constamment la même question. Et quand je veux le supprimer, avast ne le fait pas
        0
        1. scratt83
          ah mice azlors tu devrai télécharger avg antispyware sur 01net.com tu linstalle tu lui fait une mise a jour et tu fait analyse complete et aprés dit moi si c bon
          0
      3. julie
        Alors, encore merci, j'ai télécharger ce que tu m'as demandé et j'ai fait l'analyse mais ils ne disent rien de spécial
        0
        1. scratt83
          j'ai vu sur le forum que tu peu suprimé le fichier infecté ta essayé de le suprimé via avast??
          0
      4. julie
        oui, j'ai essayé mais il ne le fait pas
        0
        1. scratt83
          j'ai as bien lu mais si tu as xp fait poste de travail tu clic droit sur le'icone de ton disque dur : propriété , nettoyage du disque et tu élimine tout tes fichiers temporaires essaye et dit moi
          0
        2. christine
          @scratt83j'ai le même problème avec se virus et j'ai beau supprimé via avast et rien làje fais marché spybot version 1.5.2.20 mis a jour j'attends
          0
      5. julie
        apparemment ça n'a rien changé du tout
        0
        1. scratt83
          si tu as window defender essaye avec ca!
          0
      6. july
        moi c pareil !!! je suis dessus depuis ce matin, rien a faire !! Je desespere
        0
        1. Hanna
          Pareil c'est pourri !!lool
          0
      7. green day Modérateur
        Salut Julie/à tous

        Télécharge ceci :

        Lien : https://www.commentcamarche.net/telecharger/ 159 hijackthis

        Démo : http://pageperso.aol.fr/balltrap34/demohijack.htm

        Choisir l'option "do a scan and a logfile", et faire un copier/coller du rapport ainsi générer sur le forum.

        ++

        0
        1. scorpioneser
          meme problème que les autre personne si on peux m'aider ...
          0
          1. green day Modérateur
            Merci aux personnes autre que Julie d'ouvrir leur propre poste, et on se fera un plaisir de répondre ;-)

            sinon on va se perdre ici !

            @+
            0
            1. scorpioneser
              Logfile of HijackThis v1.99.1
              Scan saved at 22:15:52, on 24/02/2008
              Platform: Windows XP SP2 (WinNT 5.01.2600)
              MSIE: Internet Explorer v7.00 (7.00.6000.16608)

              Running processes:
              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\Ati2evxx.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              C:\Program Files\Alwil Software\Avast4\ashServ.exe
              C:\WINDOWS\system32\spoolsv.exe
              c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
              C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
              C:\WINDOWS\system32\svchost.exe
              C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
              C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
              C:\WINDOWS\system32\Ati2evxx.exe
              C:\WINDOWS\Explorer.EXE
              C:\WINDOWS\SOUNDMAN.EXE
              C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
              C:\Program Files\Logitech\G-series Software\LGDCore.exe
              C:\Program Files\Logitech\G-series Software\LCDMon.exe
              C:\WINDOWS\system32\LVCOMSX.EXE
              C:\Program Files\Logitech\Video\CameraAssistant.exe
              C:\Program Files\Logitech\G-series Software\Applets\LCDCountdown\LCDCountdown.exe
              C:\WINDOWS\system32\ElkCtrl.exe
              C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
              C:\Program Files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
              C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
              C:\WINDOWS\system32\ctfmon.exe
              C:\Program Files\RocketDock\RocketDock.exe
              C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
              C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
              C:\Program Files\Logitech\SetPoint\SetPoint.exe
              C:\Program Files\NETGEAR\WG111v2\WG111v2.exe
              C:\WINDOWS\System32\svchost.exe
              C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
              C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
              C:\Program Files\Mozilla Firefox\firefox.exe
              C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
              R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
              R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/toolbar/ie8/sidebar.html
              R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
              F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winlogon.exe
              O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
              O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
              O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
              O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
              O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
              O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
              O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
              O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
              O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
              O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
              O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Logitech\Video\CameraAssistant.exe
              O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Logitech\Video\InstallHelper.exe /inspect
              O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
              O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
              O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
              O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
              O4 - HKLM\..\Run: [Flash Driver] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winlogon.exe
              O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
              O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
              O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
              O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
              O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
              O4 - HKCU\..\RunOnce: [__GSCAdditionalInstallation__] "J:\Cossacks2Setup.exe" -AdditionalInstall
              O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
              O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
              O4 - Global Startup: NETGEAR WG111v2 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG111v2\WG111v2.exe
              O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
              O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
              O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
              O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
              O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
              O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
              O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
              O11 - Options group: [INTERNATIONAL] International*
              O11 - Options group: [TABS] Tabbed Browsing
              O18 - Protocol: bw+0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw+0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw-0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw-0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw00 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw00s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw10 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw10s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw20 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw20s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw30 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw30s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw40 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw40s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw50 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw50s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw60 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw60s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw70 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw70s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw80 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw80s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw90 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw90s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwa0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwa0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwb0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwb0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwc0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwc0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwd0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwd0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwe0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwe0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwf0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwf0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
              O18 - Protocol: bwg0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwg0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwh0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwh0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwi0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwi0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwj0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwj0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwk0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwk0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwl0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwl0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwm0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwm0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwn0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwn0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwo0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwo0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwp0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwp0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwq0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwq0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwr0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwr0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bws0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bws0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwt0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwt0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwu0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwu0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwv0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwv0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bww0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bww0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwx0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwx0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwy0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwy0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwz0 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwz0s - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
              O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
              O18 - Protocol: offline-8876480 - {FC8DDC61-6C94-49ED-A05C-4DC04774ABFF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
              O20 - Winlogon Notify: LBTWlgn - c:\program files\fichiers communs\logitech\bluetooth\LBTWlgn.dll
              O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
              O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
              O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
              O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
              O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
              O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
              O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
              O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logitech\Bluetooth\LBTServ.exe
              O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe

              ensuite...
              0
              1. green day Modérateur
                on fait comme ça ! :)

                ==> http://pagesperso-orange.fr/rginformatique/section%20virus/demofairesontmessage.htm

                0
            2. anthony
              boujours a tous ! j'ais été infecté par ce virus "Win32:small-JMH" attrapé par msn. j'ais fais un scan avec skybot iil me le trouve mais dès que je ve le supprimé mon ordi s'éteint. j'ais une analyse avec malware voila le raport :

              Malware - Search and Destroy - Version : Beta 1.0
              === Rapport d'analyse ===
              25/02/2008 a 9:46:19,35
              [b][color=#ff0000]Dernière mise à jour :[/color][/b] 24-02-2008

              [b][u]Analyse Anti-Malware[/u][/b] :
              "C:\Documents and Settings\piolain\Local Settings\Temp\winlogon.exe" [u]Résultat d'analyse :[/u] Fichier/dossier néfaste détecté
              "C:\Program Files\Fichiers communs\BOONTY Shared\" [u]Résultat d'analyse :[/u] Fichier/dossier néfaste détecté
              "C:\Program Files\GamesBar\" [u]Résultat d'analyse :[/u] Fichier/dossier néfaste détecté

              [b][u]Analyse Anti-rootkit[/u][/b]
              catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
              http://www.gmer.net

              scanning hidden processes ...

              ? [348]

              scanning hidden services ...

              scanning hidden autostart entries ...

              scanning hidden files ...

              scan completed successfully
              hidden processes: 1
              hidden services: 0
              hidden files: 0

              [b][u]Détection Trojan.Swizzor[/u][/b]
              Le volume dans le lecteur C s'appelle ACER
              Le num‚ro de s‚rie du volume est 320D-180E

              R‚pertoire de C:\WINDOWS\Tasks

              08/06/2006 11:19 <REP> .
              08/06/2006 11:19 <REP> ..
              0 fichier(s) 0 octets
              2 R‚p(s) 34ÿ705ÿ375ÿ232 octets libres

              aidez moi svp !
              0
              1. anthony
                voila le rapport hijackthis :
                Logfile of Trend Micro HijackThis v2.0.2
                Scan saved at 10:20:25, on 25/02/2008
                Platform: Windows XP SP2 (WinNT 5.01.2600)
                MSIE: Internet Explorer v7.00 (7.00.6000.16608)
                Boot mode: Normal

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\csrss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                C:\Program Files\Alwil Software\Avast4\ashServ.exe
                C:\WINDOWS\system32\spoolsv.exe
                C:\WINDOWS\Explorer.EXE
                C:\Program Files\a-squared Free\a2service.exe
                C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
                C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
                C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
                C:\WINDOWS\system32\RUNDLL32.EXE
                C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
                C:\Program Files\Acer\Acer eConsole\MediaSync.exe
                C:\WINDOWS\system32\nvsvc32.exe
                C:\Program Files\rnamfler\naofsvc.exe
                C:\Acer\Empowering Technology\eRecovery\Monitor.exe
                C:\WINDOWS\system32\tcpsvcs.exe
                C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                C:\WINDOWS\system32\svchost.exe
                C:\Program Files\Acer\Acer eMode Management\AspireService.exe
                C:\Program Files\rnamfler\naomf.exe
                C:\WINDOWS\system32\ctfmon.exe
                C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
                C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
                C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
                c:\program files\rnamfler\radprcmp.exe
                C:\PROGRA~1\WIDCOMM\LOGICI~1\BTSTAC~1.EXE
                C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
                C:\WINDOWS\System32\alg.exe
                C:\WINDOWS\System32\svchost.exe
                C:\Program Files\Internet Explorer\iexplore.exe
                C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                C:\WINDOWS\system32\wbem\wmiprvse.exe

                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
                R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer optimisé pour MSN
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\piolain\LOCALS~1\Temp\winlogon.exe
                O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
                O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
                O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
                O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
                O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
                O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
                O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
                O4 - HKLM\..\Run: [wrna3ls] C:\Program Files\rnamfler\naomf.exe
                O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                O4 - HKLM\..\Run: [Flash Driver] C:\DOCUME~1\piolain\LOCALS~1\Temp\winlogon.exe
                O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
                O4 - Global Startup: BTTray.lnk = ?
                O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
                O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
                O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
                O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
                O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
                O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
                O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
                O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
                O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
                O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
                O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
                O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
                O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
                O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
                O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://jeuxenligne.orange.fr/GameShell/online/fr/hammer_heads/popcaploader_v6.cab
                O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
                O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
                O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
                O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
                O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
                O23 - Service: RdnaoFlSvc - Unknown owner - C:\Program Files\rnamfler\naofsvc.exe
                O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
                O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
                O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
                0
                1. julie
                  encore bonjour à tous, je vous donne mon compte rendu de hijackthis en espérant que vous pourrez m'aider par la suite.

                  Logfile of Trend Micro HijackThis v2.0.2
                  Scan saved at 18:25:18, on 25/02/2008
                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
                  Boot mode: Normal

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                  C:\Program Files\Alwil Software\Avast4\ashServ.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                  C:\Program Files\Bonjour\mDNSResponder.exe
                  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                  C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
                  C:\Program Files\iTunes\iTunesHelper.exe
                  C:\Program Files\SPYWAREfighter\spftray.exe
                  C:\WINDOWS\system32\ctfmon.exe
                  C:\Program Files\MSN Messenger\msnmsgr.exe
                  C:\Program Files\SPYWAREfighter\spfprc.exe
                  C:\Program Files\TRENDnet\TEW-421PC_TEW-423PI\TRENDnet.exe
                  C:\Program Files\iPod\bin\iPodService.exe
                  C:\Program Files\MSN Messenger\usnsvc.exe
                  C:\WINDOWS\system32\wuauclt.exe
                  C:\WINDOWS\system32\wpabaln.exe
                  C:\WINDOWS\Explorer.exe
                  C:\WINDOWS\system32\notepad.exe
                  C:\Program Files\Mozilla Firefox\firefox.exe
                  C:\Program Files\Movie Maker\moviemk.exe
                  C:\Program Files\LimeWire\LimeWire.exe
                  C:\Documents and Settings\Grimaude\Bureau\eden.exe

                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
                  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                  F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\Grimaude\LOCALS~1\Temp\winlogon.exe
                  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
                  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                  O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
                  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                  O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\SPYWAREfighter\spftray.exe
                  O4 - HKLM\..\Run: [Flash Driver] C:\WINDOWS\TEMP\winlogon.exe
                  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                  O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
                  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                  O4 - Global Startup: Wireless Configuration Utility HW.51.lnk = ?
                  O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                  O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                  O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2effb718bc594f6092fc72c7f2c7601b
                  O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2effb718bc594f6092fc72c7f2c7601b
                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                  O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                  O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                  O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Program Files\SPYWAREfighter\spfprc.exe
                  0
                  1. green day Modérateur
                    Salut Julie

                    Télécharger ComboFix (par sUBs) sur le Bureau : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

                    * Démarrer en mode sans echec
                    * Double cliquer combofix.exe.
                    * Appuyer sur la touche Y (Yes) pour démarrer le scan
                    * Le rapport sera crée dans: C:\Combofix.txt, poste le stp

                    ++
                    0
                    1. julie
                      merci de m'avoir répondu si vite green day (d'ailleurs j'adore ce groupe ^^) mais revenons en au problème je t'envois le compte rendu

                      ComboFix 08-02-24.4 - Grimaude 2008-02-25 18:38:20.3 - NTFSx86 MINIMAL
                      Endroit: C:\Documents and Settings\Grimaude\Bureau\ComboFix.exe

                      [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
                      .

                      ((((((((((((((((((((((((((((( Fichiers créés 2008-01-25 to 2008-02-25 ))))))))))))))))))))))))))))))))))))
                      .

                      2008-02-24 13:49 . 2008-02-24 13:50 <REP> d-------- C:\Program Files\SPYWAREfighter
                      2008-02-24 13:49 . 2008-02-24 13:49 <REP> d-------- C:\Program Files\Fichiers communs\Application
                      2008-02-24 12:20 . 2008-02-24 12:20 9,296 --a------ C:\WINDOWS\system32\vmjbss.exe
                      2008-02-24 12:20 . 2008-02-24 12:20 244 --ah----- C:\sqmnoopt02.sqm
                      2008-02-24 12:20 . 2008-02-24 12:20 232 --ah----- C:\sqmdata02.sqm
                      2008-02-24 12:16 . 2008-02-24 12:16 <REP> d-------- C:\Documents and Settings\Grimaude\Application Data\MvPCinfo
                      2008-02-24 12:15 . 2005-04-18 11:03 18,694,144 --a------ C:\WINDOWS\system32\ALSNDMGR.CPL
                      2008-02-24 12:15 . 2005-04-18 11:07 9,309,696 --------- C:\WINDOWS\system32\RTLCPL.exe
                      2008-02-24 12:15 . 2005-04-20 11:00 2,317,696 --a------ C:\WINDOWS\system32\drivers\ALCXWDM.SYS
                      2008-02-24 12:15 . 2005-02-03 15:13 294,912 --------- C:\WINDOWS\alcupd.exe
                      2008-02-24 12:15 . 2005-03-02 20:21 200,704 --------- C:\WINDOWS\alcrmv.exe
                      2008-02-24 12:15 . 2005-03-01 16:49 192,512 --------- C:\WINDOWS\RtlExUpd.dll
                      2008-02-24 12:15 . 2004-09-07 14:23 156,672 --------- C:\WINDOWS\system32\RtlCPAPI.dll
                      2008-02-24 12:15 . 2002-02-05 13:54 141,016 --------- C:\WINDOWS\system32\alsndmgr.wav
                      2008-02-24 12:15 . 2005-04-15 11:01 77,824 --------- C:\WINDOWS\soundman.exe
                      2008-02-24 12:15 . 2004-09-07 13:47 57,344 --a------ C:\WINDOWS\ALCXMNTR.EXE
                      2008-02-24 12:15 . 2004-10-27 15:47 40,960 --------- C:\WINDOWS\system32\ChCfg.exe
                      2008-02-24 12:04 . 2008-02-24 12:04 <REP> d-------- C:\swsetup
                      2008-02-24 12:01 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
                      2008-02-24 11:47 . 2008-02-24 11:47 9,296 --a------ C:\WINDOWS\system32\qlclyy.exe
                      2008-02-24 11:47 . 2008-02-24 11:47 244 --ah----- C:\sqmnoopt01.sqm
                      2008-02-24 11:47 . 2008-02-24 11:47 232 --ah----- C:\sqmdata01.sqm
                      2008-02-24 01:24 . 2008-02-24 01:24 9,296 --a------ C:\WINDOWS\system32\przxeu.exe
                      2008-02-24 01:24 . 2008-02-24 01:24 244 --ah----- C:\sqmnoopt00.sqm
                      2008-02-24 01:24 . 2008-02-24 01:24 232 --ah----- C:\sqmdata00.sqm
                      2008-02-24 00:50 . 2008-02-24 00:50 9,296 --a------ C:\WINDOWS\system32\bctgje.exe
                      2008-02-17 10:47 . 2004-08-05 13:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
                      2008-02-16 15:49 . 2008-02-16 15:49 <REP> d-------- C:\Program Files\Windows Live Favorites
                      2008-02-16 15:40 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
                      2008-02-16 15:05 . 2007-02-28 17:02 2,182,400 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
                      2008-02-16 15:05 . 2007-02-28 17:02 2,138,112 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
                      2008-02-16 15:05 . 2007-02-28 17:02 2,059,648 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
                      2008-02-16 15:05 . 2007-02-28 17:02 2,017,792 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
                      2008-02-16 15:03 . 2006-05-05 10:41 453,120 -----c--- C:\WINDOWS\system32\dllcache\mrxsmb.sys
                      2008-02-16 15:00 . 2008-02-24 19:34 <REP> d--h----- C:\WINDOWS\$hf_mig$
                      2008-02-16 14:40 . 2008-02-16 14:40 <REP> d-------- C:\Program Files\eMule
                      2008-02-16 14:12 . 2008-02-16 14:15 <REP> d-------- C:\Documents and Settings\Grimaude\Application Data\CopyTrans
                      2008-02-16 14:11 . 2008-02-16 14:11 <REP> d-------- C:\Program Files\WindSolutions
                      2008-02-16 14:11 . 2008-02-16 14:11 <REP> d---s---- C:\Documents and Settings\Grimaude\UserData
                      2008-02-16 14:11 . 2008-02-16 14:11 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
                      2008-02-16 14:06 . 2008-02-16 14:06 <REP> d-------- C:\Documents and Settings\Grimaude\Application Data\CopyTransControlCenter
                      2008-02-16 14:06 . 2008-02-16 14:12 <REP> d-------- C:\Documents and Settings\All Users\Application Data\CopyTransControlCenter
                      2008-02-16 13:55 . 2008-02-16 13:55 <REP> d-------- C:\Program Files\iTunes
                      2008-02-16 13:55 . 2008-02-16 13:55 <REP> d-------- C:\Program Files\iPod
                      2008-02-16 13:55 . 2008-02-16 13:55 <REP> d-------- C:\Program Files\Bonjour
                      2008-02-16 13:55 . 2008-02-16 13:55 <REP> d-------- C:\Documents and Settings\Grimaude\Application Data\Apple Computer
                      2008-02-16 13:55 . 2008-02-25 17:43 54,156 --ah----- C:\WINDOWS\QTFont.qfn
                      2008-02-16 13:55 . 2008-02-16 13:55 1,409 --a------ C:\WINDOWS\QTFont.for
                      2008-02-16 13:54 . 2008-02-16 13:54 <REP> d-------- C:\Program Files\QuickTime
                      2008-02-16 13:54 . 2008-02-16 13:55 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
                      2008-02-16 13:53 . 2008-02-16 13:53 <REP> d-------- C:\Program Files\Fichiers communs\Apple
                      2008-02-16 13:53 . 2008-02-16 13:53 <REP> d-------- C:\Program Files\Apple Software Update
                      2008-02-16 13:53 . 2008-02-16 13:53 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
                      2008-02-16 13:43 . 2008-02-16 13:43 <REP> d-------- C:\Program Files\Windows Live
                      2008-02-16 13:43 . 2008-02-16 13:45 <REP> d-------- C:\Program Files\Messenger Plus! Live
                      2008-02-16 13:42 . 2008-02-16 13:42 <REP> d-------- C:\Documents and Settings\Grimaude\Contacts
                      2008-02-16 13:42 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
                      2008-02-16 13:42 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
                      2008-02-16 13:42 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
                      2008-02-16 13:40 . 2008-02-16 13:40 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Windows Live Toolbar
                      2008-02-16 13:40 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
                      2008-02-16 13:40 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui
                      2008-02-16 13:40 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
                      2008-02-16 13:40 . 2007-07-30 19:19 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui
                      2008-02-16 13:40 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
                      2008-02-16 13:39 . 2008-02-16 15:50 <REP> d-------- C:\Program Files\Windows Live Toolbar
                      2008-02-16 13:38 . 2008-02-16 13:53 <REP> d----c--- C:\WINDOWS\system32\DRVSTORE
                      2008-02-16 13:38 . 2008-02-16 13:45 <REP> d-------- C:\Program Files\MSN Messenger
                      2008-02-16 13:32 . 2008-02-16 13:32 <REP> d-------- C:\Program Files\MessengerPlus! 3
                      2008-02-16 13:30 . 2008-02-16 13:30 <REP> d-------- C:\Program Files\Java
                      2008-02-16 13:30 . 2008-02-25 18:08 <REP> d-------- C:\Documents and Settings\Grimaude\Application Data\LimeWire
                      2008-02-16 13:30 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
                      2008-02-16 13:28 . 2008-02-16 13:30 <REP> d-------- C:\Program Files\LimeWire
                      2008-02-16 13:28 . 2008-02-16 13:28 <REP> d-------- C:\Program Files\Fichiers communs\Java
                      2008-02-16 13:26 . 2008-02-16 13:26 0 --a------ C:\WINDOWS\nsreg.dat
                      2008-02-16 13:10 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
                      2008-02-16 13:10 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
                      2008-02-16 13:10 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
                      2008-02-16 13:10 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
                      2008-02-16 13:10 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
                      2008-02-16 13:10 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
                      2008-02-16 13:09 . 2008-02-16 13:09 <REP> d-------- C:\Program Files\Alwil Software
                      2008-02-16 13:09 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
                      2008-02-16 13:09 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
                      2008-02-16 13:09 . 2003-03-18 20:14 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
                      2008-02-16 13:09 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
                      2008-02-16 13:09 . 2003-02-21 04:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
                      2008-02-16 12:09 . 2008-02-16 12:09 <REP> d-------- C:\WINDOWS\Downloaded Installations
                      2008-02-16 12:09 . 2008-02-16 12:09 <REP> d-------- C:\Program Files\TRENDnet
                      2008-02-16 12:09 . 2008-02-24 12:15 <REP> d--h----- C:\Program Files\InstallShield Installation Information
                      2008-02-16 12:09 . 2008-02-24 12:15 <REP> d-------- C:\Program Files\Fichiers communs\InstallShield
                      2008-02-16 12:09 . 2006-02-23 14:52 280,576 --a------ C:\WINDOWS\system32\drivers\MRV8335.sys
                      2008-02-16 12:07 . 2008-02-16 12:07 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
                      2008-02-16 01:07 . 2001-08-17 22:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
                      2008-02-16 01:06 . 2004-08-04 01:39 58,496 --a------ C:\WINDOWS\system32\drivers\redbook.sys
                      2008-02-16 01:05 . 2004-08-04 01:54 77,312 --a------ C:\WINDOWS\system32\usbui.dll
                      2008-02-16 01:05 . 2004-08-03 23:31 20,992 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys
                      2008-02-16 01:05 . 2001-08-17 22:46 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
                      2008-02-16 01:04 . 2008-02-16 01:04 <REP> d--h----- C:\Documents and Settings\Default User\Voisinage réseau
                      2008-02-16 01:04 . 2008-02-16 01:04 <REP> d--h----- C:\Documents and Settings\Default User\Voisinage d'impression

                      .
                      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                      .
                      2008-02-15 23:15 --------- d-----w C:\Program Files\microsoft frontpage
                      2008-02-15 23:14 --------- d-----w C:\Program Files\Services en ligne
                      2007-12-07 01:07 663,552 ----a-w C:\WINDOWS\system32\wininet.dll
                      2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
                      2006-02-23 13:52 280,576 ----a-w C:\WINDOWS\inf\TEW-421PC\MRV8335XP.sys
                      2006-02-23 13:52 280,576 ----a-w C:\WINDOWS\inf\TEW-421PC\MRV8335.sys
                      2006-02-23 13:52 212,992 ----a-w C:\WINDOWS\inf\TEW-421PC\CopyWHQLDriver.exe
                      .

                      ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                      .
                      .
                      REGEDIT4
                      *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

                      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                      "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]
                      "MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2008-02-16 13:32 190024]
                      "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                      "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
                      "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]
                      "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
                      "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-04 14:18 267048]
                      "spywarefighterguard"="C:\Program Files\SPYWAREfighter\spftray.exe" [2007-08-13 14:14 115344]

                      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                      "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]
                      "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]

                      C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                      Wireless Configuration Utility HW.51.lnk - C:\WINDOWS\Installer\{29F15D3F-5B37-44DB-BB89-390B3AD1404E}\NewShortcut1.exe [2008-02-16 12:09:24 40960]

                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                      "%windir%\\system32\\sessmgr.exe"=
                      "C:\\Program Files\\LimeWire\\LimeWire.exe"=
                      "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
                      "C:\\Program Files\\MSN Messenger\\livecall.exe"=
                      "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
                      "C:\\Program Files\\iTunes\\iTunes.exe"=
                      "C:\\Program Files\\eMule\\eMule.exe"=
                      "C:\\DOCUME~1\\Grimaude\\LOCALS~1\\Temp\\winlogon.exe"=

                      S3 SpyFighter;SpyFighter Guard Device;C:\Program Files\SPYWAREfighter\spyfighter.sys [2007-08-13 14:14]
                      S3 SPYWAREfighterRP;SPYWAREfighterRP;"C:\Program Files\SPYWAREfighter\spfprc.exe" [2007-08-13 14:14]

                      .
                      Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
                      "2008-02-16 12:54:23 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
                      - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
                      "2008-02-25 17:19:10 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
                      - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
                      .
                      **************************************************************************

                      catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                      Rootkit scan 2008-02-25 18:40:58
                      Windows 5.1.2600 Service Pack 2 NTFS

                      Balayage processus cachés ...

                      ? [720]

                      Balayage caché autostart entries ...

                      Balayage des fichiers cachés ...

                      Scan terminé avec succès
                      Les fichiers cachés: 0

                      **************************************************************************
                      .
                      Temps d'accomplissement: 2008-02-25 18:42:06
                      ComboFix-quarantined-files.txt 2008-02-25 17:41:41
                      ComboFix2.txt 2008-02-25 16:58:16
                      ComboFix3.txt 2008-02-24 11:30:57
                      .
                      2008-02-25 16:38:46 --- E O F ---
                      0
                      1. green day Modérateur
                        ok,

                        * Faire un clic droit sur ce lien : http://perso.orange.fr/il.mafioso/Navifix/Navilog1.zip
                        * Enregistrez la cible (du lien) sous... et enregistrez-le sur le bureau.
                        * Faire un clic droit sur navilog1.zip et choisir "tout extraire"
                        * Double-cliquez sur navilog1.exe
                        * Arriver au menu principal, choisir l'option 1 et valider.
                        * Patientez jusqu'au message : Analyse Termine le ...
                        * Le rapport sera en outre sauvegardé à la racine du disque (fixnavi.txt)

                        ==> poste le stp

                        ++
                        0
                        1. julie
                          ça marche pas, j'ai pas navilog1.exe
                          0
                          1. green day Modérateur
                            est-ce que tu as décompressé le fichier avant ??

                            ++
                            0
                            • 1
                            • 2

                            Discussions similaires

                            Problème avec "PUADIManager:Win32/OfferCore
                            Knaki

                            3 réponses
                            Softonic,est-ce un virus ?
                            techmel1

                            6 réponses
                            Chrome://newtab
                            Nova

                            14 réponses
                            Désinstaller Softonic
                            Diguimette

                            5 réponses
                            PUADlManager:Win32/OfferCore
                            tenmalade

                            2 réponses