Virus msn win32:agent-HKJ(trj)

excuse moi je ne sait pas ce qu'est loption N peutu m'aider à le faire stp...es tu sure que ca va resoudre mon prbléme?

re bonjour,
ca ma donné ca c pa normal étant doné ke jai o moin 3virus... ca me mé ke okune infection na été detecté...merci de maider c la panik depuis hier!que dois je faire mtnan?
MSN_Fix 1.327

C:\Documents and Settings\Vincent Sarah\Bureau\Nouveau dossier\MSNFix
Fix exécuté le 27/06/2007 - 14:18:17,81 By Vincent Sarah
mode normal

************************ Recherche les fichiers présents

Aucun Fichier trouvé

************************ Recherche les dossiers présents

Aucun dossier trouvé


************************ Fichiers suspects

/!\ ces fichiers nécessitent un avis expérimenté avant toute intervention




------------------------------------------------------------------------
Auteur : !aur3n7 Contact: https://www.aceboard.fr/
------------------------------------------------------------------------

--------------------------------------------- END ---------------------------------------------

JE N'ai rien fait pour que les virus disparaissent....je crains qu'ils soient encore la mon ordi rame...je vous envois mon rapportmerci vraiment de maider,bravopour ce que vous faites!
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14:42:43, on 27/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\admServ.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\acer\Empowering Technology\ePower\epm-dm.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Acer\Empowering Technology\admtray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Softwin\BitDefender8\bdnagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\WINDOWS\system32\igfxext.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
c:\program files\softwin\bitdefender8\bdmcon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Vincent Sarah\Local Settings\Temporary Internet Files\Content.IE5\M7YMO8AM\HiJackThis_v2[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\WANADOO\SEARCH~1.DLL (file missing)
O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\system32\irvduagm.dll
O2 - BHO: (no name) - {20F0E2B3-978D-4074-80AF-68FB28A9EFFD} - C:\WINDOWS\system32\mljgg.dll
O2 - BHO: (no name) - {DC192567-65F9-4AB6-ADB7-E13575F81726} - C:\WINDOWS\system32\rqrpqop.dll
O3 - Toolbar: Acer eDataSecurity Management - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINDOWS\system32\ToolBand.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\Empowering Technology\ePower\epm-dm.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\system32\cjhbjkdh.dll",forkonce
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender8\bdmcon.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender8\bdnagent.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O4 - Global Startup: Picture Package Menu.lnk = ?
O8 - Extra context menu item: &Sample Toolband Serach - res://C:\WINDOWS\system32\ToolBand.dll/MENUSEARCH.HTM
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://babydoll875.spaces.live.com//PhotoUpload/MsnPUpld.cab
O20 - Winlogon Notify: mljgg - C:\WINDOWS\system32\mljgg.dll
O20 - Winlogon Notify: rqrpqop - C:\WINDOWS\SYSTEM32\rqrpqop.dll
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\hepmbkud.exe (file missing)
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

rebonjour...
alors jai supprimé bitdefender8 car avast est mon antivirus dorigine, jespére que ce n'est pas une erreur de ma part.
voila le rapport Vundo:
VundoFix V6.5.1

Checking Java version...

Sun Java not detected
Scan started at 20:52:35 26/06/2007

Listing files found while scanning....

C:\WINDOWS\system32\ggjlm.bak1
C:\WINDOWS\system32\ggjlm.ini
C:\WINDOWS\system32\mljgg.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\ggjlm.bak1
C:\WINDOWS\system32\ggjlm.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\ggjlm.ini
C:\WINDOWS\system32\ggjlm.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljgg.dll
C:\WINDOWS\system32\mljgg.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.5.1

Checking Java version...

Sun Java not detected
Scan started at 15:03:16 27/06/2007

Listing files found while scanning....

C:\WINDOWS\system32\ggjlm.bak1
C:\WINDOWS\system32\ggjlm.ini
C:\WINDOWS\system32\mljgg.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\ggjlm.bak1
C:\WINDOWS\system32\ggjlm.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\ggjlm.ini
C:\WINDOWS\system32\ggjlm.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljgg.dll
C:\WINDOWS\system32\mljgg.dll Has been deleted!

Performing Repairs to the registry.
Done!

pour le rapport hijacthis comment doisje faire? je cherche en attendant votre reponse merci 1000fois

voila le rapport HIjackthis:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 15:18:54, on 27/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\admServ.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\acer\Empowering Technology\ePower\epm-dm.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Acer\Empowering Technology\admtray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\system32\igfxext.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Vincent Sarah\Local Settings\Temporary Internet Files\Content.IE5\M7YMO8AM\HiJackThis_v2[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\WANADOO\SEARCH~1.DLL (file missing)
O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\system32\irvduagm.dll
O2 - BHO: (no name) - {20F0E2B3-978D-4074-80AF-68FB28A9EFFD} - C:\WINDOWS\system32\mljgg.dll (file missing)
O2 - BHO: (no name) - {6C884B08-190D-4A73-A27F-776DA886668A} - C:\WINDOWS\system32\geeby.dll
O2 - BHO: (no name) - {DC192567-65F9-4AB6-ADB7-E13575F81726} - C:\WINDOWS\system32\rqrpqop.dll
O3 - Toolbar: Acer eDataSecurity Management - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINDOWS\system32\ToolBand.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\Empowering Technology\ePower\epm-dm.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\system32\cjhbjkdh.dll",forkonce
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O4 - Global Startup: Picture Package Menu.lnk = ?
O8 - Extra context menu item: &Sample Toolband Serach - res://C:\WINDOWS\system32\ToolBand.dll/MENUSEARCH.HTM
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://babydoll875.spaces.live.com//PhotoUpload/MsnPUpld.cab
O20 - Winlogon Notify: geeby - C:\WINDOWS\system32\geeby.dll
O20 - Winlogon Notify: rqrpqop - C:\WINDOWS\SYSTEM32\rqrpqop.dll
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\hepmbkud.exe (file missing)
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

+ rapport hijackthis:

[06/27/2007, 15:37:49] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Vincent Sarah\Local Settings\Temporary Internet Files\Content.IE5\CTFNVNMQ\VirtumundoBeGone[1].exe" )
[06/27/2007, 15:37:57] - Detected System Information:
[06/27/2007, 15:37:57] - Windows Version: 5.1.2600, Service Pack 2
[06/27/2007, 15:37:57] - Current Username: Vincent Sarah (Admin)
[06/27/2007, 15:37:57] - Windows is in NORMAL mode.
[06/27/2007, 15:37:57] - Searching for Browser Helper Objects:
[06/27/2007, 15:37:57] - BHO 1: {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} ()
[06/27/2007, 15:37:57] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:37:57] - Checking for HKLM\...\Winlogon\Notify\irvduagm
[06/27/2007, 15:37:57] - Key not found: HKLM\...\Winlogon\Notify\irvduagm, continuing.
[06/27/2007, 15:37:57] - BHO 2: {20F0E2B3-978D-4074-80AF-68FB28A9EFFD} ()
[06/27/2007, 15:37:57] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:37:57] - Checking for HKLM\...\Winlogon\Notify\mljgg
[06/27/2007, 15:37:57] - Key not found: HKLM\...\Winlogon\Notify\mljgg, continuing.
[06/27/2007, 15:37:57] - BHO 3: {6C884B08-190D-4A73-A27F-776DA886668A} ()
[06/27/2007, 15:37:57] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:37:57] - Checking for HKLM\...\Winlogon\Notify\geeby
[06/27/2007, 15:37:57] - Found: HKLM\...\Winlogon\Notify\geeby - This is probably Virtumundo.
[06/27/2007, 15:37:57] - Assigning {6C884B08-190D-4A73-A27F-776DA886668A} MSEvents Object
[06/27/2007, 15:37:57] - BHO list has been changed! Starting over...
[06/27/2007, 15:37:57] - BHO 1: {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} ()
[06/27/2007, 15:37:57] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:37:57] - Checking for HKLM\...\Winlogon\Notify\irvduagm
[06/27/2007, 15:37:57] - Key not found: HKLM\...\Winlogon\Notify\irvduagm, continuing.
[06/27/2007, 15:37:57] - BHO 2: {20F0E2B3-978D-4074-80AF-68FB28A9EFFD} ()
[06/27/2007, 15:37:57] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:37:57] - Checking for HKLM\...\Winlogon\Notify\mljgg
[06/27/2007, 15:37:57] - Key not found: HKLM\...\Winlogon\Notify\mljgg, continuing.
[06/27/2007, 15:37:57] - BHO 3: {6C884B08-190D-4A73-A27F-776DA886668A} (MSEvents Object)
[06/27/2007, 15:37:57] - ALERT: Found MSEvents Object!
[06/27/2007, 15:37:57] - BHO 4: {DC192567-65F9-4AB6-ADB7-E13575F81726} ()
[06/27/2007, 15:37:57] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:37:57] - Checking for HKLM\...\Winlogon\Notify\rqrpqop
[06/27/2007, 15:37:57] - Found: HKLM\...\Winlogon\Notify\rqrpqop - This is probably Virtumundo.
[06/27/2007, 15:37:57] - Assigning {DC192567-65F9-4AB6-ADB7-E13575F81726} MSEvents Object
[06/27/2007, 15:37:57] - BHO list has been changed! Starting over...
[06/27/2007, 15:37:57] - BHO 1: {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} ()
[06/27/2007, 15:37:57] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:37:57] - Checking for HKLM\...\Winlogon\Notify\irvduagm
[06/27/2007, 15:37:57] - Key not found: HKLM\...\Winlogon\Notify\irvduagm, continuing.
[06/27/2007, 15:37:57] - BHO 2: {20F0E2B3-978D-4074-80AF-68FB28A9EFFD} ()
[06/27/2007, 15:37:57] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:37:57] - Checking for HKLM\...\Winlogon\Notify\mljgg
[06/27/2007, 15:37:57] - Key not found: HKLM\...\Winlogon\Notify\mljgg, continuing.
[06/27/2007, 15:37:57] - BHO 3: {6C884B08-190D-4A73-A27F-776DA886668A} (MSEvents Object)
[06/27/2007, 15:37:57] - ALERT: Found MSEvents Object!
[06/27/2007, 15:37:57] - BHO 4: {DC192567-65F9-4AB6-ADB7-E13575F81726} (MSEvents Object)
[06/27/2007, 15:37:57] - ALERT: Found MSEvents Object!
[06/27/2007, 15:37:57] - Finished Searching Browser Helper Objects
[06/27/2007, 15:37:57] - *** Detected MSEvents Object
[06/27/2007, 15:37:57] - Trying to remove MSEvents Object...
[06/27/2007, 15:37:58] - Terminating Process: IEXPLORE.EXE
[06/27/2007, 15:37:59] - Terminating Process: RUNDLL32.EXE
[06/27/2007, 15:37:59] - Disabling Automatic Shell Restart
[06/27/2007, 15:37:59] - Terminating Process: EXPLORER.EXE
[06/27/2007, 15:37:59] - Suspending the NT Session Manager System Service
[06/27/2007, 15:37:59] - Terminating Windows NT Logon/Logoff Manager
[06/27/2007, 15:38:00] - Re-enabling Automatic Shell Restart
[06/27/2007, 15:38:00] - File to disable: C:\WINDOWS\system32\geeby.dll
[06/27/2007, 15:38:00] - Renaming C:\WINDOWS\system32\geeby.dll -> C:\WINDOWS\system32\geeby.dll.vir
[06/27/2007, 15:38:00] - File successfully renamed!
[06/27/2007, 15:38:00] - Removing HKLM\...\Browser Helper Objects\{6C884B08-190D-4A73-A27F-776DA886668A}
[06/27/2007, 15:38:00] - Removing HKCR\CLSID\{6C884B08-190D-4A73-A27F-776DA886668A}
[06/27/2007, 15:38:00] - Adding Kill Bit for ActiveX for GUID: {6C884B08-190D-4A73-A27F-776DA886668A}
[06/27/2007, 15:38:00] - Deleting ATLEvents/MSEvents Registry entries
[06/27/2007, 15:38:00] - Removing HKLM\...\Winlogon\Notify\geeby
[06/27/2007, 15:38:00] - Searching for Browser Helper Objects:
[06/27/2007, 15:38:00] - BHO 1: {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} ()
[06/27/2007, 15:38:00] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:38:00] - Checking for HKLM\...\Winlogon\Notify\irvduagm
[06/27/2007, 15:38:00] - Key not found: HKLM\...\Winlogon\Notify\irvduagm, continuing.
[06/27/2007, 15:38:00] - BHO 2: {20F0E2B3-978D-4074-80AF-68FB28A9EFFD} ()
[06/27/2007, 15:38:00] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:38:00] - Checking for HKLM\...\Winlogon\Notify\mljgg
[06/27/2007, 15:38:00] - Key not found: HKLM\...\Winlogon\Notify\mljgg, continuing.
[06/27/2007, 15:38:00] - BHO 3: {DC192567-65F9-4AB6-ADB7-E13575F81726} (MSEvents Object)
[06/27/2007, 15:38:00] - ALERT: Found MSEvents Object!
[06/27/2007, 15:38:00] - Finished Searching Browser Helper Objects
[06/27/2007, 15:38:00] - *** Detected MSEvents Object
[06/27/2007, 15:38:00] - Trying to remove MSEvents Object...
[06/27/2007, 15:38:01] - Terminating Process: IEXPLORE.EXE
[06/27/2007, 15:38:01] - Terminating Process: RUNDLL32.EXE
[06/27/2007, 15:38:01] - Disabling Automatic Shell Restart
[06/27/2007, 15:38:01] - Terminating Process: EXPLORER.EXE
[06/27/2007, 15:38:01] - Suspending the NT Session Manager System Service
[06/27/2007, 15:38:01] - Terminating Windows NT Logon/Logoff Manager
[06/27/2007, 15:38:01] - Re-enabling Automatic Shell Restart
[06/27/2007, 15:38:01] - File to disable: C:\WINDOWS\system32\rqrpqop.dll
[06/27/2007, 15:38:01] - Renaming C:\WINDOWS\system32\rqrpqop.dll -> C:\WINDOWS\system32\rqrpqop.dll.vir
[06/27/2007, 15:38:01] - File successfully renamed!
[06/27/2007, 15:38:01] - Removing HKLM\...\Browser Helper Objects\{DC192567-65F9-4AB6-ADB7-E13575F81726}
[06/27/2007, 15:38:01] - Removing HKCR\CLSID\{DC192567-65F9-4AB6-ADB7-E13575F81726}
[06/27/2007, 15:38:01] - Adding Kill Bit for ActiveX for GUID: {DC192567-65F9-4AB6-ADB7-E13575F81726}
[06/27/2007, 15:38:01] - Deleting ATLEvents/MSEvents Registry entries
[06/27/2007, 15:38:01] - Removing HKLM\...\Winlogon\Notify\rqrpqop
[06/27/2007, 15:38:01] - Searching for Browser Helper Objects:
[06/27/2007, 15:38:01] - BHO 1: {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} ()
[06/27/2007, 15:38:01] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:38:01] - Checking for HKLM\...\Winlogon\Notify\irvduagm
[06/27/2007, 15:38:01] - Key not found: HKLM\...\Winlogon\Notify\irvduagm, continuing.
[06/27/2007, 15:38:01] - BHO 2: {20F0E2B3-978D-4074-80AF-68FB28A9EFFD} ()
[06/27/2007, 15:38:01] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:38:01] - Checking for HKLM\...\Winlogon\Notify\mljgg
[06/27/2007, 15:38:01] - Key not found: HKLM\...\Winlogon\Notify\mljgg, continuing.
[06/27/2007, 15:38:01] - Finished Searching Browser Helper Objects
[06/27/2007, 15:38:01] - Finishing up...
[06/27/2007, 15:38:01] - A restart is needed.
[06/27/2007, 15:38:03] - Attempting to Restart via STOP error (Blue Screen!)

[06/27/2007, 15:37:49] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Vincent Sarah\Local Settings\Temporary Internet Files\Content.IE5\CTFNVNMQ\VirtumundoBeGone[1].exe" )
[06/27/2007, 15:37:57] - Detected System Information:
[06/27/2007, 15:37:57] - Windows Version: 5.1.2600, Service Pack 2
[06/27/2007, 15:37:57] - Current Username: Vincent Sarah (Admin)
[06/27/2007, 15:37:57] - Windows is in NORMAL mode.
[06/27/2007, 15:37:57] - Searching for Browser Helper Objects:
[06/27/2007, 15:37:57] - BHO 1: {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} ()
[06/27/2007, 15:37:57] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:37:57] - Checking for HKLM\...\Winlogon\Notify\irvduagm
[06/27/2007, 15:37:57] - Key not found: HKLM\...\Winlogon\Notify\irvduagm, continuing.
[06/27/2007, 15:37:57] - BHO 2: {20F0E2B3-978D-4074-80AF-68FB28A9EFFD} ()
[06/27/2007, 15:37:57] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:37:57] - Checking for HKLM\...\Winlogon\Notify\mljgg
[06/27/2007, 15:37:57] - Key not found: HKLM\...\Winlogon\Notify\mljgg, continuing.
[06/27/2007, 15:37:57] - BHO 3: {6C884B08-190D-4A73-A27F-776DA886668A} ()
[06/27/2007, 15:37:57] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:37:57] - Checking for HKLM\...\Winlogon\Notify\geeby
[06/27/2007, 15:37:57] - Found: HKLM\...\Winlogon\Notify\geeby - This is probably Virtumundo.
[06/27/2007, 15:37:57] - Assigning {6C884B08-190D-4A73-A27F-776DA886668A} MSEvents Object
[06/27/2007, 15:37:57] - BHO list has been changed! Starting over...
[06/27/2007, 15:37:57] - BHO 1: {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} ()
[06/27/2007, 15:37:57] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:37:57] - Checking for HKLM\...\Winlogon\Notify\irvduagm
[06/27/2007, 15:37:57] - Key not found: HKLM\...\Winlogon\Notify\irvduagm, continuing.
[06/27/2007, 15:37:57] - BHO 2: {20F0E2B3-978D-4074-80AF-68FB28A9EFFD} ()
[06/27/2007, 15:37:57] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:37:57] - Checking for HKLM\...\Winlogon\Notify\mljgg
[06/27/2007, 15:37:57] - Key not found: HKLM\...\Winlogon\Notify\mljgg, continuing.
[06/27/2007, 15:37:57] - BHO 3: {6C884B08-190D-4A73-A27F-776DA886668A} (MSEvents Object)
[06/27/2007, 15:37:57] - ALERT: Found MSEvents Object!
[06/27/2007, 15:37:57] - BHO 4: {DC192567-65F9-4AB6-ADB7-E13575F81726} ()
[06/27/2007, 15:37:57] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:37:57] - Checking for HKLM\...\Winlogon\Notify\rqrpqop
[06/27/2007, 15:37:57] - Found: HKLM\...\Winlogon\Notify\rqrpqop - This is probably Virtumundo.
[06/27/2007, 15:37:57] - Assigning {DC192567-65F9-4AB6-ADB7-E13575F81726} MSEvents Object
[06/27/2007, 15:37:57] - BHO list has been changed! Starting over...
[06/27/2007, 15:37:57] - BHO 1: {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} ()
[06/27/2007, 15:37:57] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:37:57] - Checking for HKLM\...\Winlogon\Notify\irvduagm
[06/27/2007, 15:37:57] - Key not found: HKLM\...\Winlogon\Notify\irvduagm, continuing.
[06/27/2007, 15:37:57] - BHO 2: {20F0E2B3-978D-4074-80AF-68FB28A9EFFD} ()
[06/27/2007, 15:37:57] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:37:57] - Checking for HKLM\...\Winlogon\Notify\mljgg
[06/27/2007, 15:37:57] - Key not found: HKLM\...\Winlogon\Notify\mljgg, continuing.
[06/27/2007, 15:37:57] - BHO 3: {6C884B08-190D-4A73-A27F-776DA886668A} (MSEvents Object)
[06/27/2007, 15:37:57] - ALERT: Found MSEvents Object!
[06/27/2007, 15:37:57] - BHO 4: {DC192567-65F9-4AB6-ADB7-E13575F81726} (MSEvents Object)
[06/27/2007, 15:37:57] - ALERT: Found MSEvents Object!
[06/27/2007, 15:37:57] - Finished Searching Browser Helper Objects
[06/27/2007, 15:37:57] - *** Detected MSEvents Object
[06/27/2007, 15:37:57] - Trying to remove MSEvents Object...
[06/27/2007, 15:37:58] - Terminating Process: IEXPLORE.EXE
[06/27/2007, 15:37:59] - Terminating Process: RUNDLL32.EXE
[06/27/2007, 15:37:59] - Disabling Automatic Shell Restart
[06/27/2007, 15:37:59] - Terminating Process: EXPLORER.EXE
[06/27/2007, 15:37:59] - Suspending the NT Session Manager System Service
[06/27/2007, 15:37:59] - Terminating Windows NT Logon/Logoff Manager
[06/27/2007, 15:38:00] - Re-enabling Automatic Shell Restart
[06/27/2007, 15:38:00] - File to disable: C:\WINDOWS\system32\geeby.dll
[06/27/2007, 15:38:00] - Renaming C:\WINDOWS\system32\geeby.dll -> C:\WINDOWS\system32\geeby.dll.vir
[06/27/2007, 15:38:00] - File successfully renamed!
[06/27/2007, 15:38:00] - Removing HKLM\...\Browser Helper Objects\{6C884B08-190D-4A73-A27F-776DA886668A}
[06/27/2007, 15:38:00] - Removing HKCR\CLSID\{6C884B08-190D-4A73-A27F-776DA886668A}
[06/27/2007, 15:38:00] - Adding Kill Bit for ActiveX for GUID: {6C884B08-190D-4A73-A27F-776DA886668A}
[06/27/2007, 15:38:00] - Deleting ATLEvents/MSEvents Registry entries
[06/27/2007, 15:38:00] - Removing HKLM\...\Winlogon\Notify\geeby
[06/27/2007, 15:38:00] - Searching for Browser Helper Objects:
[06/27/2007, 15:38:00] - BHO 1: {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} ()
[06/27/2007, 15:38:00] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:38:00] - Checking for HKLM\...\Winlogon\Notify\irvduagm
[06/27/2007, 15:38:00] - Key not found: HKLM\...\Winlogon\Notify\irvduagm, continuing.
[06/27/2007, 15:38:00] - BHO 2: {20F0E2B3-978D-4074-80AF-68FB28A9EFFD} ()
[06/27/2007, 15:38:00] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:38:00] - Checking for HKLM\...\Winlogon\Notify\mljgg
[06/27/2007, 15:38:00] - Key not found: HKLM\...\Winlogon\Notify\mljgg, continuing.
[06/27/2007, 15:38:00] - BHO 3: {DC192567-65F9-4AB6-ADB7-E13575F81726} (MSEvents Object)
[06/27/2007, 15:38:00] - ALERT: Found MSEvents Object!
[06/27/2007, 15:38:00] - Finished Searching Browser Helper Objects
[06/27/2007, 15:38:00] - *** Detected MSEvents Object
[06/27/2007, 15:38:00] - Trying to remove MSEvents Object...
[06/27/2007, 15:38:01] - Terminating Process: IEXPLORE.EXE
[06/27/2007, 15:38:01] - Terminating Process: RUNDLL32.EXE
[06/27/2007, 15:38:01] - Disabling Automatic Shell Restart
[06/27/2007, 15:38:01] - Terminating Process: EXPLORER.EXE
[06/27/2007, 15:38:01] - Suspending the NT Session Manager System Service
[06/27/2007, 15:38:01] - Terminating Windows NT Logon/Logoff Manager
[06/27/2007, 15:38:01] - Re-enabling Automatic Shell Restart
[06/27/2007, 15:38:01] - File to disable: C:\WINDOWS\system32\rqrpqop.dll
[06/27/2007, 15:38:01] - Renaming C:\WINDOWS\system32\rqrpqop.dll -> C:\WINDOWS\system32\rqrpqop.dll.vir
[06/27/2007, 15:38:01] - File successfully renamed!
[06/27/2007, 15:38:01] - Removing HKLM\...\Browser Helper Objects\{DC192567-65F9-4AB6-ADB7-E13575F81726}
[06/27/2007, 15:38:01] - Removing HKCR\CLSID\{DC192567-65F9-4AB6-ADB7-E13575F81726}
[06/27/2007, 15:38:01] - Adding Kill Bit for ActiveX for GUID: {DC192567-65F9-4AB6-ADB7-E13575F81726}
[06/27/2007, 15:38:01] - Deleting ATLEvents/MSEvents Registry entries
[06/27/2007, 15:38:01] - Removing HKLM\...\Winlogon\Notify\rqrpqop
[06/27/2007, 15:38:01] - Searching for Browser Helper Objects:
[06/27/2007, 15:38:01] - BHO 1: {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} ()
[06/27/2007, 15:38:01] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:38:01] - Checking for HKLM\...\Winlogon\Notify\irvduagm
[06/27/2007, 15:38:01] - Key not found: HKLM\...\Winlogon\Notify\irvduagm, continuing.
[06/27/2007, 15:38:01] - BHO 2: {20F0E2B3-978D-4074-80AF-68FB28A9EFFD} ()
[06/27/2007, 15:38:01] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/27/2007, 15:38:01] - Checking for HKLM\...\Winlogon\Notify\mljgg
[06/27/2007, 15:38:01] - Key not found: HKLM\...\Winlogon\Notify\mljgg, continuing.
[06/27/2007, 15:38:01] - Finished Searching Browser Helper Objects
[06/27/2007, 15:38:01] - Finishing up...
[06/27/2007, 15:38:01] - A restart is needed.
[06/27/2007, 15:38:03] - Attempting to Restart via STOP error (Blue Screen!)

voila jen é fé un second: é merci enkore de maider!
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 16:06:25, on 27/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\admServ.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\acer\Empowering Technology\ePower\epm-dm.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Acer\Empowering Technology\admtray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\WINDOWS\system32\igfxext.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Vincent Sarah\Local Settings\Temporary Internet Files\Content.IE5\M7YMO8AM\HiJackThis_v2[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\WANADOO\SEARCH~1.DLL (file missing)
O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\system32\irvduagm.dll
O2 - BHO: (no name) - {20F0E2B3-978D-4074-80AF-68FB28A9EFFD} - C:\WINDOWS\system32\mljgg.dll (file missing)
O3 - Toolbar: Acer eDataSecurity Management - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINDOWS\system32\ToolBand.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\Empowering Technology\ePower\epm-dm.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\system32\cjhbjkdh.dll",forkonce
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O4 - Global Startup: Picture Package Menu.lnk = ?
O8 - Extra context menu item: &Sample Toolband Serach - res://C:\WINDOWS\system32\ToolBand.dll/MENUSEARCH.HTM
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://babydoll875.spaces.live.com//PhotoUpload/MsnPUpld.cab
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\hepmbkud.exe (file missing)
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

très bien...et maintenant je dois faire koi? les virus sont toujours présents?tu étudies le rapoort?dsl je suis un peu perdue, c'est gentil de toccuper de mon probléme.

alors jai fé la premier etape avec hijackthis mais dans panneau de config il ny a pa "option des dossiers" c peutêtre une otre appelation mais je ne sais pas laquelle peux-tu méclairer?

jai trouvé option des dossiers merki

voici le rapport AVG anti-spyware:
---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 17:17:59 27/06/2007

+ Résultat de l'analyse:



HKLM\SOFTWARE\Classes\ToolBand.ToolBandObj -> Adware.CoolWebSearch : Nettoyé et sauvegardé (mise en quarantaine).
HKLM\SOFTWARE\Classes\ToolBand.ToolBandObj.1 -> Adware.CoolWebSearch : Nettoyé et sauvegardé (mise en quarantaine).
HKLM\SOFTWARE\Classes\ToolBand.ToolBandObj\CLSID -> Adware.CoolWebSearch : Nettoyé et sauvegardé (mise en quarantaine).
HKLM\SOFTWARE\Classes\ToolBand.ToolBandObj\CurVer -> Adware.CoolWebSearch : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025283.DLL -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\awtrsrs.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\awtsrqq.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\awtttrr.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\awtuusr.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\byxutuv.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\byxxvwv.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\byxxwus.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\cbxuttr.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\cbxwuvv.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\cbxyyay.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\efcdeff.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\fccbbaw.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\fccbcbx.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\fccyvvu.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\gebccaw.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\iifcaxu.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\iifefdd.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\iiffcaa.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\jkkigec.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\jkkiifd.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\khfeedc.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\khffcay.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\ljjkkhi.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\mljihfe.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\nnnmnlj.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\opnmjjk.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\opnnkkk.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\opnnlmk.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\qomkigf.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\qomklkh.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\qomljhi.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\qomllig.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\qomnlii.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\rqropoo.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\rqrpqop.dll.vir -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\rqrsrsq.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\ssqpoml.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\ssqpoom.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\ssqroml.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\urqpqno.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\urqrono.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\urqrstt.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\vtusqoo.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\vtuttts.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\wvursst.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\wvuvsqo.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\xxyabcy.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\xxyayww.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\xxyyawt.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\yayvwuv.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\yaywwvu.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\WinAntiVirus Pro 2007\st.dat -> Adware.WinAntiVirus : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\WinAntiVirus Pro 2007\up.dat -> Adware.WinAntiVirus : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP209\A0023903.rbf -> Backdoor.MSNMaker.ag : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\Temp\_avast4_\unp108018800.tmp -> Downloader.Agent.bls : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Vincent Sarah\Application Data\winantiviruspro2007freeinstall_fr[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Vincent Sarah\Local Settings\Temporary Internet Files\Content.IE5\Y5D5LEW6\WinAntiVirusPro2007FreeInstall_fr[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Vincent Sarah\Local Settings\Temporary Internet Files\Content.IE5\FZJIAZ93\SystemDoctor2006FreeInstall_fr[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.q : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@247realmedia[2].txt -> TrackingCookie.247realmedia : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@sfr.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@adbrite[2].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@ads.adbrite[2].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@advertising[2].txt -> TrackingCookie.Advertising : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Local Settings\Temp\Cookies\vincent_sarah@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@estat[1].txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Local Settings\Temp\Cookies\vincent_sarah@search.live[3].txt -> TrackingCookie.Live : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@ssl-hints.netflame[2].txt -> TrackingCookie.Netflame : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@overture[2].txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@specificclick[2].txt -> TrackingCookie.Specificclick : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@toplist[1].txt -> TrackingCookie.Toplist : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@zedo[2].txt -> TrackingCookie.Zedo : Nettoyé.
C:\Documents and Settings\Vincent Sarah\Local Settings\Temporary Internet Files\Content.IE5\FZJIAZ93\tob_snd_20070616[1] -> Trojan.Agent.aoy : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\Softwin\BitDefender8\Quarantine\hepmbkud.exe -> Trojan.Agent.aoy : Nettoyé et sauvegardé (mise en quarantaine).


Fin du rapport

ok jessaye ce que tu me dis merci

QUAND JE CLIQUE SUR "scan" ca recherche mé ca ne mafiche pa la page blok note afin ke je puisse posté mon raport, komen dois-je faire?

c bon! voila le raport hijackthis:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 17:52:27, on 27/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Acer\Empowering Technology\admServ.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\acer\Empowering Technology\ePower\epm-dm.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\Acer\Empowering Technology\admtray.exe
C:\WINDOWS\system32\igfxext.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Vincent Sarah\Local Settings\Temporary Internet Files\Content.IE5\S07Q8ZO3\HiJackThis_v2[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\WANADOO\SEARCH~1.DLL (file missing)
O3 - Toolbar: Acer eDataSecurity Management - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINDOWS\system32\ToolBand.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\Empowering Technology\ePower\epm-dm.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O4 - Global Startup: Picture Package Menu.lnk = ?
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://babydoll875.spaces.live.com//PhotoUpload/MsnPUpld.cab
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

mon ordi est aparamen normal mé javé desinstaller msn (dou me provené le virus), avast ne declenche plu dalarme mais ca depui un moment, mém kan jaé tjs lé virus, estcke je laiss avast? estcke je desinstal avg-antispywar? estcke je pe reinstaler msn? ke me conseille tu? é ke me conseille tu pour étr sur ke je né plu de virus sur mon ordi ...merci enormémen en tou k!!!

en atendant ta reponse g fé une otr analyse av avg-antispyware é ca ma detecté d infection je tenvoi le rapport ke doisje faire a pre--------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 18:44:09 27/06/2007

+ Résultat de l'analyse:



C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025345.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025346.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025347.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025348.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025349.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025350.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025351.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025352.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025353.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025354.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025355.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025356.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025357.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025358.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025359.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025360.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025361.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025362.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025363.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025364.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025365.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025366.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025367.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025368.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025369.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025370.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025371.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025372.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025373.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025374.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025375.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025376.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025377.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025378.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025379.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025380.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025381.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025382.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025383.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025384.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025385.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025386.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025387.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025388.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025389.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025390.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025391.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025392.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025393.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025394.dll -> Adware.Virtumonde : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025395.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Aucune action entreprise.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@bluestreak[2].txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@doubleclick[1].txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
C:\Documents and Settings\Vincent Sarah\Cookies\vincent_sarah@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
C:\System Volume Information\_restore{23F08A26-38FB-4A7A-96A8-388AD6A8D028}\RP212\A0025344.exe -> Trojan.Agent.aoy : Aucune action entreprise.


Fin du rapport

sent?

ben ecoute c sper je te remercie enormémen en tou k...por ce ki é de ccleaner il fo un code pour linstaller un code payant donc bon....
sinon komen étr sur ke je desinstall corectemen msnfix,vundofix é virtumundobegone, en fait kommen je fais pour les desinstaller car il son pa dan ajou suppression de fichier?
merci bokou

pour ce ki é de la restauration jai lu lé lien mé je kompren pa tro donc je touche a rien je kroi ke c le mieu, mé lé virs ne peuvent pas étr totalmen iradié de mon ordinateur?dsl ca te fé bokou de petite kestion.

dsl le lien ne marche pas enfin je narive pa a le trouver...dsl.
Sinon il ne sont pas sur mon bureau vundofix,msnfix et virtumondobegone donc l ne doivent plus étr sur mon ordi.