BAGLE ET PLUS D'ANTI VIRUS Résolu/Fermé

Question

Bonjour,
je suis sous XP
j'ai perdu avast, quand j'ai voulu le réinstaller, un message me disais que l'application n'était pas valide. j'ai consulté les post du forum, j'ai inspecté le pc avec bitdéfendeur en ligne et stinger, avast cleaner.
ils m'ont trouvé dans le dossier internet temporer le virus BAGLE il a été éliminé. ayant ralumé mon pc, je ne peut toujours pas remettre avast ou antivir ou installer ccleaner le meme message apparait application non valide.
pouvez vous m'aider ?

toptitbal · Accepted Answer

Bonjour

Télécharge FindyKill de Chiquitine29 : 

http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe 

->Enregistre-le sur ton bureau et pas ailleurs ! 

!! Déconnecte toi et ferme toutes les  applications en cours !! 

( Si ton anti-virus s'affolle au moment de l'enregistrement ou de l'utilisation de l'outil , ignore l'alerte ...) 

-> Clique sur "FindyKill.exe" pour lancer l'installe de l'outil . Ne touche surtout pas aux paramètres d'installation. 

Tuto : https://www.malekal.com/tutorial-findykill/


--> Double-clique sur le raccourci " FindyKill " qui est sur ton bureau . 

-->choisis l'option 1 ( recherche ) . Puis laisse travailler l'outil sans rien toucher ... 

Une fois terminé, poste le rapport FindyKill.txt qui est généré ... 

( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt ) 

PS : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

babass61 · Answer

ok je m'y colle tout de suite merci a tout a l'heure

babass61 · Answer

me revoila c'est rapide et efficace, bonne lecture ! ###################### [ FindyKill V4.714 ] # User : S‚bastien - CHAMBRE # Emplacement : C:\Program Files\FindyKill # Outils Mis a jours le 19/01/09 par Chiquitine29 # Recherche effectuée à 17:35:44 le 19/01/2009 # Windows XP - Internet Explorer 7.0.5730.13 # [ FindyKill V4.714 - Scan ] ############## \\\\\\\\\\ [ Processus actifs ] /////////////////// C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32 vsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0R2.EXE C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Logitech\QuickCam10\QuickCam10.exe C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe C:\Program Files\Caere\OmniPagePro90\opware32.exe C:\Program Files\SweetIM\Messenger\SweetIM.exe C:\WINDOWS\system32 tvdm.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe C:\Documents and Settings\Sébastien\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\Picasa2\PicasaMediaDetector.exe C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE C:\Documents and Settings\Sébastien\Application Data\drivers\winupgro.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\Magentic\bin\MgApp.exe C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe C:\Program Files\IncrediMail\bin\IMApp.exe C:\Program Files\Logitech\QuickCam10\COCIManager.exe C:\Documents and Settings\Sébastien\Application Data\m\flec006.exe C:\WINDOWS\system32\wintems.exe C:\PROGRA~1\CAERE\OMNIPA~1\OPWARE16.EXE C:\WINDOWS\SYSTEM32\WOWEXEC.EXE \\\\\\\\\ [ Processus infectieux stoppés ] /////////////////// "C:\Documents and Settings\Sébastien\Application Data\drivers\winupgro.exe" (2608) "C:\Documents and Settings\Sébastien\Application Data\m\flec006.exe" (3896) "C:\WINDOWS\system32\wintems.exe" (1684) \\\\\\\\\ [ Fichiers/Dossiers infectieux ] /////////////////// ################## [ C:\ ] ################## [ C:\WINDOWS ] ################## [ C:\WINDOWS\Prefetch ] Found ! - C:\WINDOWS\prefetch\2279375.EXE-1C9A620B.pf Found ! - C:\WINDOWS\prefetch\2327531.EXE-00044919.pf Found ! - C:\WINDOWS\prefetch\2765953.EXE-31F209BB.pf Found ! - C:\WINDOWS\prefetch\2932656.EXE-08958CC9.pf Found ! - C:\WINDOWS\prefetch\2974812.EXE-058985D9.pf Found ! - C:\WINDOWS\prefetch\FLEC006.EXE-16A4187A.pf Found ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf ################## [ C:\WINDOWS\system32 ] Found ! [19/01/2009 11:54] - C:\WINDOWS\system32\a.bat Found ! [19/01/2009 17:26] - C:\WINDOWS\system32\mdelk.exe Found ! [19/01/2009 17:26] - C:\WINDOWS\system32\wintems.exe Found ! [19/01/2009 11:54] - C:\WINDOWS\system32\winupgro.exe Found ! [19/01/2009 17:26] - C:\WINDOWS\system32\ban_list.txt ################## [ C:\WINDOWS\system32\drivers ] ################## [ C:\Documents and Settings\S‚bastien\Application Data ] Found ! [19/01/2009 17:22] - "C:\Documents and Settings\S‚bastien\Application Data\m\flec006.exe" Found ! [19/01/2009 17:23] - "C:\Documents and Settings\S‚bastien\Application Data\m\list.oct" Found ! [19/01/2009 17:23] - "C:\Documents and Settings\S‚bastien\Application Data\m\data.oct" Found ! [19/01/2009 17:24] - "C:\Documents and Settings\S‚bastien\Application Data\m\srvlist.oct" Found ! [19/01/2009 17:25] - "C:\Documents and Settings\S‚bastien\Application Data\m\shared" Found ! [18/01/2009 22:06] - "C:\Documents and Settings\S‚bastien\Application Data\m" Found ! [18/01/2009 20:36] - "C:\Documents and Settings\S‚bastien\Application Data\drivers" Found ! [19/01/2009 17:14] - "C:\Documents and Settings\S‚bastien\Application Data\drivers\srosa2.sys" Found ! [19/01/2009 17:14] - "C:\Documents and Settings\S‚bastien\Application Data\drivers\wfsintwq.sys" Found ! [10/05/2006 09:10] - "C:\Documents and Settings\S‚bastien\Application Data\drivers\winupgro.exe" Found ! [19/01/2009 17:26] - "C:\Documents and Settings\S‚bastien\Application Data\drivers\downld" ################## [ C:\DOCUME~1\SBASTI~1\LOCALS~1\Temp ] Found ! - C:\DOCUME~1\SBASTI~1\LOCALS~1\Temp\IncrediMail\IMInstall\Contents\Sound chaikovsky_the_nutcracker.imw \\\\\\\\\ [ Registre / Startup ] /////////////////// [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion un] CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe IncrediMail=C:\Program Files\IncrediMail\bin\IncMail.exe /c MsnMsgr=~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background Magentic=C:\PROGRA~1\Magentic\bin\Magentic.exe /c YSearchProtection=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe LDM=C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe Picasa Media Detector=C:\Program Files\Picasa2\PicasaMediaDetector.exe H/PC Connection Agent="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" SpybotSD TeaTimer=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion un] EPSON Stylus C86 Series=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0R2.EXE /P23 "EPSON Stylus C86 Series" /O5 "LPT1:" /M "Stylus C86" YSearchProtection="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" SoundMan=SOUNDMAN.EXE NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup nwiz=nwiz.exe /install LogitechCommunicationsManager="C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe" LogitechQuickCamRibbon="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide LVCOMSX="C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe" OmniPage=C:\Program Files\Caere\OmniPagePro90\opware32.exe NeroFilterCheck=C:\WINDOWS\system32\NeroCheck.exe Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" SweetIM=C:\Program Files\SweetIM\Messenger\SweetIM.exe QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime ArcSoft Connection Service=C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe" EoEngine= SoftwareHelper=C:\Documents and Settings\Sébastien\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents= = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\IMAIL= Installed=1 = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\MAPI= NoChange=1 Installed=1 = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\MSFS= Installed=1 = [HKEY_CURRENT_USER\software\local appwizard-generated applications\AOM] [HKEY_CURRENT_USER\software\local appwizard-generated applications\ESApp] [HKEY_CURRENT_USER\software\local appwizard-generated applications\install] [HKEY_CURRENT_USER\software\local appwizard-generated applications\msnmsgr] [HKEY_CURRENT_USER\software\local appwizard-generated applications\winupgro] \\\\\\\\\ [ Registre / Clés infectieuses ] /////////////////// Found ! - HKEY_USERS\S-1-5-21-583907252-746137067-839522115-1004\Software\Local AppWizard-Generated Applications\msnmsgr Found ! - HKEY_USERS\S-1-5-21-583907252-746137067-839522115-1004\Software\Local AppWizard-Generated Applications\winupgro Found ! - HKEY_USERS\S-1-5-21-583907252-746137067-839522115-1004\Software\bisoft Found ! - HKEY_USERS\S-1-5-21-583907252-746137067-839522115-1004\Software\DateTime4 Found ! - HKEY_USERS\S-1-5-21-583907252-746137067-839522115-1004\Software\FFC Found ! - HKEY_USERS\S-1-5-21-583907252-746137067-839522115-1004\Software\FirtR Found ! - HKEY_USERS\S-1-5-21-583907252-746137067-839522115-1004\Software\MuleAppData Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\msnmsgr Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sK9Ou0s Found ! - HKEY_CURRENT_USER\Software\bisoft Found ! - HKEY_CURRENT_USER\Software\DateTime4 Found ! - HKEY_CURRENT_USER\Software\FirtR Found ! - [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] | drvsyskit Found ! - [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] | german.exe Found ! - [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] | mule_st_key /!\ Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1 /!\ Infection active : HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1 \\\\\\\\\ [ Etat / Services ] /////////////////// # Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /!\ Mode sans echec non fonctionnel !! # Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal /!\ Mode sans echec non fonctionnel !! # Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network /!\ Mode sans echec non fonctionnel !! # Services : [ Auto=2 / Demande=3 / Désactivé=4 ] /!\ Ndisuio - # Type de démarrage = 4 EapHost - # Type de démarrage = 3 /!\ Ip6Fw - # Type de démarrage = 4 /!\ SharedAccess - # Type de démarrage = 4 /!\ wuauserv - # Type de démarrage = 4 /!\ wscsvc - # Type de démarrage = 4 \\\\\\\\\ [ Recherche dans supports amovibles] /////////////////// # Informations : C: - Lecteur fixe # presence des fichiers : \\\\\\\\\ [ Registre / Mountpoint2 ] /////////////////// -> Not found ! ################## [ ! Fin du rapport # FindyKill V4.714 ! ]

toptitbal · Answer

Important : 
Branche toutes tes unités externes au PC ( DD externes , clé USB , lecteur mp3, ect...) mais sans les ouvrir ! 
Tu les retireras après la manipe ... 


Ferme toutes les applications en cours ! 

Relance FindyKill : 

-> choisis cette fois-ci l'option 2 (suppression). 

/!\ ton PC va redémarrer de lui même , c'est normal !... Laisse travailler l'outil jusqu' à l'apparition du message : 
"nettoyage terminé" . 

Note : lors du message d'avertissement , cliques sur " Ok " . 

--> Poste le nouveau rapport FindyKill.txt qui est généré.

( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt ) 


PS : Si le Bureau ne réapparaît pas, presse Ctrl + Alt + Suppr , Onglet "Fichier"-> "Nouvelle tâche": 
tapes explorer.exe et valide .

babass61 · Answer

ok c'est en cours...je suis en parallele sur un autre pc au cas ou  merci
mon pc viens de ce rallumer sur la page d'accueuil , je ne touche a rien ?

toptitbal · Answer

Tu attends le message : "nettoyage terminé"

babass61 · Answer

cela fait 20mn que j'ai lancé le programme findykill, est-ce normal que ce soit aussi long j'ai laissé l'ordinateur ce rallumer et je n'ai toucher à rien il n'y a rien qui me dit que findykill est au boulot. c'est normal ?

Utilisateur anonyme · Answer

Salut ,

je vais prendre la suite si toptip veux bien .

tu peux refaire l option 2 stp et dis moi si tu tombes sur ecran "searching for over infections"

babass61 · Answer

alors, je suis allé sur ma page principale(bureau ) et il ya un encadré rouge ou c'est inscrit:
deleting files and folders
cleaning temps files

Utilisateur anonyme · Answer

oki 

donc là tu es temp files ..

Utilisateur anonyme · Answer

TU AS fermé la fenetre rouge ??

babass61 · Answer

alors ça ce complique
il y a eu la fenetre nettoyage du disque et la il me marque:
exception processing message c0000013 PARAMETERS 75afbf7c 4 75 afbf7c 75afbf7c
puis annuler    recommencer   continuer

Utilisateur anonyme · Answer

oki 

fais continuer stp 

ensuite tu verras "searching for over infection" "please wait"

ton bureu réappariatra et attend "clening complete"

babass61 · Answer

je viens de cliquer sur la fenetre windows"pas de disque" sur continuer et le meme message appaarait
a l'arriere la fenetre de findykill rouge il y a bien le message searching for other infections

Utilisateur anonyme · Answer

clic ok sur le message autant de fois que necessiare 

apres laisse la recherche se faire et poste le rapport au message "cleaning complete"

babass61 · Answer

ok c'est reparti il me dis d'attendre entre 10 et 15 mn
une fenetre d'alerte c'est ouverte comme quoi : il se peut que votre ordinateur coure un risque

babass61 · Answer

###################### [ FindyKill V4.714 ]

# User : S‚bastien - CHAMBRE
# Executed from : C:\Program Files\FindyKill
# Update on 19/01/09 by Chiquitine29
# Start at 18:24:05 the 19/01/2009
# Windows XP - Internet Explorer 7.0.5730.13
 
# [ FindyKill V4.714 - Deleting ] ############### 
 
\\\\\\\\\  [ Active Processes ]  ///////////////////  
 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
 
\\\\\\\\\  [ Infected Files / Folders ]  ///////////////////  
 
 
################## [ C:\ ] 
 
 
################## [ C:\WINDOWS ] 
 
 
################## [ C:\WINDOWS\Prefetch ] 
 
Deleted ! - C:\WINDOWS\prefetch\2279375.EXE-1C9A620B.pf 
Deleted ! - C:\WINDOWS\prefetch\2327531.EXE-00044919.pf 
Deleted ! - C:\WINDOWS\prefetch\2765953.EXE-31F209BB.pf 
Deleted ! - C:\WINDOWS\prefetch\2932656.EXE-08958CC9.pf 
Deleted ! - C:\WINDOWS\prefetch\2974812.EXE-058985D9.pf 
Deleted ! - C:\WINDOWS\prefetch\FLEC006.EXE-16A4187A.pf 
Deleted ! - C:\WINDOWS\prefetch\MDELK.EXE-1D176F91.pf 
Deleted ! - C:\WINDOWS\prefetch\MDELK.EXE-238AA5EF.pf 
Deleted ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf 
 
################## [ C:\WINDOWS\system32 ] 
 
Deleted ! - C:\WINDOWS\system32\a.bat  
Deleted ! - C:\WINDOWS\system32\mdelk.exe  
Deleted ! - C:\WINDOWS\system32\wintems.exe  
Deleted ! - C:\WINDOWS\system32\winupgro.exe  
Deleted ! - C:\WINDOWS\system32\ban_list.txt  
 
################## [ C:\WINDOWS\system32\drivers ] 
 
 
################## [ C:\Documents and Settings\S‚bastien\Application Data ] 
 
Deleted ! - "C:\Documents and Settings\S‚bastien\Application Data\m\flec006.exe"  
Deleted ! - "C:\Documents and Settings\S‚bastien\Application Data\m\list.oct"  
Deleted ! - "C:\Documents and Settings\S‚bastien\Application Data\m\data.oct"  
Deleted ! - "C:\Documents and Settings\S‚bastien\Application Data\m\srvlist.oct"  
Deleted ! - "C:\Documents and Settings\S‚bastien\Application Data\m\shared"  
Deleted ! - "C:\Documents and Settings\S‚bastien\Application Data\m"  
Deleted ! - "C:\Documents and Settings\S‚bastien\Application Data\drivers\srosa2.sys"  
Deleted ! - "C:\Documents and Settings\S‚bastien\Application Data\drivers\wfsintwq.sys"  
Deleted ! - "C:\Documents and Settings\S‚bastien\Application Data\drivers\winupgro.exe"  
Deleted ! - "C:\Documents and Settings\S‚bastien\Application Data\drivers\downld"  
Deleted ! - "C:\Documents and Settings\S‚bastien\Application Data\drivers"  
 
################## [ C:\DOCUME~1\SBASTI~1\LOCALS~1\Temp ] 
 
Deleted ! - C:\DOCUME~1\SBASTI~1\LOCALS~1\Temp\IncrediMail\IMInstall\Contents\Sound	chaikovsky_the_nutcracker.imw     
 
################## [ C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5 ] 
 
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\0FYEUY9V\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\0FYEUY9V\b64_2[1].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\0FYEUY9V\b64_2[2].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\0FYEUY9V\b64_2[3].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\0QK9FXO8\b64_2[1].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\3SPLNVWE\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\3SPLNVWE\b64_1[2].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\3SPLNVWE\b64_2[1].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\3SPLNVWE\b64_2[2].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\3SPLNVWE\b64_5[1].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\657VVPZ4\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\657VVPZ4\b64_1[2].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\657VVPZ4\b64_1[3].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\657VVPZ4\b64_1[4].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\BDFNSG7P\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\LTDW0MLK\b64[3].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\LTDW0MLK\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\LTDW0MLK\b64_1[2].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\LTDW0MLK\b64_1[3].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\LTDW0MLK\b64_1[4].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\LTDW0MLK\b64_1[5].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\LTDW0MLK\file[1].txt    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\TKZ5ROE1\b64[1].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\TKZ5ROE1\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\TKZ5ROE1\b64_1[3].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\TKZ5ROE1\b64_1[4].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\TKZ5ROE1\b64_1[5].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\TKZ5ROE1\b64_2[1].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\TKZ5ROE1\b64_2[2].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\TKZ5ROE1\b64_3[1].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\TKZ5ROE1\b64_3[2].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\WPZ1YTGV\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\WPZ1YTGV\b64_2[1].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\WWVDFDDL\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\WWVDFDDL\b64_1[2].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\WWVDFDDL\b64_2[1].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\WWVDFDDL\b64_2[2].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\WWVDFDDL\b64_2[3].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\WWVDFDDL\b64_2[4].jpg    
Deleted ! - C:\Documents and Settings\S‚bastien\Local Settings\Temporary Internet Files\Content.IE5\WWVDFDDL\b64_3[1].jpg    
 
\\\\\\\\\  [  Registry / Infected keys ]  ///////////////////  
 
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA   
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S   
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S   
Deleted ! - HKEY_CURRENT_USER\Software\bisoft   
Deleted ! - HKEY_CURRENT_USER\Software\DateTime4   
Deleted ! - HKEY_CURRENT_USER\Software\FirtR   
Deleted ! - HKEY_USERS\S-1-5-21-583907252-746137067-839522115-1004\Software\Local AppWizard-Generated Applications\msnmsgr   
Deleted ! - HKEY_USERS\S-1-5-21-583907252-746137067-839522115-1004\Software\Local AppWizard-Generated Applications\winupgro   
Deleted ! - HKEY_USERS\S-1-5-21-583907252-746137067-839522115-1004\Software\FFC   
Deleted ! - HKEY_USERS\S-1-5-21-583907252-746137067-839522115-1004\Software\MuleAppData   
 
\\\\\\\\\  [ States / Restarting of services ]  ///////////////////  
 
# Safe boot mode restored ! 

# Services : [ Auto=2 / Request=3 / Disable=4 ] 

Ndisuio - # Type of startup  = 3 
 
EapHost - # Type of startup  = 2 
 
Ip6Fw - # Type of startup  = 2 
 
SharedAccess - # Type of startup  = 2 
 
wuauserv - # Type of startup  = 2 
 
wscsvc - # Type of startup  = 2 
 
 
\\\\\\\\\  [ Cleaning Removable drives ]  ///////////////////  
 
# Informations : 

C: - Lecteur fixe

M: - Lecteur fixe

 
# deleting files : 
 
 
\\\\\\\\\  [ Registry / Mountpoint2 ]  ///////////////////  
 
 
 -> Not found ! 
 
 
\\\\\\\\\  [ Searching Other Infections ]  ///////////////////  
 
Références de comparaison Bagle MD5 :

2144df1c C:\Documents and Settings\S‚bastien\Application Data\drivers\winupgro.exe 
895c7dd60d43bc828d2355a956d9db27 C:\Documents and Settings\S‚bastien\Application Data\drivers\winupgro.exe 

Suspect ! - 895c7dd60d43bc828d2355a956d9db27  C:\Program Files\Windows Live\Messenger\msnmsgr.exe  
 
\\\\\\\\\  [ Searching Cracks / Keygen ]  ///////////////////  
 
C:\Documents and Settings\All Users\Application Data\IncrediMail\Data\Sound	chaikovsky_the_nutcracker.imw
 
################## [ ! End of report # FindyKill V4.714 ! ]

Utilisateur anonyme · Answer

oki bien joué ,


---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau : 
http://oldtimer.geekstogo.com/OTMoveIt3.exe 

---> Double-clique sur OTMoveIt3.exe afin de le lancer. 

---> Copie (Ctrl+C) le texte suivant ci-dessous : 





:processes 
explorer.exe 

:files 
C:\Program Files\Windows Live\Messenger\msnmsgr.exe 

:commands 
[emptytemp] 
[start explorer] 



---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3. 

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\ 
Le nom du rapport correspond au moment de sa création : date_heure.log

babass61 · Answer

ok, j'ai effectué l'installation et ile copier coller il m'a eteind et rallumé le pc

babass61 · Answer

========= PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
C:\Program Files\Windows Live\Messenger\msnmsgr.exe moved successfully.
========== COMMANDS ==========
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_63c.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01192009_185037

Files moved on Reboot...
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS	emp\Perflib_Perfdata_63c.dat not found!

Utilisateur anonyme · Answer

va dans panneau de configuration 

et désinstal messenger car infecté 

ensuite :

Télécharge ToolsCleaner sur ton bureau. 
--> 
http://pc-system.fr/ 
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner

# Clique sur Recherche et laisse le scan agir ... 
# Clique sur Suppression pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

babass61 · Answer

[ Rapport ToolsCleaner version 2.3.0 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\FindyKill.txt: trouvé !
C:\_OtMoveIt: trouvé !
C:\Documents and Settings\Sébastien\Bureau\OTMoveIt3.exe: trouvé !
C:\Documents and Settings\Sébastien\Menu Démarrer\Programmes\FindyKill: trouvé !
C:\Program Files\FindyKill: trouvé !

---------------------------------
-->- Suppression: 

C:\FindyKill.txt: supprimé !
C:\Documents and Settings\Sébastien\Bureau\OTMoveIt3.exe: supprimé !
C:\_OtMoveIt: supprimé !
C:\Documents and Settings\Sébastien\Menu Démarrer\Programmes\FindyKill: supprimé !
C:\Program Files\FindyKill: supprimé !

Utilisateur anonyme · Answer

oki 

on continue :


Télécharge Ad-remover ( de C_XX ) sur ton bureau ( et pas ailleurs!) : 

http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe

! Déconnecte toi et ferme toutes applications en cours ! 

* Clique sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installe par défaut . 
* Double-clique sur le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil . 
* Au menu principal choisis l'option "A" et tape sur [entrée] . 

Laisse travailler l'outil et ne touche à rien ... 

--> Poste le rapport qui apparait à la fin . 

( le rapport est sauvegardé aussi sous C:\Ad-report.log ) 

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

babass61 · Answer

ok c'est parti le petit singe est au boulot !

Utilisateur anonyme · Answer

-;)

babass61 · Answer

LOGFILE OF AD-REMOVER 1.0.9.3 | ONLY XP/VISTA -------

Updated by C_XX on 17/01/2009 at 12:00

Start at: 19:07:03 | Lun 19/01/2009 | Microsoft® Windows XP™  SP3 (V5.1.2600)
Boot mode: Normal
Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Pc: CHAMBRE | User: S‚bastien ( Current user is an administrator)
Drive(s): 
- C:\  (File System: NTFS)
- M:\  (File System: FAT32)
System Drive: C:\
Windows Directory: C:\WINDOWS\
System Directory: C:\WINDOWS\System32\

--- Running Processes: 50

+--------------------| Boonty/Boonty Games Elements Found :

.
.

+--------------------| Eorezo Elements Found :

Process: "SOFTWAREUPDATEHP.EXE" [PID:~2968]
.
HKCU\SOFTWARE\EoRezo
HKLM\SOFTWARE\EoRezo
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\EOENGINE
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\SOFTWAREHELPER
.
C:\Documents and Settings\S‚bastien\Application Data\EoRezo
C:\Documents and Settings\S‚bastien\Application Data\EoRezo\cache
C:\Documents and Settings\S‚bastien\Application Data\EoRezo\cmhost.cyp
C:\Documents and Settings\S‚bastien\Application Data\EoRezo\ConfMedia.cyp
C:\Documents and Settings\S‚bastien\Application Data\EoRezo\db
C:\Documents and Settings\S‚bastien\Application Data\EoRezo\eoDesktop
C:\Documents and Settings\S‚bastien\Application Data\EoRezo\eoStats
C:\Documents and Settings\S‚bastien\Application Data\EoRezo\host.cyp
C:\Documents and Settings\S‚bastien\Application Data\EoRezo\SoftwareUpdate
C:\Documents and Settings\S‚bastien\Application Data\EoRezo\user.cyp
C:\Documents and Settings\S‚bastien\Application Data\EoRezo\db\cat.cyp
C:\Documents and Settings\S‚bastien\Application Data\EoRezo\eoDesktop\config.xml
C:\Documents and Settings\S‚bastien\Application Data\EoRezo\eoDesktop\eoDesktop.html
C:\Documents and Settings\S‚bastien\Application Data\EoRezo\eoDesktop\userConfig.xml
C:\Documents and Settings\S‚bastien\Application Data\EoRezo\eoStats\eoStats.txt
C:\Documents and Settings\S‚bastien\Application Data\EoRezo\SoftwareUpdate\SoftwareUpdate.exe
C:\Documents and Settings\S‚bastien\Application Data\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
C:\Documents and Settings\S‚bastien\Application Data\EoRezo\SoftwareUpdate\unins000.dat
C:\Documents and Settings\S‚bastien\Application Data\EoRezo\SoftwareUpdate\unins000.exe
C:\Documents and Settings\S‚bastien\Application Data\EoRezo\SoftwareUpdate\user_config.cyp
C:\Documents and Settings\S‚bastien\Application Data\EoRezo\SoftwareUpdate\user_profil.cyp
C:\Documents and Settings\S‚bastien\Cookies\s‚bastien@eorezo[1].txt

+--------------------| Everest Casino/Everest Poker Elements Found :

.
.

+--------------------| Funwebproducts/Myway/Mywebsearch/Myglobalsearch Elements Found :

.
.

+--------------------| It's TV Elements Found :

.

+--------------------| Sweetim Elements Found :

Process: "SWEETIM.EXE" [PID:~2740]
.
HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCR\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0
HKCR\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
HKCR\SWEETIE.IEToolbar
HKCR\SWEETIE.IEToolbar.1
HKCR\SWEETIE.SWEETIE
HKCR\SWEETIE.SWEETIE.3
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKCR\Toolbar3.SWEETIE
HKCR\Toolbar3.SWEETIE.1
HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}
HKCR\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}
HKCR\MgMediaPlayer.GifAnimator
HKCR\MgMediaPlayer.GifAnimator.1
HKCU\SOFTWARE\SweetIM
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
HKLM\SOFTWARE\SweetIM
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\SWEETIM
HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\02F47BF73B948514FAACADD8CBBDF37D
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\080D9F5E1E95FEE4794CE438E635239E
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\1E264E0A5959A1C46BA9175A878B12EA
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\2E6768B6932D112438F047C54D180635
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\351716A953E21214898904032EAE2E81
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\397C771A7BCAC904697C3EC629ED33ED
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\98CC8BF5A4A6E6C4ABF7051DDAB8B058
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\A189D17A469616C4688D23E192996267
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\D15DAF33C220F91468A1D7D57C31ACD7
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\D3BA76A44C779424889063D5098ED2D6
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\D6D0EB9FDBD90C04D92A7E729058F10D
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\E4748F9A4181FCE46A23C13B517B9420
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\07D5290CDBDAE4242926B8E6CA650501
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\08E33F7B61DEFF24BB9673ED7D467636
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\0E3D8A5B48622A445A7DF73FEFF32C3F
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\1AC67655DD68F8240B2860F2D511EBD8
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\46A5861A389ADB844AF89E31BC9DF0A1
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\34EDDB1BFB3A2D448845F3EFD0F15A43
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\4318DF19719275242801CBE292063A4C
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\45FC115D1FEAEF849A4E1610D6EC8BF0
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\49B0E1A6FF50BBE4289E4E23DE6EA0C7
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\4CCCAC049F34D0540AAC13011398BEDB
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\5C4389D0BFB302C479DE4178BD5D9EBA
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\5D19F074C042AD34BAB463D4175A062E
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\5D2B09BDEF4FE54418E6F3373CDBC7AC
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\61B65D3397A1FBF4CB1571B5E4F6B5B0
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\68E8A05C60DD9254591DBD16C94EDDBF
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\697E782CF574CC34CBB9566440BA12BC
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\6AE27A8613CF7EA4782F2886F67295E5
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\7CE172051F585E04187BCB97570BFA74
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\86A901BA5265452499DCBF719C378EE3
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\88ABD1CD5C40EC84789A7F6EF86DAC5E
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\980289C22F80A7C4BB9323DC61255E4E
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\9A4B7EF3789F871419D9302583B20C15
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\A6C53B0F76C44004A8F36716213017DB
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\B59F2D8189784CC46A4597F2842480B0
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\BD746FB95FB8E5B45BF66BE54D5FD91F
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\CCF399FCD6D2D3F46BF02A1378654FC9
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\D149C1355C98DE24E82CEFBD996FE06A
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\DB59FDB786388EA4D897F3EE715683AC
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\DB8DAD19CFBCC2049A4477183787E8C5
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\E337925F629CF4C4FB08F3D9674DD839
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\EC65F200D112357449C8B1BC3CFA03D0
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\F327D0C73C0973644A21E8CC852267A0
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\FA96423FE2B98E248A3B23548D1E22D9
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\0FF2AEFF45EEA0A48A4B33C1973B6094
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\305B09CE8C53A214DB58887F62F25536
.
C:\WINDOWS\INSTALLER\ce73aa.msi
C:\WINDOWS\INSTALLER\ce73af.msi
C:\Program Files\SweetIM
C:\Program Files\SweetIM\Messenger
C:\Program Files\SweetIM\Toolbars
C:\Program Files\SweetIM\Messenger\default.xml
C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll
C:\Program Files\SweetIM\Messenger\mgAIMAuto.dll
C:\Program Files\SweetIM\Messenger\mgAIMMessengerAdapter.dll
C:\Program Files\SweetIM\Messenger\mgArchive.dll
C:\Program Files\SweetIM\Messenger\mgcommon.dll
C:\Program Files\SweetIM\Messenger\mgcommunication.dll
C:\Program Files\SweetIM\Messenger\mgconfig.dll
C:\Program Files\SweetIM\Messenger\mgFlashPlayer.dll
C:\Program Files\SweetIM\Messenger\mghooking.dll
C:\Program Files\SweetIM\Messenger\mgIEPlayer.dll
C:\Program Files\SweetIM\Messenger\mglogger.dll
C:\Program Files\SweetIM\Messenger\mgMediaPlayer.dll
C:\Program Files\SweetIM\Messenger\mgMsnAuto.dll
C:\Program Files\SweetIM\Messenger\mgMsnMessengerAdapter.dll
C:\Program Files\SweetIM\Messenger\mgsimcommon.dll
C:\Program Files\SweetIM\Messenger\mgSweetIM.dll
C:\Program Files\SweetIM\Messenger\mgUpdateSupport.dll
C:\Program Files\SweetIM\Messenger\mgxml_wrapper.dll
C:\Program Files\SweetIM\Messenger\mgYahooAuto.dll
C:\Program Files\SweetIM\Messenger\mgYahooMessengerAdapter.dll
C:\Program Files\SweetIM\Messenger\msvcp71.dll
C:\Program Files\SweetIM\Messenger\msvcr71.dll
C:\Program Files\SweetIM\Messengeresources
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\SweetIM\Messengeresources\images
C:\Program Files\SweetIM\Messengeresources\images\AudibleButton.png
C:\Program Files\SweetIM\Messengeresources\images\DisplayPicturesButton.png
C:\Program Files\SweetIM\Messengeresources\images\EmoticonButton.png
C:\Program Files\SweetIM\Messengeresources\images\NudgeButton.png
C:\Program Files\SweetIM\Messengeresources\images\SoundFxButton.png
C:\Program Files\SweetIM\Messengeresources\images\WinksButton.png
C:\Program Files\SweetIM\Toolbars\Internet Explorer
C:\Program Files\SweetIM\Toolbars\Internet Explorer\ClearHist.exe
C:\Program Files\SweetIM\Toolbars\Internet Explorer\conf
C:\Program Files\SweetIM\Toolbars\Internet Explorer\default.xml
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgcommon.dll
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgconfig.dll
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mglogger.dll
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgsimcommon.dll
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgxml_wrapper.dll
C:\Program Files\SweetIM\Toolbars\Internet Explorer\msvcp71.dll
C:\Program Files\SweetIM\Toolbars\Internet Explorer\msvcr71.dll
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources
C:\Program Files\SweetIM\Toolbars\Internet Explorer\conf\logger.xml
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\affid.dat
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\basis.xml
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Bookmarks_23x18.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Email_23x18.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Games_23x18.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Greetingcards_23x18.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Logo.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Mobile_23x18.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Music_23x18.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\News_23x18.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Shoping_23x18.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\SmileySmile.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\SmileyWink.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\sweetimicons.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources	oolbar.xml
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\version.txt
C:\Documents and Settings\All Users\Application Data\SweetIM
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger
C:\Documents and Settings\All Users\Application Data\SweetIM\Toolbars
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\logs
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\update
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\adapter.xml
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\autoupdate.xml
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\logger.xml
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\messages.xml
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\sweetim.xml
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\sweetimapp.xml
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\users
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\users\babass61@ifrance.com
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\users\guilou@live.fr
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\users\lachieusedamour@hotmail.fr
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\users\main_user_config.xml
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\users\babass61@ifrance.com\emoticons_shortcut.xml
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\users\babass61@ifrance.com\user_config.xml
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\users\guilou@live.fr\emoticons_shortcut.xml
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\users\guilou@live.fr\lastuse_Audibles.xml
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\users\guilou@live.fr\lastuse_Emoticons.xml
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\users\guilou@live.fr\lastuse_SpecialFX.xml
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\users\guilou@live.fr\lastuse_Winks.xml
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\users\guilou@live.fr\user_config.xml
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\users\lachieusedamour@hotmail.fr\emoticons_shortcut.xml
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\users\lachieusedamour@hotmail.fr\user_config.xml
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000100FD.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00010104.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0001010A.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0001011E.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00010819.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00010869.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00010893.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00010896.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0001089A.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0001089B.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000108A0.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000108C2.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00010911.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0001092C.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00010934.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00010949.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0001094E.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00010954.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0001095A.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0002006A.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0002006E.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020073.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020075.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020079.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000200BE.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000200C0.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000200D0.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000200D5.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000200DA.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020112.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0002011D.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0002011E.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0002013F.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020149.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020153.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020158.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000201A9.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000201AD.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000201CC.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000201DC.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000201E4.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000201F5.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000201F6.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000201FC.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020201.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020212.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020218.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020226.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0002022B.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0002022C.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0002022E.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020230.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020239.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020241.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020263.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020285.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020294.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000202BA.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000202ED.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000202F3.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020309.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020318.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020321.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0002032D.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020337.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00020344.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0002034D.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00030099.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000300AC.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000300B5.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000300BF.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000300C2.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000300CB.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000400C4.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00050005.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0006006F.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000601A7.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000601EB.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00060225.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0006022F.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00060232.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0006023E.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\000602A8.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0008000B.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00080011.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00080014.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00080017.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0008001A.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00080020.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00080024.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00080025.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00080029.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00080037.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00080042.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0008004D.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0008004F.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00080051.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00080052.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00080056.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0008005C.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0008005F.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\00080068.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\0008008D.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\02050002.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb\cache_indx.dat
C:\Documents and Settings\All Users\Application Data\SweetIM\Toolbars\Internet Explorer
C:\Documents and Settings\All Users\Application Data\SweetIM\Toolbars\Internet Explorer\cache
C:\Documents and Settings\All Users\Application Data\SweetIM\Toolbars\Internet Explorer\cache\f64a71f602d078aa84829e36b8992194.toolbar31.xml

+--------------------| Added Scan :

~~~~ INTERNET EXPLORER VERSION 7.0.5730.13 ~~~~

+--[HKEY_CURRENT_USER\..\INTERNET EXPLORER\MAIN]

Start page : hxxp://fr.yahoo.com/

+--[HKEY_LOCAL_MACHINE\..\INTERNET EXPLORER\MAIN]

Start page : hxxp://go.microsoft.com/fwlink/?LinkId=69157

+---------------------------------------------------------------------------+

[~26280 BYTES] - "C:\AD-REPORT-SCAN-19.01.2009.LOG"

End at: 19:07:37 | 19/01/2009 - Time elapsed: 34.1 seconds 

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 349 Lines ]
+---------------------------------------------------------------------------+

Utilisateur anonyme · Answer

au boulot le petit singe :

Nettoyage AD-Remover : 

! Déconnecte toi et ferme toutes application en cours ( navigarteur compris ) ! 

* Relance "Ad-remover" : au menu principal choisis l'option "B" . 

* A l'écran de sélection ( écran ) : 

> choisis le(s) chiffre(s) suivant pour nettoyer les traces de : 

2 - "Eorezo" puis [entrée] 
6 - "Sweetim" puis [entrée] 

Une fois la sélection faite, tape S puis [entrée] pour lancer la suppression . 

--> le programme va travailler , ne touche à rien ... 


* Poste le rapport qui apparait à la fin 

( le rapport est sauvegardé aussi sous C:\Ad-report.log ) 

/!\ Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tape explorer.exe et valide ) /!\

babass61 · Answer

ok c'est fait mais rien n'apparait sur l'ecran cela doit travailler en sous marin je suppose

Utilisateur anonyme · Answer

non ,

tu dois avoir une fenetre ad remover qui t indique le taff en cours

babass61 · Answer

non je n'ai rien je recommence la manipe ?

Utilisateur anonyme · Answer

stp ,

si pas ok on fera autrement

babass61 · Answer

autant pour moi je n'avais pas fait entré après avoir taper les chiffres: ça  marche

Utilisateur anonyme · Answer

-;) pas de soucis

babass61 · Answer

------- LOGFILE OF AD-REMOVER 1.0.9.3 | ONLY XP/VISTA -------

Updated by C_XX on 17/01/2009 at 12:00

*** LIMITED TO ***

Eorezo
Sweetim

******************

Start at: 19:27:22 | Lun 19/01/2009 | Microsoft® Windows XP™  SP3 (V5.1.2600)
Boot mode: Normal
Option: CLEAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Pc: CHAMBRE | User: S‚bastien ( Current user is an administrator)
Drive(s): 
- C:\  (File System: NTFS)
- M:\  (File System: FAT32)
System Drive: C:\
Windows Directory: C:\WINDOWS\
System Directory: C:\WINDOWS\System32\

--- Running Processes: 49

(!) ---- IE start pages reset

+--------------------| Eorezo Elements Deleted :

Process: "SOFTWAREUPDATEHP.EXE" [PID:~2968]
.
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\EOENGINE
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\SOFTWAREHELPER
HKCU\SOFTWARE\EoRezo
HKLM\SOFTWARE\EoRezo
.
C:\Documents and Settings\S‚bastien\Application Data\EoRezo
C:\Documents and Settings\S‚bastien\Cookies\s‚bastien@eorezo[1].txt

+--------------------| Sweetim Elements Deleted :

Process: "SWEETIM.EXE" [PID:~2740]
.
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\SWEETIM
HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\02F47BF73B948514FAACADD8CBBDF37D
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\080D9F5E1E95FEE4794CE438E635239E
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\1E264E0A5959A1C46BA9175A878B12EA
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\2E6768B6932D112438F047C54D180635
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\351716A953E21214898904032EAE2E81
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\397C771A7BCAC904697C3EC629ED33ED
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\98CC8BF5A4A6E6C4ABF7051DDAB8B058
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\A189D17A469616C4688D23E192996267
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\D15DAF33C220F91468A1D7D57C31ACD7
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\D3BA76A44C779424889063D5098ED2D6
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\D6D0EB9FDBD90C04D92A7E729058F10D
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\E4748F9A4181FCE46A23C13B517B9420
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\07D5290CDBDAE4242926B8E6CA650501
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\08E33F7B61DEFF24BB9673ED7D467636
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\0E3D8A5B48622A445A7DF73FEFF32C3F
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\1AC67655DD68F8240B2860F2D511EBD8
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\46A5861A389ADB844AF89E31BC9DF0A1
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\34EDDB1BFB3A2D448845F3EFD0F15A43
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\4318DF19719275242801CBE292063A4C
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\45FC115D1FEAEF849A4E1610D6EC8BF0
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\49B0E1A6FF50BBE4289E4E23DE6EA0C7
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\4CCCAC049F34D0540AAC13011398BEDB
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\5C4389D0BFB302C479DE4178BD5D9EBA
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\5D19F074C042AD34BAB463D4175A062E
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\5D2B09BDEF4FE54418E6F3373CDBC7AC
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\61B65D3397A1FBF4CB1571B5E4F6B5B0
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\68E8A05C60DD9254591DBD16C94EDDBF
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\697E782CF574CC34CBB9566440BA12BC
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\6AE27A8613CF7EA4782F2886F67295E5
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\7CE172051F585E04187BCB97570BFA74
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\86A901BA5265452499DCBF719C378EE3
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\88ABD1CD5C40EC84789A7F6EF86DAC5E
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\980289C22F80A7C4BB9323DC61255E4E
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\9A4B7EF3789F871419D9302583B20C15
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\A6C53B0F76C44004A8F36716213017DB
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\B59F2D8189784CC46A4597F2842480B0
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\BD746FB95FB8E5B45BF66BE54D5FD91F
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\CCF399FCD6D2D3F46BF02A1378654FC9
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\D149C1355C98DE24E82CEFBD996FE06A
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\DB59FDB786388EA4D897F3EE715683AC
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\DB8DAD19CFBCC2049A4477183787E8C5
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\E337925F629CF4C4FB08F3D9674DD839
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\EC65F200D112357449C8B1BC3CFA03D0
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\F327D0C73C0973644A21E8CC852267A0
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\FA96423FE2B98E248A3B23548D1E22D9
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\0FF2AEFF45EEA0A48A4B33C1973B6094
HKLM\~\USERDATA\S-1-5-18\COMPONENTS\305B09CE8C53A214DB58887F62F25536
HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCR\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0
HKCR\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
HKCR\SWEETIE.IEToolbar
HKCR\SWEETIE.IEToolbar.1
HKCR\SWEETIE.SWEETIE
HKCR\SWEETIE.SWEETIE.3
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKCR\Toolbar3.SWEETIE
HKCR\Toolbar3.SWEETIE.1
HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}
HKCR\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}
HKCR\MgMediaPlayer.GifAnimator
HKCR\MgMediaPlayer.GifAnimator.1
HKCU\SOFTWARE\SweetIM
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
HKLM\SOFTWARE\SweetIM
.
C:\WINDOWS\INSTALLER\ce73aa.msi
C:\WINDOWS\INSTALLER\ce73af.msi
/!\ NOT DELETED - C:\Program Files\SweetIM
/!\ NOT DELETED - C:\Program Files\SweetIM\Messenger 
/!\ NOT DELETED - C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll 
/!\ NOT DELETED - C:\Program Files\SweetIM\Messenger\msvcr71.dll 
C:\Documents and Settings\All Users\Application Data\SweetIM

(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives.


************* /!\ FILE(S)/FOLDER(S) NOT DELETED /!\ *************

"C:\Program Files\SweetIM\Messenger"
"C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll"
"C:\Program Files\SweetIM\Messenger\msvcr71.dll"

SECOND RUN ...

/!\ RESIST ! - "C:\Program Files\SweetIM\Messenger"
/!\ RESIST ! - "C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll"
/!\ RESIST ! - "C:\Program Files\SweetIM\Messenger\msvcr71.dll"


+--------------------| Added Scan :

+---------------------------------------------------------------------------+


~~~~ INTERNET EXPLORER VERSION 7.0.5730.13 ~~~~

+--[HKEY_CURRENT_USER\..\INTERNET EXPLORER\MAIN]

Start page : hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+--[HKEY_LOCAL_MACHINE\..\INTERNET EXPLORER\MAIN]

Start page : hxxp://fr.msn.com/

+---------------------------------------------------------------------------+

[~7521 BYTES] - "C:\AD-REPORT-CLEAN-19.01.2009.LOG"
[~26614 BYTES] - "C:\AD-REPORT-SCAN-19.01.2009.LOG"

End at: 19:28:00 | 19/01/2009 - Time elapsed: 38.5 seconds 

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 135 Lines ]
+---------------------------------------------------------------------------+

Utilisateur anonyme · Answer

ok

désinstal ad remover via le panneau de configuration

on va repasser otmove it :

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau : 
http://oldtimer.geekstogo.com/OTMoveIt3.exe 

---> Double-clique sur OTMoveIt3.exe afin de le lancer. 

---> Copie (Ctrl+C) le texte suivant ci-dessous : 



:processes 
explorer.exe 

:files 
C:\Program Files\SweetIM 

:commands 
[start explorer] 


---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3. 

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\ 
Le nom du rapport correspond au moment de sa création : date_heure.log

babass61 · Answer

========= PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
File/Folder C:\Program Files\SweetIM not found.
========== COMMANDS ==========
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01192009_193928

Utilisateur anonyme · Answer

OK..

Télécharge HijackThis (outils de diagnostic) ici : 

->  Fais un clic droit sur un des liens et choisi enregistrer la cible sous .... le bureau

->  http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe 
->  HijackThis

-> Fais un double-clic sur HJTInstall.exe afin de lancer l'installation 

-> Clique sur Install ensuite sur I Accept 

-> Clique sur Do a scan system and save log file 

-> Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse

babass61 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:44:33, on 19/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0R2.EXE
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe
C:\Program Files\Caere\OmniPagePro90\opware32.exe
C:\WINDOWS\system32
tvdm.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Magentic\bin\MgApp.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\IncrediMail\bin\IMApp.exe
C:\Program Files\Logitech\QuickCam10\COCIManager.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [EPSON Stylus C86 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0R2.EXE /P23 "EPSON Stylus C86 Series" /O5 "LPT1:" /M "Stylus C86"
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe"
O4 - HKLM\..\Run: [OmniPage] C:\Program Files\Caere\OmniPagePro90\opware32.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f012.mail.caramail.lycos.fr/app/uploader/FileUploader.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/activex/zylomloader.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} (Imikimi_activex_plugin Control) - http://imikimi.com/download/imikimi_plugin_0.5.1.cab
O18 - Protocol: bw+0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Documents and Settings\maconfservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O24 - Desktop Component 0: (no name) - http://us.js2.yimg.com/us.yimg.com/i/us/sch/topgrad1.jpg

Utilisateur anonyme · Answer

oki chef ,

désinstal : Desktop Messenger ( ça sert a rien )

réinstal ton antivirus ..

je te conseil Antivir (gratuit ) : 

->Antivir le telecharger

-> http://www.commentcamarche.net/telecharger/telecharger 55 antivir

tuto : https://www.malekal.com/avira-free-security-antivirus-gratuit/
tuto : http://www.swl1f.net/viewtopic.php?f=14&t=59 


verifie spybot , si hs réinstal le 

puis :

Telecharge malwarebytes 
https://www.malwarebytes.com/

Tu l´instale; le programme va se mettre automatiquement a jour. 

Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression". 

Click maintenant sur l´onglet recherche et coche la case : "executer un examen Rapide". 

Puis click sur "rechercher". 

Laisse le scanner le pc... 

Si des elements on ete trouvés > click sur supprimer la selection. 

si il t´es demandé de redemarrer > click sur "yes". 

A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum. 
Copie et colle le rapport stp.

PS : les rapport sont aussi rangé dans l onglet rapport/log

babass61 · Answer

AH ! les yeux d'informaticien ou cienne ! et je le trouve où Desktop Messenger  ?

Utilisateur anonyme · Answer

panneau de configuration `\ ajout et suppresion ..

babass61 · Answer

bah non j'avais un nom comme ça sur le bureau pour mon gps ?? je l'ai virer mais etait ça ??

Utilisateur anonyme · Answer

ok 

laisse et passe a la suite et fais ceci en plus pour ta peine avant le scan malewarebyte :


-> Télécharge Ccleaner (n'installe pas la barre d'outil Yahoo): 


http://download.piriform.com/ccsetup210.exe

https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

-> Tuto : https://www.malekal.com/tutoriel-ccleaner/ (fais registre : corriger les erreures et lancer le nettoyage)

babass61 · Answer

je viens d'installer antivir c'est ok
spybot toujours le message application non valide je l'ai desinstaller
je vais installer malwarebytes

je fais quoi pour spybot ?

Utilisateur anonyme · Answer

spybot toujours le message application non valide je l'ai desinstaller 

ça m étonnes pas ..

je fais quoi pour spybot ?

soit tu le réinstal , soit tu t en passes , perso je l utilise pas ...

babass61 · Answer

pour c cleaner il me demande si il doit reparer les erreurs je suppose que je dois accepter ?

Utilisateur anonyme · Answer

.... oui stp

babass61 · Answer

ok c'est fait je lance le scan avec malwarebytes

babass61 · Answer

Malwarebytes' Anti-Malware 1.33
Version de la base de données: 1668
Windows 5.1.2600 Service Pack 3

19/01/2009 20:27:02
mbam-log-2009-01-19 (20-27-02).txt

Type de recherche: Examen rapide
Eléments examinés: 58063
Temps écoulé: 5 minute(s), 12 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Utilisateur anonyme · Answer

ok 

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau : 
http://oldtimer.geekstogo.com/OTMoveIt3.exe 

---> Double-clique sur OTMoveIt3.exe afin de le lancer. 

---> Copie (Ctrl+C) le texte suivant ci-dessous : 


:files 
C:\Program Files\Logitech\Desktop Messenger


---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3. 

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\ 
Le nom du rapport correspond au moment de sa création : date_heure.log

babass61 · Answer

C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Guilaine\Data\4cb0\Upstream moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Guilaine\Data\4cb0 moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Guilaine\Data\41c2\11e4f6f9 moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Guilaine\Data\41c2 moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Guilaine\Data\41bf\a9a3f17 moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Guilaine\Data\41bf\a9a3ef0 moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Guilaine\Data\41bf\a9a3e54 moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Guilaine\Data\41bf\a9a3e53 moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Guilaine\Data\41bf\a9a3e36 moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Guilaine\Data\41bf moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Guilaine\Data moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Guilaine moved successfully.
Folder move failed. C:\Program Files\Logitech\Desktop Messenger\8876480\Users scheduled to be moved on reboot.
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\Enable_OAS moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\8876480\Sébastien moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\8876480 moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Program moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\GenFlash\1 moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\GenFlash moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program	emp moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUIesources moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\CommStatus moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUIesources moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\Navigation moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\CommStatus moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN moved successfully.
Folder move failed. C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program scheduled to be moved on reboot.
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Plugins moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Install moved successfully.
Folder move failed. C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Logitech\Desktop Messenger\8876480 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Logitech\Desktop Messenger scheduled to be moved on reboot.
 
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01192009_203321

Files moved on Reboot...
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Sébastien\Data moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Sébastien\Misc\Backup moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Sébastien\Misc moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Sébastien moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Users moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480 moved successfully.
C:\Program Files\Logitech\Desktop Messenger moved successfully.

Utilisateur anonyme · Answer

refais un scan hijackthis , post le rapport et on termine

babass61 · Answer

ok par curiosité c'est quoi desktop messenger ?

babass61 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:39:39, on 19/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS
otepad.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0R2.EXE
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\Caere\OmniPagePro90\opware32.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32
tvdm.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Magentic\bin\MgApp.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\IncrediMail\bin\IMApp.exe
C:\PROGRA~1\FICHIE~1\Logitech\LComMgr\COMMUN~1.EXE
C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe
C:\Program Files\Logitech\QuickCam10\COCIManager.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [EPSON Stylus C86 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0R2.EXE /P23 "EPSON Stylus C86 Series" /O5 "LPT1:" /M "Stylus C86"
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [OmniPage] C:\Program Files\Caere\OmniPagePro90\opware32.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\_OTMoveIt\MovedFiles\01192009_203321\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com/...
O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f012.mail.caramail.lycos.fr/app/uploader/FileUploader.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/activex/zylomloader.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} (Imikimi_activex_plugin Control) - http://imikimi.com/download/imikimi_plugin_0.5.1.cab
O18 - Protocol: bw+0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw+0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw-0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw-0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw00 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw00s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw10 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw10s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw20 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw20s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw30 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw30s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw40 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw40s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw50 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw50s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw60 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw60s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw70 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw70s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw80 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw80s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw90 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw90s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwa0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwa0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwb0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwb0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwc0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwc0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwd0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwd0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwe0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwe0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwf0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwf0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwg0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwg0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwh0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwh0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwi0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwi0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwj0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwj0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwk0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwk0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwl0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwl0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwm0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwm0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwn0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwn0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwo0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwo0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwp0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwp0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwq0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwq0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwr0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwr0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bws0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bws0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwt0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwt0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwu0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwu0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwv0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwv0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bww0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bww0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwx0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwx0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwy0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwy0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwz0 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwz0s - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: offline-8876480 - {A2661854-7E8D-4C05-A4CC-FBB6FF7E9114} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Documents and Settings\maconfservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O24 - Desktop Component 0: (no name) - http://us.js2.yimg.com/us.yimg.com/i/us/sch/topgrad1.jpg

Utilisateur anonyme · Answer

ça fé partie de ta webcam , sa supression n empeche pas son utilistation :

http://forum.telecharger.01net.com/forum/high-tech/LOGICIELS/Logiciels-divers/logitec-desktop-messenger-sujet_246051_1.htm

tape : desktop messenger dans google tu y trouveras tout 

passe a hijackthis

Utilisateur anonyme · Answer

ok

réouvre hijackthis
fais scan only

et coches toutes les lignes 016 018 et la 024 

et clic sur fix checked 

ensuite :

Télécharge ToolsCleaner sur ton bureau. 
--> 
http://pc-system.fr/ 
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner

# Clique sur Recherche et laisse le scan agir ... 
# Clique sur Suppression pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). 


puis :


Purge de la restauration système 
*Désactive ta restauration : 
Clique droit sur poste de travail/propriétés/Restauration système/coche la case désactiver la restauration, appliquer, OK 
---> Redémarre ton PC ... 

*Réactive ta restauration : 
Clique droit sur poste de travail/propriétés/Restauration système/décoche la case désactiver la restauration, appliquer, OK 
--->Redémarre ton PC ... 

( Note : tu peux aussi y accéder via panneau de configuration->" système "->" restauration système " ). 



Tuto xp : http://service1.symantec.com/support/inter/tsgeninfointl.Nsf/fr_docid/20020830101856924


ensuite je te conseil un scan antivir

babass61 · Answer

ok j'irai voir.... j'ai posté le rapport du dernier scan

Utilisateur anonyme · Answer

Oué , vu :

http://www.commentcamarche.net/forum/affich 10584058 bagle et plus d anti virus?page=3#58

babass61 · Answer

j'ai effectué hitjackthis sans soucis
par ailleurs je n'arrive pas a rechercher sur  tools cleaaner le programme ne répond pas

Utilisateur anonyme · Answer

recommence toolcleaner stp sans utiliser le pc

babass61 · Answer

je n'utilise pas le pc quand je reponds entre 2 operations je suis sur le pc portable 
le pc de bureau est celui qui est infecté.


[ Rapport ToolsCleaner version 2.3.0 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\_OtMoveIt: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\Sébastien\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Sébastien\Bureau\HJTInstall.exe: trouvé !
C:\Documents and Settings\Sébastien\Bureau\OTMoveIt3.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !

Utilisateur anonyme · Answer

oki 

désinstal hijackthis ou vire ce dossier : C:\Program Files\Trend Micro

t en es ou  ?

babass61 · Answer

ok j'ai desinstaller

Utilisateur anonyme · Answer

allez sacn antivir , post du rapport et c finit

babass61 · Answer

ok je lance le scan j'ai encore otmoveit et tools scan d'installer je les virent ?

Utilisateur anonyme · Answer

oué vire

babass61 · Answer

ok
j'ai lancé le scan mais j'ai l'impression que cela va prendre du temps il n'est qu'a 4,5 % en 10 mn
a tout a l'heure !

Utilisateur anonyme · Answer

oki

babass61 · Answer

me revoila !


Avira AntiVir Personal
Date de création du fichier de rapport : lundi 19 janvier 2009  21:14

La recherche porte sur 1230368 souches de virus.

Détenteur de la licence :Avira AntiVir PersonalEdition Classic
Numéro de série : 0000149996-ADJIE-0001
Plateforme :      Windows XP
Version de Windows :(Service Pack 3)  [5.1.2600]
Mode Boot :       Démarré normalement
Identifiant :     Sébastien
Nom de l'ordinateur :CHAMBRE

Informations de version :
BUILD.DAT     : 8.2.0.52       16931 Bytes  02/12/2008 14:55:00
AVSCAN.EXE    : 8.1.4.10      315649 Bytes  18/11/2008 08:21:00
AVSCAN.DLL    : 8.1.4.1        49921 Bytes  21/07/2008 13:44:27
LUKE.DLL      : 8.1.4.5       164097 Bytes  12/06/2008 12:44:16
LUKERES.DLL   : 8.1.4.0        13057 Bytes  04/07/2008 07:30:27
ANTIVIR0.VDF  : 7.1.0.0     15603712 Bytes  27/10/2008 11:30:36
ANTIVIR1.VDF  : 7.1.1.113    2817536 Bytes  14/01/2009 19:02:47
ANTIVIR2.VDF  : 7.1.1.114       2048 Bytes  14/01/2009 19:02:48
ANTIVIR3.VDF  : 7.1.1.142     385024 Bytes  19/01/2009 19:03:01
Version du moteur: 8.2.0.57  
AEVDF.DLL     : 8.1.0.6       102772 Bytes  14/10/2008 10:05:56
AESCRIPT.DLL  : 8.1.1.26      340347 Bytes  19/01/2009 19:03:44
AESCN.DLL     : 8.1.1.5       123251 Bytes  07/11/2008 15:06:41
AERDL.DLL     : 8.1.1.3       438645 Bytes  04/11/2008 13:58:38
AEPACK.DLL    : 8.1.3.5       393588 Bytes  19/01/2009 19:03:42
AEOFFICE.DLL  : 8.1.0.33      196987 Bytes  19/01/2009 19:03:32
AEHEUR.DLL    : 8.1.0.84     1540471 Bytes  19/01/2009 19:03:30
AEHELP.DLL    : 8.1.2.0       119159 Bytes  19/01/2009 19:03:10
AEGEN.DLL     : 8.1.1.10      323957 Bytes  19/01/2009 19:03:09
AEEMU.DLL     : 8.1.0.9       393588 Bytes  14/10/2008 10:05:56
AECORE.DLL    : 8.1.5.2       172405 Bytes  19/01/2009 19:03:03
AEBB.DLL      : 8.1.0.3        53618 Bytes  14/10/2008 10:05:56
AVWINLL.DLL   : 1.0.0.12       15105 Bytes  09/07/2008 08:40:02
AVPREF.DLL    : 8.0.2.0        38657 Bytes  16/05/2008 09:27:58
AVREP.DLL     : 8.0.0.2        98344 Bytes  31/07/2008 12:02:15
AVREG.DLL     : 8.0.0.1        33537 Bytes  09/05/2008 11:26:37
AVARKT.DLL    : 1.0.0.23      307457 Bytes  12/02/2008 08:29:19
AVEVTLOG.DLL  : 8.0.0.16      119041 Bytes  12/06/2008 12:27:46
SQLITE3.DLL   : 3.3.17.1      339968 Bytes  22/01/2008 17:28:02
SMTPLIB.DLL   : 1.2.0.23       28929 Bytes  12/06/2008 12:49:36
NETNT.DLL     : 8.0.0.1         7937 Bytes  25/01/2008 12:05:07
RCIMAGE.DLL   : 8.0.0.51     2371841 Bytes  04/07/2008 07:23:16
RCTEXT.DLL    : 8.0.52.1       86273 Bytes  17/07/2008 10:08:43

Configuration pour la recherche actuelle :
Nom de la tâche..................: Lecteurs locaux
Fichier de configuration.........: c:\program files\avira\antivir personaledition classic\alldrives.avp
Documentation....................: bas
Action principale................: interactif
Action secondaire................: ignorer
Recherche sur les secteurs d'amorçage maître: marche
Recherche sur les secteurs d'amorçage: marche
Secteurs d'amorçage..............: C:, M:, F:, G:, H:, I:, J:, D:, E:, 
Recherche dans les programmes actifs: marche
Recherche en cours sur l'enregistrement: marche
Recherche de Rootkits............: arrêt
Fichier mode de recherche........: Sélection de fichiers intelligente
Recherche sur les archives.......: marche
Limiter la profondeur de récursivité: 20
Archive Smart Extensions.........: marche
Heuristique de macrovirus........: marche
Heuristique fichier..............: moyen

Début de la recherche : lundi 19 janvier 2009  21:14

La recherche sur les processus démarrés commence :
Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avcenter.exe' - '1' module(s) sont contrôlés
Processus de recherche 'WLLoginProxy.exe' - '1' module(s) sont contrôlés
Processus de recherche 'iexplore.exe' - '1' module(s) sont contrôlés
Processus de recherche 'COCIManager.exe' - '1' module(s) sont contrôlés
Processus de recherche 'ImApp.exe' - '1' module(s) sont contrôlés
Processus de recherche 'LVComSX.exe' - '1' module(s) sont contrôlés
Processus de recherche 'MgApp.exe' - '1' module(s) sont contrôlés
Processus de recherche 'EasyShare.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wcescomm.exe' - '1' module(s) sont contrôlés
Processus de recherche 'PicasaMediaDetector.exe' - '1' module(s) sont contrôlés
Processus de recherche 'ctfmon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avgnt.exe' - '1' module(s) sont contrôlés
Processus de recherche 'ntvdm.exe' - '1' module(s) sont contrôlés
Processus de recherche 'jusched.exe' - '1' module(s) sont contrôlés
Processus de recherche 'ACDaemon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'qttask.exe' - '1' module(s) sont contrôlés
Processus de recherche 'OPware32.exe' - '1' module(s) sont contrôlés
Processus de recherche 'QuickCam10.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'Communications_Helper.exe' - '1' module(s) sont contrôlés
Processus de recherche 'SOUNDMAN.EXE' - '1' module(s) sont contrôlés
Processus de recherche 'SearchProtection.exe' - '1' module(s) sont contrôlés
Processus de recherche 'E_S4I0R2.EXE' - '1' module(s) sont contrôlés
Processus de recherche 'alg.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wmiapsrv.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wscntfy.exe' - '1' module(s) sont contrôlés
Processus de recherche 'explorer.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'nvsvc32.exe' - '1' module(s) sont contrôlés
Processus de recherche 'jqs.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avguard.exe' - '1' module(s) sont contrôlés
Processus de recherche 'ACService.exe' - '1' module(s) sont contrôlés
Processus de recherche 'sched.exe' - '1' module(s) sont contrôlés
Processus de recherche 'LVPrcSrv.exe' - '1' module(s) sont contrôlés
Processus de recherche 'spoolsv.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'lsass.exe' - '1' module(s) sont contrôlés
Processus de recherche 'services.exe' - '1' module(s) sont contrôlés
Processus de recherche 'winlogon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
Processus de recherche 'smss.exe' - '1' module(s) sont contrôlés
'48' processus ont été contrôlés avec '48' modules

La recherche sur les secteurs d'amorçage maître commence :
Secteur d'amorçage maître HD0
    [INFO]      Aucun virus trouvé !
Secteur d'amorçage maître HD1
    [INFO]      Aucun virus trouvé !
Secteur d'amorçage maître HD2
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
Secteur d'amorçage maître HD3
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
Secteur d'amorçage maître HD4
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
Secteur d'amorçage maître HD5
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
Secteur d'amorçage maître HD6
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.

La recherche sur les secteurs d'amorçage commence :
Secteur d'amorçage 'C:\'
    [INFO]      Aucun virus trouvé !
Secteur d'amorçage 'M:\'
    [INFO]      Aucun virus trouvé !
Secteur d'amorçage 'F:\'
    [INFO]      Aucun support de données inséré dans le lecteur 'F:\' !
Secteur d'amorçage 'G:\'
    [INFO]      Aucun support de données inséré dans le lecteur 'G:\' !
Secteur d'amorçage 'H:\'
    [INFO]      Aucun support de données inséré dans le lecteur 'H:\' !
Secteur d'amorçage 'I:\'
    [INFO]      Aucun support de données inséré dans le lecteur 'I:\' !
Secteur d'amorçage 'J:\'
    [INFO]      Aucun support de données inséré dans le lecteur 'J:\' !

La recherche sur les renvois aux fichiers exécutables (registre) commence.
Le registre a été contrôlé ( '64' fichiers).


La recherche sur les fichiers sélectionnés commence :

Recherche débutant dans 'C:\'
C:\pagefile.sys
    [AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Program Files\eMule\Incoming\Methode de deblocage mobile samsung tous modeles.zip
    [0] Type d'archive: ZIP
    --> install.exe
      [RESULTAT]  Contient le cheval de Troie TR/Dldr.Bagle.amk
    [REMARQUE]  Fichier supprimé.
Recherche débutant dans 'M:\' <IOMEGA_HDD>
M:\broderie\broderie 1\broderie\Embird.2006.Build.2.WinAll.English.keyymaker.zip
    [0] Type d'archive: ZIP
    --> Embird.exe
      [RESULTAT]  Contient le cheval de Troie TR/Crypt.XDR.Gen
    [REMARQUE]  Fichier supprimé.
M:\pc fixe\programmes\Comptabilité_EBP 2005 Fr_Code-Cracks.zip
    [0] Type d'archive: ZIP
      --> EBP 2005 Fr + Code + Cracks/produits/bourse5/Crack.exe
          [RESULTAT]  Contient le code suspect : HEUR/Malware
    [REMARQUE]  Fichier supprimé.
Recherche débutant dans 'F:\'
Impossible d'ouvrir le chemin à contrôler F:\ !
Erreur système [21]: Le périphérique n'est pas prêt.
Recherche débutant dans 'G:\'
Impossible d'ouvrir le chemin à contrôler G:\ !
Erreur système [21]: Le périphérique n'est pas prêt.
Recherche débutant dans 'H:\'
Impossible d'ouvrir le chemin à contrôler H:\ !
Erreur système [21]: Le périphérique n'est pas prêt.
Recherche débutant dans 'I:\'
Impossible d'ouvrir le chemin à contrôler I:\ !
Erreur système [21]: Le périphérique n'est pas prêt.
Recherche débutant dans 'J:\'
Impossible d'ouvrir le chemin à contrôler J:\ !
Erreur système [21]: Le périphérique n'est pas prêt.
Recherche débutant dans 'D:\'
Impossible d'ouvrir le chemin à contrôler D:\ !
Erreur système [21]: Le périphérique n'est pas prêt.
Recherche débutant dans 'E:\'
Impossible d'ouvrir le chemin à contrôler E:\ !
Erreur système [21]: Le périphérique n'est pas prêt.


Fin de la recherche : lundi 19 janvier 2009  22:30
Temps nécessaire:  1:16:13 Heure(s)

La recherche a été effectuée intégralement

   7422 Les répertoires ont été contrôlés
 358035 Des fichiers ont été contrôlés
      2 Des virus ou programmes indésirables ont été trouvés
      1 Des fichiers ont été classés comme suspects
      3 Des fichiers ont été supprimés
      0 Des virus ou programmes indésirables ont été réparés
      0 Les fichiers ont été déplacés dans la quarantaine
      0 Les fichiers ont été renommés
      1 Impossible de contrôler des fichiers
 358031 Fichiers non infectés
   2894 Les archives ont été contrôlées
      6 Avertissements
      3 Consignes

Utilisateur anonyme · Answer

te revoila !!!

regarde ce rapport :

:\Program Files\eMule\Incoming\Methode de deblocage mobile samsung tous modeles.zip 
[0] Type d'archive: ZIP 
--> install.exe 
[RESULTAT] Contient le cheval de Troie TR/Dldr.Bagle.amk 
[REMARQUE] Fichier supprimé. 
Recherche débutant dans 'M:\' <IOMEGA_HDD> 
M:\broderie\broderie 1\broderie\Embird.2006.Build.2.WinAll.English.keyymaker.zip 
[0] Type d'archive: ZIP 
--> Embird.exe 
[RESULTAT] Contient le cheval de Troie TR/Crypt.XDR.Gen 
[REMARQUE] Fichier supprimé. 
M:\pc fixe\programmes\Comptabilité_EBP 2005 Fr_Code-Cracks.zip 
[0] Type d'archive: ZIP 
--> EBP 2005 Fr + Code + Cracks/produits/bourse5/Crack.exe 


arrete ces merdes et tout ira bien 

regarde ça aussi :

/!\ A lire dans tons cas 1 : http://www.libellules.ch/...
/!\ A lire dans tons cas 2 : http://forum.malekal.com/ftopic893.php
/!\ A visionner : http://secuboxlabs.fr/archives/computertoday.html

si tu n as pas d autres soucis change le statut du sujet en resolu stp

http://www.commentcamarche.net/faq/sujet 11365 marquer un fil de discussion comme etant resolu

babass61 · Answer

ok j'ai compris le message je stop la bourrique !(e mule)
alors comme ça c'est fini ?

alors je tiens tout particulièrement a te remercier de ton guidage, et je te félicite de ton savoir qui pour moi viens d'une autre planéte ! mais qui sert beaucoup a tout ceux et celles qui on l'art de planter leur pc.
moi aussi je répare mais mes diques durs sont humains !
bonne soirée et merci pourtout merci pour ta patience.

Utilisateur anonyme · Answer

pas de soucis 

prend soin de ton pc et kiss 

++

babass61 · Answer

dernière question idiote etant novice sur le forum comment je change mon statut ?
gros bisous et merci encore

babass61 · Answer

j'ai trouvé tu a du me reformater le cerveau egalement ça marche mieux !!!!
tchao et merci

Utilisateur anonyme · Answer

-;) tans mieu alors 

des kiss aussi

BAGLE ET PLUS D'ANTI VIRUS

75 réponses

Discussions similaires