Virus besoin daide

vgabond -  
Bonjour,
depuis quelque jour mon pc va mal et est lent je crois avoir virus ou quelque truc qui val mal allors si quelqun pourrais maider svp merci voici le log de hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:10:15, on 14/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Logitech\QuickCam10\COCIManager.exe
C:\WINDOWS\system32\spider.exe
C:\WINDOWS\system32\spider.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe
C:\Program Files\TeamViewer\Version5\TeamViewer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe -H
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\VistaCodecPack\QT\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2EDF75C0-5ABD-49f9-BAB6-220476A32034} (System Requirements Lab) - http://intel-drv-cdn.systemrequirementslab.com/multi/bin/sysreqlab_srlx.cab
O16 - DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} - http://messenger.zone.msn.com/...
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/...
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://funnychat.org/controls/msnchat45.cab
O18 - Protocol: bw+0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Google Update (gupdate1c9962ba8de13ba) (gupdate1c9962ba8de13ba) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: TeamViewer 5 (TeamViewer5) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe

--
End of file - 24298 bytes
Configuration: Windows XP Internet Explorer 7.0

16 réponses

Résumé de la discussion

Un utilisateur signale un ralentissement du PC et suspecte une infection virale après l'analyse d'un log HijackThis sur Windows XP SP3, indiquant plusieurs processus et services potentiellement indésirables. Des éléments de réponse recommandent d'effectuer une désinfection, de vérifier les éléments de démarrage et les services susceptibles d'être malveillants, puis de recourir à des outils dédiés pour nettoyer les traces et sécuriser le système. D'autres conseils préconisent d'analyser les démarrages et les services suspects comme UnlockerAssistant, TeaTimer, ou composants Logitech, puis d'effectuer scans croisés avec des antivirus et antispyware pour confirmer l'état du système. En cas d'infection persistante ou d'échec des outils, une réinstallation propre du système peut s'avérer nécessaire pour assurer une remise en sécurité durable et éviter une réinfection.

Bobot (l’IA à votre service)
  1. mentir
    Bonjour, je crois qu' il faudra suprimé quelques programmes ou sinon je verrai.
    Je pourrais te repondre juste le mercredi, samedi, dimanche.
    Bone journée!!!
    1. gen-hackman
      et bien !! salut !! drolement construit ce windows !!

      ^^

      desinstalle le programme logitech

      ensuite :

      ▶ Télécharge Ad-remover ( de C_XX ) sur ton bureau :

      ▶ Déconnecte toi et ferme toutes applications en cours !

      ▶ Double clique sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installation par défaut .

      ▶ Double-clique sur le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil .

      ▶ Au menu principal choisis l'option "L" et tape sur [entrée] .

      ▶ Laisse travailler l'outil et ne touche à rien ...

      ▶ Poste le rapport qui apparait à la fin , sur le forum ...

      ( Le rapport est sauvegardé aussi sous C:\Ad-report.log )
      ( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )

      ▶ Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
      Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
      Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
      1. vgabond
        tu peut me dire pkoi tu dit de desinstaler le prg ed logiteck et ke mon win est drolement monter mais jvais suivre tes conseil mais jaimerais que tu mexplik svp
      2. vgabond
        .
        ======= RAPPORT D'AD-REMOVER 1.1.4.6_E | UNIQUEMENT XP/VISTA/7 =======
        .
        Mit à jour par C_XX le 13.12.2009 à 20:08
        Contact: AdRemover.contact@gmail.com
        Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
        .
        Lancé à: 13:11:58, 14/12/2009 | Mode sans echec | Option: CLEAN
        Exécuté de: C:\Program Files\Ad-Remover\
        Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
        Nom du PC: INDY_PC | Utilisateur actuel: Administrateur
        .
        ============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
        .

        C:\Program Files\Mozilla FireFox\Components\AskSearch.js

        (!) -- Fichiers temporaires supprimés.

        .
        HKCU\software\microsoft\internet explorer\searchscopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
        .
        ============== Scan additionnel ==============
        .
        .
        * Mozilla FireFox Version 3.5.5 [fr] *
        .
        Nom du profil: nyksljdq.default (Administrateur)
        .
        (ADMINI~1, prefs.js) Browser.download.lastDir, C:\Documents and Settings\Administrateur\Bureau
        (ADMINI~1, prefs.js) Browser.search.defaultenginename, Bing
        (ADMINI~1, prefs.js) Browser.search.defaulturl, hxxp://www.bing.com/search?FORM=IEFM1&q=
        (ADMINI~1, prefs.js) Browser.search.selectedEngine, Google
        (ADMINI~1, prefs.js) Browser.startup.homepage, hxxp://fr.msn.com/
        .
        .
        * Internet Explorer Version 8.0.6001.18702 *
        .
        [HKEY_CURRENT_USER\..\Internet Explorer\Main]
        .
        Do404Search: 01000000
        Local Page: C:\WINDOWS\system32\blank.htm
        Show_ToolBar: yes
        Start Page: hxxp://fr.msn.com/
        Enable Browser Extensions: yes
        Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
        Start Page Redirect Cache: hxxp://fr.msn.com/?ocid=iehp
        Start Page Redirect Cache_TIMESTAMP: 7a14278bb772ca01
        Start Page Redirect Cache AcceptLangs: fr
        Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
        Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
        .
        [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
        .
        Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
        Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
        Delete_Temp_Files_On_Exit: yes
        Local Page: C:\WINDOWS\system32\blank.htm
        Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
        Start Page: hxxp://fr.msn.com/
        Search bar: hxxp://search.msn.com/spbasic.htm
        .
        [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
        .
        Tabs: res://ieframe.dll/tabswelcome.htm
        .
        ============== Suspect (Cracks, Serials, ...) ==============
        .
        C:\Documents and Settings\Administrateur\Mes documents\Downloads\Avast 4.8.1296 Professional [h33t] - XPLOSiON\Keygen.exe
        .
        ===================================
        .
        524 Octet(s) - C:\Ad-Report-CLEAN[1].log
        2716 Octet(s) - C:\Ad-Report-CLEAN[2].log
        3036 Octet(s) - C:\Ad-Report-SCAN[1].log
        .
        0 Fichier(s) - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
        0 Fichier(s) - C:\WINDOWS\Temp
        0 Fichier(s) - C:\WINDOWS\Prefetch
        .
        20 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
        1 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE
        .
        Fin à: 13:15:48 | 14/12/2009 - CLEAN[2]
        .
        ============== E.O.F ==============
        .
    3. kduc
      Salut,

      Windows non activé, allégé, modifié, voire ... cracké !

      "Les problèmes se posent lorsqu’une personne vient se faire dépanner sur un forum d’aide.
      En désinfection les tools utilisés peuvent être incompatibles, certaines fonctions utiles à la résolution de problèmes ne sont pas installées, problème pour la mise en réseau, etc       …"
      3. mentir
        Non on doit pas suprimée le programme logitech car sa mets du temps pour le telecharger et sa va bloquer plus!!!!
        1. gen-hackman
          d'accord mentir....regle lui son probleme dans ce cas...bonne soirée

          MDR !
          1. vgabond
            bon voila le leg de ton prg

            ======= RAPPORT D'AD-REMOVER 1.1.4.6_E | UNIQUEMENT XP/VISTA/7 =======
            .
            Mit à jour par C_XX le 13.12.2009 à 20:08
            Contact: AdRemover.contact@gmail.com
            Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
            .
            Lancé à: 13:11:58, 14/12/2009 | Mode sans echec | Option: CLEAN
            Exécuté de: C:\Program Files\Ad-Remover\
            Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
            Nom du PC: INDY_PC | Utilisateur actuel: Administrateur
            .
            ============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
            .

            C:\Program Files\Mozilla FireFox\Components\AskSearch.js

            (!) -- Fichiers temporaires supprimés.

            .
            HKCU\software\microsoft\internet explorer\searchscopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
            .
            ============== Scan additionnel ==============
            .
            .
            * Mozilla FireFox Version 3.5.5 [fr] *
            .
            Nom du profil: nyksljdq.default (Administrateur)
            .
            (ADMINI~1, prefs.js) Browser.download.lastDir, C:\Documents and Settings\Administrateur\Bureau
            (ADMINI~1, prefs.js) Browser.search.defaultenginename, Bing
            (ADMINI~1, prefs.js) Browser.search.defaulturl, hxxp://www.bing.com/search?FORM=IEFM1&q=
            (ADMINI~1, prefs.js) Browser.search.selectedEngine, Google
            (ADMINI~1, prefs.js) Browser.startup.homepage, hxxp://fr.msn.com/
            .
            .
            * Internet Explorer Version 8.0.6001.18702 *
            .
            [HKEY_CURRENT_USER\..\Internet Explorer\Main]
            .
            Do404Search: 01000000
            Local Page: C:\WINDOWS\system32\blank.htm
            Show_ToolBar: yes
            Start Page: hxxp://fr.msn.com/
            Enable Browser Extensions: yes
            Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
            Start Page Redirect Cache: hxxp://fr.msn.com/?ocid=iehp
            Start Page Redirect Cache_TIMESTAMP: 7a14278bb772ca01
            Start Page Redirect Cache AcceptLangs: fr
            Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
            Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
            .
            [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
            .
            Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
            Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
            Delete_Temp_Files_On_Exit: yes
            Local Page: C:\WINDOWS\system32\blank.htm
            Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
            Start Page: hxxp://fr.msn.com/
            Search bar: hxxp://search.msn.com/spbasic.htm
            .
            [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
            .
            Tabs: res://ieframe.dll/tabswelcome.htm
            .
            ============== Suspect (Cracks, Serials, ...) ==============
            .
            C:\Documents and Settings\Administrateur\Mes documents\Downloads\Avast 4.8.1296 Professional [h33t] - XPLOSiON\Keygen.exe
            .
            ===================================
            .
            524 Octet(s) - C:\Ad-Report-CLEAN[1].log
            2716 Octet(s) - C:\Ad-Report-CLEAN[2].log
            3036 Octet(s) - C:\Ad-Report-SCAN[1].log
            .
            0 Fichier(s) - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
            0 Fichier(s) - C:\WINDOWS\Temp
            0 Fichier(s) - C:\WINDOWS\Prefetch
            .
            20 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
            1 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE
            .
            Fin à: 13:15:48 | 14/12/2009 - CLEAN[2]
            .
            ============== E.O.F ==============
            .
          2. vgabond
            bon mets la c pas grave je lais deja supprimer logiteck donc jmen oquperis a la fin mais ec ce que tu peut maider pour terminer moi je suivais tes demarche la allors la jattends de tes nouvelle merci de ton aide !
        2. gen-hackman
          Télécharge OTL de OLDTimer

          ▶ enregistre le sur ton Bureau.

          ▶ Double clic ( pour vista => clic droit "executer en tant qu'administrateur") sur OTL.exe pour le lancer.

          ▶ Coche les 2 cases Lop et Purity

          ▶ Coche la case devant scan all users

          ▶ règle-le sur "60 Days"

          ▶ dans la colonne de gauche , mets tout sur all

          ne modifie pas ceci :

          "files created whithin" et "files modified whithin"

          ▶Clic sur Run Scan.

          A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

          Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

          ▶▶▶ NE LE POSTE PAS SUR LE FORUM

          Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

          ▶ Clique sur Parcourir et cherche le fichier ci-dessus.

          ▶ Clique sur Ouvrir.

          ▶ Clique sur "Cliquez ici pour déposer le fichier".

          Un lien de cette forme :

          http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

          est ajouté dans la page.

          ▶ Copie ce lien dans ta réponse.

          ▶▶ Tu feras la meme chose avec le "Extra.txt".
          1. vgabond
            voila

            http://www.cijoint.fr/cjlink.php?file=cj200912/cij5J53zNe.txt

            http://www.cijoint.fr/cjlink.php?file=cj200912/cij9QmL6FG.txt
        3. gen-hackman
          ▶ Télécharge Zeb-Restoreet enregistre ce fichier sur le bureau.

          ▶-Clic droit Zeb-Restore.zip ==> Extraire tout choisis comme lieu d'enregistrement le bureau.

          ▶-Ouvre le dossier ZR_1.0.0.37 ==> double clic sur Zeb-Restore.exe

          ▶- Coche la case devant : sites de confiance et fichiers host

          ▶- Ne coche aucune autre case

          ▶-Clique sur Restaurer

          ▶-Redémarre ton PC

          ensuite :

          ▶ Double clic sur OTL.exe pour le lancer.

          ▶Copie la liste qui se trouve en gras ci-dessous,

          ▶ colle-la dans la zone sous Customs Scans/Fixes :


          :processes
          explorer.exe
          iexplore.exe
          firefox.exe
          msnmsgr.exe
          Teatimer.exe

          :OTL
          FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07
          FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}:6.0.12
          FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15
          [2008/08/11 13:08:02 | 00,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
          [2009/02/15 21:16:09 | 00,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
          [2009/11/22 13:49:11 | 00,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
          O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
          O4 - HKLM..\Run: [UniMessenger] File not found
          O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

          :reg
          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
          "iTunesHelper"=-
          "QuickTime Task"=-
          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
          "C:\Program Files\ooVoo\ooVoo.exe"=-
          "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\IXP000.TMP\ikoge.exe"=-
          :files
          C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

          :commands
          [emptytemp]
          [start explorer]
          [reboot]


          ▶ Clique sur RunFix pour lancer la suppression.

          ▶ Poste le rapport.
          1. vgabond
            bon voila le log demander et maitenant que dois je faire !

            All processes killed
            ========== PROCESSES ==========
            No active process named explorer.exe was found!
            Process iexplore.exe killed successfully!
            No active process named firefox.exe was found!
            Process msnmsgr.exe killed successfully!
            No active process named Teatimer.exe was found!
            ========== OTL ==========
            Prefs.js: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07 removed from extensions.enabledItems
            Prefs.js: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}:6.0.12 removed from extensions.enabledItems
            Prefs.js: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15 removed from extensions.enabledItems
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\content folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\content folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\content folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome folder moved successfully.
            C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} folder moved successfully.
            Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
            Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
            Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\UniMessenger deleted successfully.
            Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
            C:\WINDOWS\Downloaded Program Files\CONFLICT.1\gp.inf not found.
            Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
            Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
            Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
            Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
            ========== REGISTRY ==========
            Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\iTunesHelper deleted successfully.
            Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task deleted successfully.
            Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\ooVoo\ooVoo.exe deleted successfully.
            Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\IXP000.TMP\ikoge.exe deleted successfully.
            ========== FILES ==========
            C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\x86 folder moved successfully.
            C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86 folder moved successfully.
            C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} folder moved successfully.
            ========== COMMANDS ==========

            [EMPTYTEMP]

            User: Administrateur
            ->Temp folder emptied: 101817 bytes
            ->Temporary Internet Files folder emptied: 21620708 bytes
            ->Java cache emptied: 54391036 bytes
            ->FireFox cache emptied: 96729366 bytes
            ->Google Chrome cache emptied: 6013616 bytes

            User: All Users

            User: Default User
            ->Temp folder emptied: 48300 bytes
            ->Temporary Internet Files folder emptied: 33170 bytes

            User: LocalService
            ->Temp folder emptied: 99119 bytes
            ->Temporary Internet Files folder emptied: 33170 bytes

            User: NetworkService
            ->Temp folder emptied: 1122972 bytes
            ->Temporary Internet Files folder emptied: 2433007 bytes

            %systemdrive% .tmp files removed: 0 bytes
            %systemroot% .tmp files removed: 2133582 bytes
            %systemroot%\System32 .tmp files removed: 3072 bytes
            Windows Temp folder emptied: 0 bytes
            Session Manager Temp folder emptied: 0 bytes
            Session Manager Tmp folder emptied: 0 bytes
            %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 121857072 bytes
            %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
            RecycleBin emptied: 1330184 bytes

            Total Files Cleaned = 293,72 mb

            OTL by OldTimer - Version 3.1.17.0 log created on 12142009_172651

            Files\Folders moved on Reboot...
            File move failed. C:\WINDOWS\System32\config\systemprofile\Local Settings\Temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
            File\Folder C:\WINDOWS\System32\config\systemprofile\Local Settings\Temp\Perflib_Perfdata_674.dat not found!

            Registry entries deleted on Reboot...
        4. gen-hackman
          bien refais un scan OTL comme demandé precedemment
          1. vgabond
            bon voila desoer pour lattente jai des truc a faire en meme temps mais merci beaucoup pour ton aide cest tres tres apprecier donc voila jai suivi les etape comme celle davant et voila le log !

            http://www.cijoint.fr/cjlink.php?file=cj200912/cijLq5EQsj.txt
          2. vgabond
            et voila lextra joubliais desoller !

            http://www.cijoint.fr/cjlink.php?file=cj200912/cijMJIwV78.txt
        5. gen-hackman
          ▶ Double clic sur OTL.exe pour le lancer.

          ▶Copie la liste qui se trouve en gras ci-dessous,

          ▶ colle-la dans la zone sous Customs Scans/Fixes :

          :processes
          explorer.exe
          iexplore.exe
          firefox.exe
          msnmsgr.exe
          Teatimer.exe

          :OTL
          @Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8F7DC5D9
          @Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:ADF211B1

          :commands
          [Purity]
          [emptytemp]
          [start explorer]

          ▶ Clique sur RunFix pour lancer la suppression.

          ▶ Poste le rapport.

          ensuite :

          Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent

          ▶ TéléchargeList&Kill'emet enregistre le sur ton bureau (car il est detecté a tort comme infection)

          Il ne necessite pas d'installation

          choisis la langue puis choisis l'option 1 = Mode Recherche

          ▶ laisse travailler l'outil

          à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

          un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , mais ne le supprime pas pour l instant, le scan n'est pas fini.

          ▶ Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

          tu peux supprimer le rapport catchme.log de ton bureau maintenant.

          1. vgabond
            voila le lof de otl

            All processes killed
            ========== PROCESSES ==========
            No active process named explorer.exe was found!
            Process iexplore.exe killed successfully!
            No active process named firefox.exe was found!
            No active process named msnmsgr.exe was found!
            No active process named Teatimer.exe was found!
            ========== OTL ==========
            ADS C:\Documents and Settings\All Users\Application Data\TEMP:8F7DC5D9 deleted successfully.
            ADS C:\Documents and Settings\All Users\Application Data\TEMP:ADF211B1 deleted successfully.
            ========== COMMANDS ==========

            [EMPTYTEMP]

            User: Administrateur
            ->Temp folder emptied: 262632 bytes
            ->Temporary Internet Files folder emptied: 10744178 bytes
            ->Java cache emptied: 7610880 bytes
            ->FireFox cache emptied: 37612960 bytes
            ->Google Chrome cache emptied: 0 bytes

            User: All Users

            User: Default User
            ->Temp folder emptied: 0 bytes
            ->Temporary Internet Files folder emptied: 0 bytes

            User: LocalService
            ->Temp folder emptied: 66016 bytes
            ->Temporary Internet Files folder emptied: 33170 bytes

            User: NetworkService
            ->Temp folder emptied: 8816 bytes
            ->Temporary Internet Files folder emptied: 33170 bytes

            %systemdrive% .tmp files removed: 0 bytes
            %systemroot% .tmp files removed: 0 bytes
            %systemroot%\System32 .tmp files removed: 4706 bytes
            Windows Temp folder emptied: 23681 bytes
            Session Manager Temp folder emptied: 0 bytes
            Session Manager Tmp folder emptied: 0 bytes
            %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 145474 bytes
            %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
            RecycleBin emptied: 1687783 bytes

            Total Files Cleaned = 55,54 mb

            OTL by OldTimer - Version 3.1.17.0 log created on 12162009_171156

            Files\Folders moved on Reboot...
            File move failed. C:\WINDOWS\System32\config\systemprofile\Local Settings\Temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
            File\Folder C:\WINDOWS\System32\config\systemprofile\Local Settings\Temp\Perflib_Perfdata_5c0.dat not found!

            Registry entries deleted on Reboot...
        6. gen-hackman
          Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

          ▶ Télécharge :

          Malwarebytes

          ou :

          Malwarebytes

          ▶ Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

          (NB : Si tu as un message d'erreur t'indiquant qu'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : COMCTL32.OCX

          ▶ Potasses le Tuto pour te familiariser avec le prg :

          ( cela dit, il est très simple d'utilisation ).

          relance malwarebytes en suivant scrupuleusement ces consignes :

          ! Déconnecte toi et ferme toutes applications en cours !

          ▶ Lance Malwarebyte's .

          Fais un examen dit "Complet" .

          ▶ Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
          ▶ à la fin tu cliques sur "résultat" .
          ▶ Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

          ▶ Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !

          ▶ Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

          1. vgabond
            mais la jsuis entrain de fire ton auter affaire de scan la List&Kill'em et appres je ferais lautre affaire de Malwarebytes et jai un prob avek logiteck que tu ma fais desinstaller o debut la yarrete pas de revenir mais je le ferme en fessan gestionaire de tache !
          2. vgabond
            @vgabondList'em by g3n-h@ckm@n 1.1.5.2

            Thx to Chiquitine29.....& CCM team

            User : Administrateur (Administrateurs) # INDY_PC
            Update on 14/12/2009 by g3n-h@ckm@n ::::: 00:00
            Start at: 17:18:15 | 16/12/2009
            Contact : g3n-h@ckm@n sur CCM

            Intel(R) Pentium(R) 4 CPU 2.80GHz
            Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
            Internet Explorer 8.0.6001.18702
            Windows Firewall Status : Enabled
            AV : avast! antivirus 4.8.1296 [VPS 091216-0] 4.8.1296 [ Enabled | Updated ]

            A:\ -> Lecteur de disquettes 3 ½ pouces
            C:\ -> Disque fixe local | 37,24 Go (14,32 Go free) | NTFS
            D:\ -> Disque CD-ROM

            ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

            C:\WINDOWS\System32\smss.exe 596
            C:\WINDOWS\system32\csrss.exe 644
            C:\WINDOWS\system32\winlogon.exe 668
            C:\WINDOWS\system32\services.exe 712
            C:\WINDOWS\system32\lsass.exe 724
            C:\WINDOWS\system32\svchost.exe 888
            C:\WINDOWS\system32\svchost.exe 952
            C:\Program Files\Windows Defender\MsMpEng.exe 1048
            C:\WINDOWS\System32\svchost.exe 1104
            C:\WINDOWS\system32\svchost.exe 1172
            C:\WINDOWS\system32\svchost.exe 1360
            C:\WINDOWS\Explorer.EXE 1560
            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 1600
            C:\Program Files\Alwil Software\Avast4\ashServ.exe 1648
            C:\WINDOWS\system32\spoolsv.exe 1948
            C:\WINDOWS\system32\svchost.exe 412
            C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 444
            C:\Program Files\Java\jre6\bin\jqs.exe 584
            C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe 1012
            C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 1548
            C:\WINDOWS\system32\svchost.exe 1748
            C:\WINDOWS\system32\wuauclt.exe 208
            C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 1004
            C:\Program Files\Alwil Software\Avast4\ashWebSv.exe 1308
            C:\WINDOWS\System32\alg.exe 2260
            C:\WINDOWS\system32\wbem\wmiapsrv.exe 2460
            C:\WINDOWS\system32\wbem\wmiprvse.exe 2504
            C:\Program Files\Analog Devices\Core\smax4pnp.exe 2820
            C:\Program Files\Unlocker\UnlockerAssistant.exe 2868
            C:\Program Files\Windows Defender\MSASCui.exe 2884
            C:\WINDOWS\system32\msiexec.exe 3156
            C:\Program Files\iTunes\iTunesHelper.exe 3180
            C:\WINDOWS\system32\igfxtray.exe 3252
            C:\Program Files\iPod\bin\iPodService.exe 3400
            C:\WINDOWS\system32\hkcmd.exe 3416
            C:\WINDOWS\system32\igfxpers.exe 3428
            C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 3444
            C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe 3472
            C:\WINDOWS\system32\ctfmon.exe 3588
            C:\Program Files\Messenger\msmsgs.exe 3616
            C:\Program Files\Internet Explorer\iexplore.exe 3192
            C:\Program Files\Internet Explorer\iexplore.exe 1916
            C:\Program Files\Windows Live\Toolbar\wltuser.exe 3860
            c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe 332
            C:\Program Files\Internet Explorer\iexplore.exe 2808
            C:\Documents and Settings\Administrateur\Bureau\List_Kill'em.exe 3368
            C:\WINDOWS\system32\cmd.exe 3348
            C:\WINDOWS\system32\wbem\wmiprvse.exe 2168
            C:\Documents and Settings\Administrateur\Local Settings\Temp\19.tmp\pv.exe 2784

            ======================
            Keys "Run"
            ======================
            [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
            MsnMsgr REG_SZ "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
            SpybotSD TeaTimer REG_SZ C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
            ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
            LDM REG_SZ C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
            MSMSGS REG_SZ "C:\Program Files\Messenger\msmsgs.exe" /background
            swg REG_SZ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
            SoundMAXPnP REG_SZ C:\Program Files\Analog Devices\Core\smax4pnp.exe
            Logitech Hardware Abstraction Layer REG_SZ KHALMNPR.EXE
            UnlockerAssistant REG_SZ C:\Program Files\Unlocker\UnlockerAssistant.exe -H
            Windows Defender REG_SZ "C:\Program Files\Windows Defender\MSASCui.exe" -hide
            QuickTime Task REG_SZ "C:\Program Files\VistaCodecPack\QT\qttask.exe" -atboottime
            UniMessenger REG_SZ
            LogitechCommunicationsManager REG_SZ "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
            LogitechQuickCamRibbon REG_SZ "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
            iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
            igfxtray REG_SZ C:\WINDOWS\system32\igfxtray.exe
            igfxhkcmd REG_SZ C:\WINDOWS\system32\hkcmd.exe
            igfxpers REG_SZ C:\WINDOWS\system32\igfxpers.exe
            avast! REG_SZ C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

            =====================
            Other Keys
            =====================
            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
            dontdisplaylastusername REG_DWORD 0 (0x0)
            legalnoticecaption REG_SZ
            legalnoticetext REG_SZ
            shutdownwithoutlogon REG_DWORD 1 (0x1)
            undockwithoutlogon REG_DWORD 1 (0x1)

            ===============
            [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
            NoDriveTypeAutoRun REG_DWORD 145 (0x91)

            ===============
            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
            HonorAutoRunSetting REG_DWORD 1 (0x1)

            ===============
            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
            AppInit_DLLS REG_SZ

            ===============
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igfxcui]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

            ===============
            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
            {AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ
            {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} REG_SZ Microsoft AntiMalware ShellExecuteHook

            ===============
            [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
            %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
            %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
            C:\WINDOWS\system32\dpvsetup.exe REG_SZ C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test
            C:\WINDOWS\system32\rundll32.exe REG_SZ C:\WINDOWS\system32\rundll32.exe:*:Enabled:Exécuter une DLL en tant qu'application
            C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe REG_SZ C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger
            C:\Program Files\ooVoo\ooVoo.exe REG_SZ C:\Program Files\ooVoo\ooVoo.exe:*:Enabled:ooVoo
            C:\Program Files\Messenger\msmsgs.exe REG_SZ C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
            C:\Program Files\iTunes\iTunes.exe REG_SZ C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
            C:\Program Files\LimeWire\LimeWire.exe REG_SZ C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire
            C:\Program Files\uTorrent\uTorrent.exe REG_SZ C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent
            C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
            C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\IXP000.TMP\ikoge.exe REG_SZ C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\IXP000.TMP\ikoge.exe:*:Enabled:Firevall Administrating
            C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
            C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger

            [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
            %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
            %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
            C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe REG_SZ C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger
            C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
            C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
            C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger

            ===============
            BHO :
            ======
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{53707962-6F74-2D53-2644-206D7942484F}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

            ================
            Internet Explorer :
            ================
            [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
            Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp

            [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
            Start Page REG_SZ http://www.gllob.com

            ========
            Services
            ========
            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

            Ndisuio : 0x3
            EapHost : 0x3
            SharedAccess : 0x2
            windefend : 0x2
            wuauserv : 0x2

            =========

            =======
            Drive :
            =======

            D‚fragmenteur de disque Windows
            Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

            Rapport d'analyse
            37,24 Go total, 14,32 Go libre (38%), 15% fragment‚ (fragmentation du fichier 29%)

            Vous devriez d‚fragmenter ce volume.

            ¤¤¤¤¤¤¤¤¤¤ Files/folders :

            C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
            C:\Program Files\Adverts
            C:\WINDOWS\System32\drivers\etc\hosts.msn
            C:\WINDOWS\System32\drivers\Sonyhcp.dll
            C:\Documents and Settings\Administrateur\Application Data\mindhabits.dat

            ¤¤¤¤¤¤¤¤¤¤ Keys :

            "HKCU\software\microsoft\internet explorer\searchscopes\{CF739809-1C6C-47C0-85B9-569DBB141420}"
            "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
            "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
            HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}
            HKLM\Software\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}

            =========
            Rootkits
            =========

            catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
            Rootkit scan 2009-12-16 17:22:25
            Windows 5.1.2600 Service Pack 3 NTFS

            scanning hidden processes ...

            scanning hidden services & system hive ...

            scanning hidden registry entries ...

            scanning hidden files ...

            scan completed successfully
            hidden processes: 0
            hidden services: 0
            hidden files: 0

            Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

            device: opened successfully
            user: MBR read successfully
            kernel: MBR read successfully
            user & kernel MBR OK

            ==========
            Programs
            ==========

            Ad-Remover
            Adverts
            Alwil Software
            Analog Devices
            Apple Software Update
            ComPlus Applications
            Dome Messenger
            Fichiers communs
            Foxit Software
            Google
            HashTab Shell Extension
            InstallShield Installation Information
            Internet Explorer
            iPod
            iTunes
            Java
            LG Electronics
            LG PC Suite 2
            LimeWire
            Logitech
            Malwarebytes' Anti-Malware
            Messenger
            Messenger Plus! Live
            Microsoft
            Microsoft CAPICOM 2.1.0.2
            microsoft frontpage
            Microsoft Office
            Microsoft Office Outlook Connector
            Microsoft PowerToys
            Microsoft Silverlight
            Microsoft SQL Server Compact Edition
            Microsoft Sync Framework
            Microsoft Visual Studio
            Microsoft Visual Studio 8
            Microsoft Works
            Microsoft.NET
            MindHabits
            Movie Maker
            Mozilla Firefox
            MSBuild
            MSECache
            MSN
            MSN Gaming Zone
            MSN Messenger
            MSXML 4.0
            MSXML 6.0
            MySpace
            NetMeeting
            Online Services
            Outlook Express
            PDF Editeur 2
            PokerStars
            Real
            RealArcade
            Reference Assemblies
            Registry Easy
            RngInterstitial.dll
            Services en ligne
            Spybot - Search & Destroy
            Sun
            SystemRequirementsLab
            Trend Micro
            UNI2
            Uninstall Information
            Unlocker
            Utilities
            uTorrent
            VistaCodecPack
            Windows Defender
            Windows Live
            Windows Live SkyDrive
            Windows Live Toolbar
            Windows Media Connect 2
            Windows Media Player
            Windows NT
            WindowsUpdate
            WinRAR
            xerox
            Z-Ball Free Trial
            Zuma's Revenge!

            ============
            Lecteur C:
            ============

            Ad-Report-CLEAN[1].log
            Ad-Report-CLEAN[2].log
            Ad-Report-SCAN[1].log
            AUTOEXEC.BAT
            boot.ini
            Bootfont.bin
            Config.Msi
            CONFIG.SYS
            Documents and Settings
            DPsFnshr.log
            Drivers
            fcc5c7c14dd1dfd38f73ae2000
            games
            hiberfil.sys
            IDE
            Install_Log.txt
            IO.SYS
            Kill'em
            List'em.txt
            lvcoinst.log
            MSDOS.SYS
            MSOCache
            My Games
            NTDETECT.COM
            ntldr
            pagefile.sys
            Program Files
            Programe telecharger
            RECYCLER
            sqmdata00.sqm
            sqmdata01.sqm
            sqmdata02.sqm
            sqmnoopt00.sqm
            sqmnoopt01.sqm
            sqmnoopt02.sqm
            System Volume Information
            TEMP
            USB_DRV
            users
            WINDOWS
            _OTL

            ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
          3. vgabond
            voila ton log de lautre affaire !
        7. gen-hackman
          autant pour moi , je tedonnerai le signal pour malwarebytes

          desole je suis en train de bosser une application ^^
          1. gen-hackman
            ▶ Relance List&Kill'em comme tu as fait pour l'option 1 (soit en clic droit pour vista),

            mais cette fois-ci :

            ▶ choisis l'option 2 = Mode Destruction

            laisse travailler l'outil.

            en fin de scan un rapport s'ouvre

            ▶ colle le contenu dans ta reponse

            ensuite :

            ▶ Double clic sur OTL.exe pour le lancer.

            ▶Copie la liste qui se trouve en gras ci-dessous,

            ▶ colle-la dans la zone sous Customs Scans/Fixes :


            :processes
            explorer.exe
            iexplore.exe
            firefox.exe
            msnmsgr.exe
            Teatimer.exe

            :reg
            [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
            "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"=-
            "C:\Program Files\ooVoo\ooVoo.exe"=-
            "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\IXP000.TMP\ikoge.exe"=-
            [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
            "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"=-
            [-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

            :commands
            [emptytemp]
            [start explorer]
            [reboot]


            ▶ Clique sur RunFix pour lancer la suppression.

            ▶ Poste le rapport.
            1. vgabond
              Kill'em by g3n-h@ckm@n 1.1.5.2

              User : Administrateur (Administrateurs) # INDY_PC
              Update on 14/12/2009 by g3n-h@ckm@n ::::: 00:00
              Start at: 17:45:43 | 16/12/2009
              Contact : g3n-h@ckm@n sur CCM

              Intel(R) Pentium(R) 4 CPU 2.80GHz
              Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
              Internet Explorer 8.0.6001.18702
              Windows Firewall Status : Enabled
              AV : avast! antivirus 4.8.1296 [VPS 091216-0] 4.8.1296 [ Enabled | Updated ]

              A:\ -> Lecteur de disquettes 3 ½ pouces
              C:\ -> Disque fixe local | 37,24 Go (14,27 Go free) | NTFS
              D:\ -> Disque CD-ROM

              ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

              C:\WINDOWS\System32\smss.exe 596
              C:\WINDOWS\system32\csrss.exe 644
              C:\WINDOWS\system32\winlogon.exe 668
              C:\WINDOWS\system32\services.exe 712
              C:\WINDOWS\system32\lsass.exe 724
              C:\WINDOWS\system32\svchost.exe 888
              C:\WINDOWS\system32\svchost.exe 952
              C:\Program Files\Windows Defender\MsMpEng.exe 1048
              C:\WINDOWS\System32\svchost.exe 1104
              C:\WINDOWS\system32\svchost.exe 1172
              C:\WINDOWS\system32\svchost.exe 1360
              C:\WINDOWS\Explorer.EXE 1560
              C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 1600
              C:\Program Files\Alwil Software\Avast4\ashServ.exe 1648
              C:\WINDOWS\system32\spoolsv.exe 1948
              C:\WINDOWS\system32\svchost.exe 412
              C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 444
              C:\Program Files\Java\jre6\bin\jqs.exe 584
              C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe 1012
              C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 1548
              C:\WINDOWS\system32\svchost.exe 1748
              C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 1004
              C:\Program Files\Alwil Software\Avast4\ashWebSv.exe 1308
              C:\WINDOWS\System32\alg.exe 2260
              C:\WINDOWS\system32\wbem\wmiapsrv.exe 2460
              C:\Program Files\Analog Devices\Core\smax4pnp.exe 2820
              C:\Program Files\Unlocker\UnlockerAssistant.exe 2868
              C:\Program Files\Windows Defender\MSASCui.exe 2884
              C:\Program Files\iTunes\iTunesHelper.exe 3180
              C:\WINDOWS\system32\igfxtray.exe 3252
              C:\Program Files\iPod\bin\iPodService.exe 3400
              C:\WINDOWS\system32\hkcmd.exe 3416
              C:\WINDOWS\system32\igfxpers.exe 3428
              C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 3444
              C:\WINDOWS\system32\ctfmon.exe 3588
              C:\Program Files\Messenger\msmsgs.exe 3616
              c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe 332
              C:\Program Files\Windows Live\Contacts\wlcomm.exe 8920
              C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 11732
              C:\Program Files\Windows Live\Toolbar\wltuser.exe 19320
              C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe 20284
              C:\WINDOWS\system32\msiexec.exe 19900
              C:\Documents and Settings\Administrateur\Bureau\List_Kill'em.exe 20436
              C:\WINDOWS\system32\cmd.exe 3768
              C:\WINDOWS\system32\wbem\wmiprvse.exe 17132
              C:\Documents and Settings\Administrateur\Local Settings\Temp\62.tmp\pv.exe 16916

              Detections :
              ==========

              ¤¤¤¤¤¤¤¤¤¤ Files/folders :

              "C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}"
              "C:\Program Files\Adverts"
              "C:\WINDOWS\System32\drivers\etc\hosts.msn"
              "C:\WINDOWS\system32\drivers\Sonyhcp.dll"

              ¤¤¤¤¤¤¤¤¤¤ Files/folders deleted :

              Quarantine :

              Adverts.Kill'em
              hosts.msn.Kill'em
              Sonyhcp.dll.Kill'em
              {3276BE95_AF08_429F_A64F_CA64CB79BCF6}.Kill'em

              ==============
              host file OK !
              ==============

              ========
              Registry
              ========
              Deleted : HKCU\software\microsoft\internet explorer\searchscopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
              Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe
              Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe
              Deleted : HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}

              ============
              Disk Cleaned
              ============

              ================
              Prefetch cleaned
              ================

              ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
            2. vgabond
              All processes killed
              ========== PROCESSES ==========
              No active process named explorer.exe was found!
              Process iexplore.exe killed successfully!
              No active process named firefox.exe was found!
              Process msnmsgr.exe killed successfully!
              No active process named Teatimer.exe was found!
              ========== REGISTRY ==========
              Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe deleted successfully.
              Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\Program Files\ooVoo\ooVoo.exe deleted successfully.
              Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\IXP000.TMP\ikoge.exe deleted successfully.
              Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list\\C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe deleted successfully.
              Registry key HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
              Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
              ========== COMMANDS ==========

              [EMPTYTEMP]

              User: Administrateur
              ->Temp folder emptied: 1868864 bytes
              ->Temporary Internet Files folder emptied: 7024276 bytes
              ->Java cache emptied: 0 bytes
              ->FireFox cache emptied: 0 bytes
              ->Google Chrome cache emptied: 0 bytes

              User: All Users

              User: Default User
              ->Temp folder emptied: 0 bytes
              ->Temporary Internet Files folder emptied: 0 bytes

              User: LocalService
              ->Temp folder emptied: 66016 bytes
              ->Temporary Internet Files folder emptied: 33170 bytes

              User: NetworkService
              ->Temp folder emptied: 920 bytes
              ->Temporary Internet Files folder emptied: 0 bytes

              %systemdrive% .tmp files removed: 0 bytes
              %systemroot% .tmp files removed: 0 bytes
              %systemroot%\System32 .tmp files removed: 0 bytes
              Windows Temp folder emptied: 0 bytes
              Session Manager Temp folder emptied: 0 bytes
              Session Manager Tmp folder emptied: 0 bytes
              %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 17698 bytes
              %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
              RecycleBin emptied: 0 bytes

              Total Files Cleaned = 8,59 mb

              OTL by OldTimer - Version 3.1.17.0 log created on 12162009_175426

              Files\Folders moved on Reboot...
              File move failed. C:\WINDOWS\System32\config\systemprofile\Local Settings\Temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
              File\Folder C:\WINDOWS\System32\config\systemprofile\Local Settings\Temp\Perflib_Perfdata_670.dat not found!

              Registry entries deleted on Reboot...
          2. gen-hackman
            ▶ Télécharge FindyKill de Chiquitine29 sur ton bureau :

            http://pagesperso-orange.fr/NosTools/Chiquitine29/Setup.exe

            ! Déconnecte toi et ferme toutes applications en cours !

            ▶ Double clique (clic droit "en tant qu'administrateur" pour Vista) sur "FindyKill.exe" pour lancer l'installation et laisse les paramètres d'instalation par défaut .

            ▶ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

            ▶ Double-clique (clic droit "en tant qu'administrateur" pour Vista)sur le raccourci FindyKill qui est sur ton bureau pour lancer l'outil .

            ▶ Au menu principal choisis l'option " F " pour français et tape sur [entrée] .

            ▶ Au second menu Choisis l'option " 1 " (recherche) et tape sur [entrée]

            ▶ Laisse travailler l'outil et ne touche à rien ...

            ▶ Poste le rapport qui apparait à la fin , sur le forum ...

            ( le rapport est sauvegardé aussi sous C:\FindyKill.txt )
            ( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

            ensuite :

            ########### [ Option 2 ( Suppression ) ]

            ▶ Déconnecte toi et ferme toutes application en cours ( navigateur compris ) .

            ▶ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

            ▶ Relance "FindyKill" (clic droit "en tant qu'administrateur" pour Vista): au menu principal choisis l'option " F " pour français et tape sur [entrée] .

            ▶ Au second menu choisis l'option 2 (suppression) et tape sur [entrée]

            ▶ Le pc va redémarrer automatiquement ...

            ▶ le programme va travailler , ne touche à rien ... , ton bureau ne sera pas accessible c est normal !

            ▶ Poste le rapport qui apparait à la fin ( le rapport est sauvegardé aussi sous C:\FindyKill.txt )

            ▶ Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tape explorer.exe et valide

            Discussions similaires

            Softonic,est-ce un virus ?
            techmel1

            6 réponses
            Chrome://newtab
            Nova

            14 réponses
            Désinstaller Softonic
            Diguimette

            5 réponses
            Supprimer New Tab
            tysaozon

            8 réponses
            Bouton pause/break
            frans003

            3 réponses