Virus worm spybot ajs impossible a eradiquer

Résolu
anne -  
pc cilin m'a détecté le virus worm spybot.ajs et ne peut le mettre en quarantaine ou l'éradiquer ?
Le fichier atteint est c:\windows\system32\winapi.exe, puis je le supprimer?
Ou y a t il une autre façon d'enlever le virus.
A noter que secuser.com ne le détecte pas.

Merci de votre ide en langage simple, je ne suis pas une pro.

13 réponses

  1. Utilisateur anonyme
    salut anne

    essaye de faire ceci:

    Désactive la restauration systéme.
    Clic droit sur poste de travail > propriétés > onglet restauration système
    puis cocher "désactiver la restauration système".
    clic sur ok pour valider

    Redémarre en mode sans échec
    Redemarre le pc, laisse passer l'écran du bios, puis tapote sur la touche F8 avant qu'apparaisse l'écran de chargement de windows.
    Choisis le mode sans échec dans les options et valide avec entrée.

    une fois en mode sans echec, ne t'inquiete pas du changement d'apparence, dans ce mode windows ne charge que le minimum de chose pour pouvoir fonctionner.
    tout redeviendra normal apres avoir redemarré normallement le pc.
    donc, une fois en mode sans echec, relance ton antivirus, peut etre qu'il pourra le supprimer.
    ensuite redemarre ton pc, comme tu le ferais d'habitude.
    de retour en mode normal, repasse une seconde fois ton antivirus pour voir s'il le detecte de nouveau ou pas.

    Si tout est ok, réactive la restauration systeme:
    Clic droit sur poste de travail > propriétés > onglet restauration système
    puis décocher la case"désactiver la restauration système".

    a+
    1
    1. anne
      merci de ton aide, mais pc cilin ne marche pas en mode sans échec!
      0
  2. Utilisateur anonyme
    salut

    telecharge hijackthis:
    http://www.merijn.org/files/hijackthis.zip
    Dezippe le dans un dossier prévu a cet effet.
    Par exemple C:\hijack
    et surtout pas dans un dossier temporaire (temp)
    lance le puis:
    clic sur "do a system scan and save logfile" et pas autre chose
    Le bloc note va s'ouvrir, copie tout le contenu et colle le ici a la suite de ton message.
    Si tu as du mal, regarde ceci:
    http://pageperso.aol.fr/balltrap34/demohijack.htm

    a+
    0
    1. anne
      voila ce que j'ai trouvé :
      gfile of HijackThis v1.99.1
      Scan saved at 18:08:00, on 12/10/2005
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\System32\wuapi.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
      C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe
      C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\WINDOWS\system32\pctspk.exe
      C:\WINDOWS\System32\svchost.exe
      C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
      C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
      C:\Program Files\Messenger\MSMSGS.EXE
      C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
      C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
      C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
      C:\WINDOWS\System32\HPZipm12.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Documents and Settings\Anne\Local Settings\Temp\Répertoire temporaire 1 pour hijackthis.zip\HijackThis.exe
      C:\PROGRA~1\TRENDM~1\INTERN~1\TSC.EXE

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O3 - Toolbar: (no name) - {8E718888-423F-11D2-876E-00A0C9082467} - (no file)
      O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"
      O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
      O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      O4 - HKLM\..\Run: [C-Media Speaker Configuration] C:\PROGRA~1\C-Media\WIN_ME\Setup.exe /SPEAKER
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
      O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
      O4 - Global Startup: hpoddt01.exe.lnk = ?
      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
      O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
      O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1128517469671
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O23 - Service: Automatic Update Service (Automatic Update) - Unknown owner - C:\WINDOWS\System32\wuapi.exe
      O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
      O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
      O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
      O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
      O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

      merci a+
      0
  3. Utilisateur anonyme
    salut

    Ouvre le gestionnaire des taches (ctrl+alt+suppr) et termine ce processus
    wuapi.exe

    Ensuite :
    Dans le menu Demarrer>Executer >tape: Services.msc
    recherche le service avec cette orthographe exacte:
    Automatic Update Service
    Double clic dessus et clic sur [arreter] puis dans :
    type de demarrage --> sélectionne désactivé.

    recherche et supprime:
    C:\WINDOWS\System32\wuapi.exe

    redemarre le pc et reposte un rapport hijackthis.

    a+
    0
    1. anne
      j'ai bien suivi tes conseils mais impossible de retrouver c:\windows\system 32\wuapi.exe,
      il me répond : pas de fichier retrouvé.

      Que faire?
      Merci a+
      0
      2. anne
        je viens de faire un sacn antivirus, il ne me retrouve plus worm.spybot.ajs.

        Serait- il éradiqué?

        J'espère A +
        0
        1. anne
          voici la suite par hijackthis :
          Logfile of HijackThis v1.99.1
          Scan saved at 17:30:49, on 13/10/2005
          Platform: Windows XP SP1 (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
          C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
          C:\WINDOWS\Explorer.EXE
          C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe
          C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
          C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
          C:\WINDOWS\system32\pctspk.exe
          C:\WINDOWS\System32\ctfmon.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Messenger\MSMSGS.EXE
          C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
          C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
          C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
          C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
          C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
          C:\WINDOWS\System32\wuauclt.exe
          C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
          C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
          C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
          C:\Documents and Settings\Anne\Local Settings\Temp\Répertoire temporaire 2 pour hijackthis.zip\HijackThis.exe
          C:\Program Files\Internet Explorer\iexplore.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
          O3 - Toolbar: (no name) - {8E718888-423F-11D2-876E-00A0C9082467} - (no file)
          O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"
          O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
          O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
          O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
          O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
          O4 - Global Startup: hpoddt01.exe.lnk = ?
          O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
          O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1128517469671
          O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
          O23 - Service: Automatic Update Service (Automatic Update) - Unknown owner - C:\WINDOWS\System32\wuapi.exe (file missing)
          O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
          O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
          O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
          O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
          O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
          O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

          je n'y comprends rien mais je fais confiance. A +
          0
          1. Utilisateur anonyme
            salut

            Moe ne me semble pas rentrer...

            Telecharge ceci:

            http://www.01net.com/telecharger/windows/Utilitaire/cryptage_et_securite/fiches/23822.html

            Démo d’utilisation ici (merci à Balltrap34 pour cette réalisation)
            http://pageperso.aol.fr/balltrap34/demochaos.swf

            ****
            ----------------------------------------------------------------------------
            ¤Relance HijackThis, coche les cases devant ces lignes et ensuite clique sur fix checked :

            O23 - Service: Automatic Update Service (Automatic Update) - Unknown owner - C:\WINDOWS\System32\wuapi.exe (file missing)

            ----------------------------------------------------------------------------
            ¤Lance chaos shredder comme sur la video et supprime ceci
            C:\WINDOWS\System32\wuapi.exe

            ----------------------------------------------------------------------------
            ¤Arrête ces services :

            Clique sur Démarrer->exécuter->tape: services.msc

            Double-clique: Service: Automatic Update Service

            Règle-le sur "Arrêté" et "Désactivé".

            ------
            Redemarre ton pc et remet un log hijack this

            A+
            0
            1. anne
              merci d'avoir repris la discussion.

              J'ai lancé chaos mais il ne trouve pas de fichier c:\windows\system32\wuapi.exe mais seulement wuapi.dll

              Je n'ai pas osé le supprimer!

              Au fait toutes les manips que vous me faites faire ça correspond à quoi? Je suis nulle en informatique mais j'aime bien comprendre.

              Merci. A+
              0
          2. Utilisateur anonyme
            salut quentin, anne

            merci pour anne d'avoir pris le relais ;-)

            a+++
            0
            1. Utilisateur anonyme
              salut
              remet un hijack this, meme en affichant ceci
              **
              ¤Affiche tous les fichiers et dossiers :
              Clique sur démarrer/panneau de configuration/outil/option des dossiers/affichage

              Coche « afficher les fichiers et dossiers cachés »

              Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"

              Décoche « masquer les extensions dont le type est connu »
              Puis fais «Ok» pour valider les changements.

              Et appliquer !
              **
              tu ne trouve pas c:\windows\system32\wuapi.exe ?

              A+ et remet un log
              0
              1. anne
                Salut,

                le fichier C:\windows\system32\wuapi.exe est toujours introuvable!

                Voici le log :
                Logfile of HijackThis v1.99.1
                Scan saved at 14:52:47, on 15/10/2005
                Platform: Windows XP SP1 (WinNT 5.01.2600)
                MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\system32\spoolsv.exe
                C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
                C:\WINDOWS\system32\pctspk.exe
                C:\WINDOWS\System32\svchost.exe
                C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
                C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
                C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
                C:\WINDOWS\Explorer.EXE
                C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe
                C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
                C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                C:\WINDOWS\System32\ctfmon.exe
                C:\Program Files\Messenger\MSMSGS.EXE
                C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
                C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
                C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
                C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
                C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
                C:\WINDOWS\System32\wuauclt.exe
                C:\Program Files\Internet Explorer\iexplore.exe
                C:\WINDOWS\System32\HPZipm12.exe
                C:\Documents and Settings\Anne\Local Settings\Temp\Répertoire temporaire 4 pour hijackthis.zip\HijackThis.exe

                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                O3 - Toolbar: (no name) - {8E718888-423F-11D2-876E-00A0C9082467} - (no file)
                O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"
                O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
                O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
                O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
                O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
                O4 - Global Startup: hpoddt01.exe.lnk = ?
                O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1128517469671
                O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
                O23 - Service: Automatic Update Service (Automatic Update) - Unknown owner - C:\WINDOWS\System32\wuapi.exe (file missing)
                O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
                O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
                O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
                O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
                O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
                O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
                0
                2. rayhane
                  Logfile of HijackThis v1.99.1
                  Scan saved at 17:44:56, on 18/12/2006
                  Platform: Windows XP (WinNT 5.01.2600)
                  MSIE: Internet Explorer v6.00 (6.00.2600.0000)

                  Running processes:
                  G:\WINDOWS\System32\smss.exe
                  G:\WINDOWS\system32\winlogon.exe
                  G:\WINDOWS\system32\services.exe
                  G:\WINDOWS\system32\lsass.exe
                  G:\WINDOWS\system32\svchost.exe
                  G:\WINDOWS\Explorer.EXE
                  G:\PROGRA~1\MOZILL~1\FIREFOX.EXE
                  G:\WINDOWS\System32\svchost.exe
                  G:\Documents and Settings\tek\Local Settings\Temp\Répertoire temporaire 1 pour hijackthis.zip\HijackThis.exe

                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotinfobox.com
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                  F2 - REG:system.ini: UserInit=G:\WINDOWS\System32\userinit.exe,userinit.exe
                  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - G:\WINDOWS\system32\msdxm.ocx
                  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - g:\program files\google\googletoolbar1.dll
                  O3 - Toolbar: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - G:\PROGRA~1\FICHIE~1\{386D1~1\Bar888.dll
                  O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - G:\Program Files\VSAdd-in\VSAdd-in.dll
                  O4 - HKLM\..\Run: [cpanel] G:\WINDOWS\System32\winlogin32.exe
                  O4 - HKLM\..\Run: [QuickTime Task] "G:\Program Files\QuickTime\qttask.exe" -atboottime
                  O4 - HKLM\..\Run: [User Input Services] G:\WINDOWS\System32\ctfmon32.exe
                  O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
                  O4 - HKLM\..\Run: [UpdReg] G:\WINDOWS\UpdReg.EXE
                  O4 - HKLM\..\Run: [Jet Detection] "G:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
                  O4 - HKLM\..\Run: [TkBellExe] "G:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                  O4 - HKLM\..\Run: [WINDOWS] C:\peusnmia.exe
                  O4 - HKLM\..\Run: [{A86D158E-07EE-1036-1111-020603310021}] "G:\Program Files\Fichiers communs\{A86D158E-07EE-1036-1111-020603310021}\Update.exe" mc-110-12-0000572
                  O4 - HKLM\..\Run: [IpWins] G:\Program Files\ipwins\ipwins.exe
                  O4 - HKLM\..\Run: [Google Desktop Search] "G:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
                  O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
                  O4 - HKCU\..\Run: [msnmsgr] "G:\Program Files\MSN Messenger\msnmsgr.exe" /background
                  O4 - HKCU\..\Run: [Steam] G:\Program Files\Steam\Steam.exe -silent
                  O4 - HKCU\..\Run: [MSMSGS] "G:\Program Files\Messenger\msmsgs.exe" /background
                  O4 - HKCU\..\Run: [cpanel] G:\WINDOWS\System32\winlogin32.exe
                  O4 - HKCU\..\Run: [Shareaza] "G:\Program Files\Shareaza\Shareaza.exe" -tray
                  O4 - HKCU\..\Run: [eMuleAutoStart] G:\Program Files\eMule\emule.exe -AutoStart
                  O4 - Global Startup: Outil de mise à jour Google.lnk = G:\Program Files\Google\Google Updater\GoogleUpdater.exe
                  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                  O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/27cd9ec480c8a7a12f05/netzip/RdxIE601_fr.cab
                  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "G:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
                  O20 - AppInit_DLLs: G:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
                  O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
                  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - G:\WINDOWS\System32\Ati2evxx.exe
                  O23 - Service: ATI Smart - Unknown owner - G:\WINDOWS\system32\ati2sgag.exe
                  O23 - Service: Boonty Games - BOONTY - G:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                  O23 - Service: COM+ Messages - Unknown owner - G:\WINDOWS\System32\svchosts.exe" -e mc-110-12-0000572 (file missing)
                  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - G:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                  O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - G:\WINDOWS\system32\LEXBCES.EXE
                  O23 - Service: LSA Shel (Export Version) - Unknown owner - G:\WINDOWS\lsass.exe (file missing)
                  O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - G:\WINDOWS\System32\msasvc.exe
                  O23 - Service: Network helper Service (MSDisk) - Unknown owner - G:\WINDOWS\System32\irdvxc.exe" /service (file missing)
                  O23 - Service: Network Windows Service (MSWindows) - Unknown owner - G:\WINDOWS\System32\urdvxc.exe" /service (file missing)
                  O23 - Service: NBService - Nero AG - G:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
                  O23 - Service: SFTP client for Windows - Unknown owner - G:\WINDOWS\System32\dllcache\winscp.exe
                  0
                  1. yoyo30
                    Bonjour,
                    Je ne peux plus accéder a mon poste de travail, il me dise que windows/explorer.exe est introuvable et les autre éléments du bureau . J'ai lancer l'analyse hijack this et me donne :
                    Logfile of Trend Micro HijackThis v2.0.2
                    Scan saved at 20:34:38, on 19/02/2009
                    Platform: Windows XP SP3 (WinNT 5.01.2600)
                    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
                    Boot mode: Normal

                    Running processes:
                    C:\WINDOWS\System32\smss.exe
                    C:\WINDOWS\system32\csrss.exe
                    C:\WINDOWS\system32\winlogon.exe
                    C:\WINDOWS\system32\services.exe
                    C:\WINDOWS\system32\lsass.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\Program Files\Ahead\InCD\InCDsrv.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
                    C:\WINDOWS\system32\spoolsv.exe
                    C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
                    C:\WINDOWS\Explorer.EXE
                    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
                    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
                    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                    C:\Program Files\Bonjour\mDNSResponder.exe
                    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                    C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
                    C:\Program Files\Pack Securite\backweb\361343\program\fsbwsys.exe
                    C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                    C:\WINDOWS\System32\alg.exe
                    C:\WINDOWS\system32\ctfmon.exe
                    C:\Documents and Settings\didier gregoire\Spybot - Search & Destroy\SpybotSD.exe
                    C:\Program Files\Mozilla Firefox\firefox.exe
                    C:\Program Files\Spyware Doctor\pctsAuxs.exe
                    C:\Program Files\Spyware Doctor\pctsTray.exe
                    C:\Program Files\SFR\Controle Parental\bin\optproxy.exe
                    C:\Program Files\Spyware Doctor\pctsSvc.exe
                    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                    C:\WINDOWS\System32\wbem\wmiprvse.exe

                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neufportail.fr/
                    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                    O2 - BHO: BrowserCmp - {1D8282E6-BC4F-469B-AAED-7E4FF077AD93} - C:\WINDOWS\system32\iebrowserc.dll
                    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\DOCUME~1\DIDIER~1\SPYBOT~1\SDHelper.dll
                    O2 - BHO: EWPBrowseObject Class - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
                    O2 - BHO: GamesBar - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Program Files\GamesBar\oberontb.dll
                    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
                    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.5672\swg.dll
                    O2 - BHO: Star Downloader Toolbar Helper - {E16AB45F-35A8-4f4d-922F-8D00D760F85B} - C:\Program Files\Star Downloader Toolbar\v2.0.0.5\Star_Downloader_Toolbar.dll
                    O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - C:\PROGRA~1\STARDO~1\SDIEInt.dll
                    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                    O3 - Toolbar: Star Downloader Toolbar - {8CEB3591-5DDC-47ec-AF97-66699BC85FE0} - C:\Program Files\Star Downloader Toolbar\v2.0.0.5\Star_Downloader_Toolbar.dll
                    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
                    O3 - Toolbar: GamesBar - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Program Files\GamesBar\oberontb.dll
                    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
                    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                    O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
                    O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
                    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
                    O8 - Extra context menu item: Download with Star Downloader - C:\Program Files\Star Downloader\sdie.htm
                    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
                    O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
                    O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
                    O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
                    O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                    O9 - Extra button: (no name) - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\oberontb.dll
                    O9 - Extra 'Tools' menuitem: GamesBar - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\oberontb.dll
                    O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                    O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://xxxtrayicon.com/xtrayinst.exe
                    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                    O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.encyclo.wanadoo.fr/JS/tdserver.cab
                    O16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1016_FR_XP.cab
                    O16 - DPF: {093F9CF8-0DE1-491C-95D5-5EC257BD4CA3} - http://akamai.downloadv3.com/binaries/IA/dtc32_FR_XP.cab
                    O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
                    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
                    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
                    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
                    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                    O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
                    O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - http://akamai.downloadv3.com/binaries/IA/nethv32_FR_XP.cab
                    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
                    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
                    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
                    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                    O16 - DPF: {92ABACFE-EF6E-42C7-A824-D50A914B5B70} (MastaCash Loader Class) - http://dx.mastacash.com/loader.cab
                    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
                    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
                    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game09.zylom.com/activex/zylomgamesplayer.cab
                    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                    O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Environnement d'exécution Java 1.4.1_01) -
                    O16 - DPF: {D1B80EBF-1A26-4FEC-B0B9-DCB934C6507E} - http://dialup.carpediem.fr/CABS/cd/1,0,3,8/fr/AccesMembre.cab
                    O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
                    O16 - DPF: {EEECA057-AD0F-44A7-8BE5-8634CEDBDBD1} - http://akamai.downloadv3.com/binaries/IA/netpe32_FR_XP.cab
                    O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
                    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
                    O18 - Protocol: bw+0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw+0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw-0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw-0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw00 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw00s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw10 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw10s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw20 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw20s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw30 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw30s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw40 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw40s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw50 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw50s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw60 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw60s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw70 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw70s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw80 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw80s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw90 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bw90s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwa0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwa0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwb0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwb0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwc0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwc0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwd0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwd0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwe0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwe0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwf0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwf0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                    O18 - Protocol: bwg0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwg0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwh0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwh0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwi0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwi0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwj0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwj0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwk0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwk0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwl0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwl0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwm0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwm0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwn0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwn0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwo0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwo0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwp0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwp0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwq0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwq0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwr0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwr0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bws0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bws0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwt0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwt0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwu0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwu0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwv0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwv0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bww0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bww0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwx0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwx0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwy0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwy0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwz0 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: bwz0s - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O18 - Protocol: offline-8876480 - {272261BD-5DA6-46EA-A8E4-28640C2FE425} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
                    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
                    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
                    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
                    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                    O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
                    O23 - Service: Pack Securite (BackWeb Plug-in - 361343) - BackWeb Technologies Inc. - C:\PROGRA~1\PACKSE~1\backweb\361343\Program\SERVIC~1.EXE
                    O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                    O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                    O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
                    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
                    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Pack Securite\backweb\361343\program\fsbwsys.exe
                    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
                    O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
                    O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                    O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                    O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
                    O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
                    O23 - Service: Contrôle Parental SFR (OPTENET_FILTER) - SFR - C:\Program Files\SFR\Controle Parental\bin\optproxy.exe
                    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
                    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
                    O24 - Desktop Component 0: (no name) - http://www.afjv.com/press0407/040705_olympique_marseille_.gif
                    O24 - Desktop Component 1: (no name) - http://www.ricarou51.com/images/djibril_180.jpg
                    0

                    Discussions similaires

                    Cheval de Troie- e.tre456.worm.windows
                    Ninou037

                    13 réponses
                    Softonic,est-ce un virus ?
                    techmel1

                    6 réponses
                    Chrome://newtab
                    Nova

                    14 réponses
                    Désinstaller Softonic
                    Diguimette

                    5 réponses
                    Virus potentiel
                    Ramon1

                    29 réponses