Analyse d'un rapport SmitFraudFix

Loutsky -  
Bonjour,

J'ai des soucis avec un ordianteur, j'ai scanner l'ordi et supprimer les virus, j'ai fait un scan avec SmitFraudFix et voici mon rapport :
Dois-je faire un nettoyage?

Merci de votre aide.

SmitFraudFix v2.259

Rapport fait à 11:42:49,25, 10/12/2007
Executé à partir de C:\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for Workstation 5\kavmm.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\ncompat.tlb PRESENT !
C:\WINDOWS\system32\ot.ico PRESENT !
C:\WINDOWS\system32\stdole3.tlb PRESENT !
C:\WINDOWS\system32\ts.ico PRESENT !
C:\WINDOWS\system32\1024\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\maxime

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\maxime\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

C:\DOCUME~1\maxime\MENUDM~1\PROGRA~1\MalwareWipe PRESENT !
C:\DOCUME~1\ALLUSE~1\MENUDM~1\Online Security Guide.url PRESENT !
C:\DOCUME~1\ALLUSE~1\MENUDM~1\Security Troubleshooting.url PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\maxime\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

C:\DOCUME~1\ALLUSE~1\Bureau\Online Security Guide.url PRESENT !
C:\DOCUME~1\ALLUSE~1\Bureau\Security Troubleshooting.url PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\MalwareWipe\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="file:///C:/DOCUME~1/maxime/LOCALS~1/Temp/msohtml1/01/clip_image001.jpg"
"SubscribedURL"="file:///C:/DOCUME~1/maxime/LOCALS~1/Temp/msohtml1/01/clip_image001.jpg"
"FriendlyName"=""

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{D1A2E7CD-F5C1-21A8-CA2C-13D0AC72D19D}"="Wheel Mouse Optical Driver"

[HKEY_CLASSES_ROOT\CLSID\{D1A2E7CD-F5C1-21A8-CA2C-13D0AC72D19D}\InProcServer32]
@="C:\WINDOWS\system32\dxmpp.dll"

[HKEY_CURRENT_USER\Software\Classes\CLSID\{D1A2E7CD-F5C1-21A8-CA2C-13D0AC72D19D}\InProcServer32]
@="C:\WINDOWS\system32\dxmpp.dll"

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\WINDOWS\\system32\\__c00698E4.dat"
"LoadAppInit_DLLs"=dword:00000001

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Broadcom NetXtreme 57xx Gigabit Controller - Miniport d'ordonnancement de paquets
DNS Server Search Order: 194.2.0.20
DNS Server Search Order: 194.2.0.50

HKLM\SYSTEM\CCS\Services\Tcpip\..\{071108E1-FB10-4D07-BB46-93B4D3790AA1}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CCS\Services\Tcpip\..\{EFED3DE9-161A-450E-80E4-C058033BBB86}: NameServer=194.2.0.20,194.2.0.50
HKLM\SYSTEM\CS1\Services\Tcpip\..\{071108E1-FB10-4D07-BB46-93B4D3790AA1}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{EFED3DE9-161A-450E-80E4-C058033BBB86}: NameServer=194.2.0.20,194.2.0.50
HKLM\SYSTEM\CS2\Services\Tcpip\..\{071108E1-FB10-4D07-BB46-93B4D3790AA1}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS2\Services\Tcpip\..\{EFED3DE9-161A-450E-80E4-C058033BBB86}: NameServer=194.2.0.20,194.2.0.50

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

16 réponses

  • Votes
  • Date
  • Date décroissante
  1. ^^Marie^^
    Bonjour Loutsky

    Démarre en mode sans échec :
    Pour cela, tu tapotes la touche F8 ((Si F8 ne marche pas utilise la touche F5)).
    dès le début de l’allumage du pc sans t’arrêter.
    Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
    Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
    ----------------------------------------------------------------------------
    Relance le programme Smitfraud,
    Cette fois choisit l’option 2,
    répond oui à tous ;
    Sauvegarde le rapport,
    Redémarre en mode normal,
    Copie/colle le rapport sauvegardé sur le forum

    F - Hijackthis - Outil de diagnostic et réparation
    télécharge HijackThis ici:
    http://telechargement.zebulon.fr/138-hijackthis-1991.html
    Dézippe le dans un dossier prévu à cet effet.
    Par exemple C:\hijackthis < Enregistre le bien dans c : !
    Démo : (Merci a Balltrap34 pour cette réalisation)
    http://pageperso.aol.fr/balltrap34/Hijenr.gif
    Lance le puis:
    clique sur "do a system scan and save logfile" (cf démo)
    faire un copier coller du log entier sur le forum
    Démo : (Merci a Balltrap34 pour cette réalisation)
    http://pageperso.aol.fr/balltrap34/demohijack.htm
    http://www.tutoriaux-excalibur.com/hijackthis.htm
    https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

    Bon courage

    A+

    1. g!rly Contributeur
      bonsoir a vous tous,

      btfix a trouvé l´infection comme l´avait dit marie...

      voici la suite a appliquer avec bt fix

      1 Télécharge CCleaner.
      http://www.filehippo.com/download_ccleaner.html
      Installe le dans un répertoire dédié.

      2 Redémarre en mode sans echec. Attention, tu n'as pas accès à internet dans ce mode, note bien ce que tu as à faire.
      Démarre l'ordinateur.
      Une fois le chargement du BIOS terminé, il y a un écran noir. Appuye sur la touche F8 jusqu'à l'affichage du menu des options avancées de Windows.
      En utilisant les touches du curseur, sélectionne Mode sans échec et appuye sur Entrée.

      3.Lance le nettoyage des fichiers temporaires a l´aide de ccleaner : "nettoyeur"

      -> décoche la derniere case (Avancé si elle est cochée) puis click sur "lancer le nettoyage" qunand il aura terminé le scan click en bas a droite sur "lancer le nettoyage" et accepte par oui.

      4Ouvre BTFix.
      Clique sur Nettoyer.
      Un rapport va apparaître.

      5 Relance ccleaner pour nettoyer les erreures : "erreurs" :

      ->Coches toutes les cases dans les propriétés du nettoyeur de l´onglet "windows" et "applications", puis click en bas sur "chercher des erreurs" une fois terminé, clic sur "reparer les erreurs", tu auras un message pour sauvegarder ta base de registre, tu click "oui" puis tu recommence jusqu'à ce qu'il ne trouve plus rien.

      ps : les sauvegardes que tu auras faites, pourront etre supprimées ulterieurement si tout va bien.

      6 Redémarre normalement

      7 Poste un nouveau log HijackThis avec le rapport de BTFix.

      @+
      1. Loutsky Auteur
        Merci de ton aide, j'ai supprimé les fichiers, fait un scan avec avg anti-spyware et fait les actions recommandées.
        Voici le log Hijackthis :

        Logfile of HijackThis v1.99.1
        Scan saved at 13:40:49, on 10/12/2007
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for Workstation 5\kavmm.exe
        C:\WINDOWS\Explorer.EXE
        C:\WINDOWS\system32\rundll32.exe
        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
        C:\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
        O3 - Toolbar: Hotbar - {07AA283A-43D7-4CBE-A064-32A21112D94D} - C:\Program Files\Hotbar\bin\10.0.356.0\HostIE.dll
        O3 - Toolbar: Mirar - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - C:\WINDOWS\system32\WinNB58.dll (file missing)
        O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
        O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
        O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
        O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
        O4 - HKLM\..\Run: [KAV50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for Workstation 5\kwsprod.exe" -run -n Workstation -v 5.0.0.0 -chkss
        O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
        O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
        O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
        O4 - HKLM\..\Run: [AutoEJCD_0ACE2011] C:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2011\AutoEJCD.EXE /VID=0ACE /PID=2011
        O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
        O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Logitech\Video\CameraAssistant.exe
        O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Logitech\Video\InstallHelper.exe /inspect
        O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
        O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
        O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
        O4 - HKLM\..\Run: [08330227] rundll32.exe "C:\WINDOWS\system32\bpgkkkmv.dll",b
        O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
        O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
        O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        O4 - HKCU\..\Run: [WeatherDPA] "C:\Program Files\Hotbar\bin\10.0.356.0\Weather.exe" -auto
        O4 - HKCU\..\Run: [Toae] "C:\WINDOWS\CROSOF~1.NET\notepad.exe" -vt yazb
        O4 - HKCU\..\Run: [Vkh] "C:\Program Files\?dobe\?vchost.exe"
        O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
        O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
        O4 - Global Startup: ZyXEL G-220F Utility GUI.lnk = ?
        O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
        O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
        O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?c2ee41dcfe3245d59a132aeff8bac0c8
        O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?c2ee41dcfe3245d59a132aeff8bac0c8
        O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Companion\Modules\messmod4\v6\yhexbmes.dll
        O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Companion\Modules\messmod4\v6\yhexbmes.dll
        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
        O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
        O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O15 - Trusted Zone: http://click.getmirar.com (HKLM)
        O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)
        O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)
        O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
        O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
        O16 - DPF: {8A0DCBDB-6E20-489C-9041-C1E8A0352E75} (Mirar_Dummy_ATS1 Class) - http://awbeta.net-nucleus.com/FIX/WinATS.cab
        O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
        O17 - HKLM\System\CCS\Services\Tcpip\..\{EFED3DE9-161A-450E-80E4-C058033BBB86}: NameServer = 194.2.0.20,194.2.0.50
        O18 - Protocol: bw+0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw+0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw-0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw-0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw00 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw00s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw10 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw10s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw20 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw20s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw30 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw30s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw40 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw40s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw50 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw50s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw60 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw60s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw70 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw70s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw80 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw80s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw90 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw90s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwa0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwa0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwb0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwb0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwc0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwc0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwd0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwd0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwe0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwe0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwf0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwf0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
        O18 - Protocol: bwg0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwg0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwh0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwh0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwi0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwi0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwj0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwj0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwk0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwk0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwl0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwl0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwm0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwm0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwn0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwn0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwo0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwo0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwp0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwp0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwq0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwq0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwr0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwr0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bws0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bws0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwt0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwt0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwu0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwu0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwv0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwv0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bww0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bww0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwx0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwx0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwy0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwy0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwz0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwz0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
        O18 - Protocol: offline-8876480 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00698E4.dat
        O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: KLBLMain - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for Workstation 5\kavmm.exe" -run bl -n Workstation -v 5.0.0.0 -ttsr 10000000 (file missing)
        O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
        1. Loutsky Auteur
          Voici le rapport après avoir fait le nettoyage de smitfraud :

          SmitFraudFix v2.259

          Rapport fait à 13:53:21,56, 10/12/2007
          Executé à partir de C:\SmitfraudFix
          OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
          Le type du système de fichiers est NTFS
          Fix executé en mode sans echec

          »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          SrchSTS.exe by S!Ri
          Search SharedTaskScheduler's .dll

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
          "{D1A2E7CD-F5C1-21A8-CA2C-13D0AC72D19D}"="Wheel Mouse Optical Driver"

          »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

          »»»»»»»»»»»»»»»»»»»»»»»» hosts

          127.0.0.1 localhost

          »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

          S!Ri's WS2Fix: LSP not Found.

          »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

          GenericRenosFix by S!Ri

          »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

          C:\DOCUME~1\maxime\MENUDM~1\PROGRA~1\MalwareWipe supprimé
          C:\DOCUME~1\ALLUSE~1\Bureau\Online Security Guide.url supprimé
          C:\DOCUME~1\ALLUSE~1\Bureau\Security Troubleshooting.url supprimé
          C:\Program Files\MalwareWipe\ supprimé

          »»»»»»»»»»»»»»»»»»»»»»»» DNS

          Description: Broadcom NetXtreme 57xx Gigabit Controller - Miniport d'ordonnancement de paquets
          DNS Server Search Order: 194.2.0.20
          DNS Server Search Order: 194.2.0.50

          HKLM\SYSTEM\CCS\Services\Tcpip\..\{071108E1-FB10-4D07-BB46-93B4D3790AA1}: DhcpNameServer=212.27.54.252 212.27.53.252
          HKLM\SYSTEM\CCS\Services\Tcpip\..\{EFED3DE9-161A-450E-80E4-C058033BBB86}: NameServer=194.2.0.20,194.2.0.50
          HKLM\SYSTEM\CS1\Services\Tcpip\..\{071108E1-FB10-4D07-BB46-93B4D3790AA1}: DhcpNameServer=212.27.54.252 212.27.53.252
          HKLM\SYSTEM\CS1\Services\Tcpip\..\{EFED3DE9-161A-450E-80E4-C058033BBB86}: NameServer=194.2.0.20,194.2.0.50
          HKLM\SYSTEM\CS2\Services\Tcpip\..\{071108E1-FB10-4D07-BB46-93B4D3790AA1}: DhcpNameServer=212.27.54.252 212.27.53.252
          HKLM\SYSTEM\CS2\Services\Tcpip\..\{EFED3DE9-161A-450E-80E4-C058033BBB86}: NameServer=194.2.0.20,194.2.0.50

          »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

          »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
          "System"=""

          »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

          Nettoyage terminé.

          »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          SrchSTS.exe by S!Ri
          Search SharedTaskScheduler's .dll

          »»»»»»»»»»»»»»»»»»»»»»»» Fin
        3. Loutsky Auteur
          J'ai pas réussi à fixer les lignes :
          O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
          O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll

          BTFix me donne ce rapport :
          BTFix 1.066 (par bibi26) - 10/12/2007 17:45:21 - Analyse
          Lancé depuis C:\Documents and Settings\maxime\Bureau\BTFix\BTFix\BTFix.exe

          ---> Fichiers/Dossiers trouvés

          - [Heuristique : Hotbar] C:\WINDOWS\system32\nqpurucf.exe
          - C:\Program Files\ShoppingReport
          - C:\Program Files\Hotbar
          - C:\Program Files\Mozilla Firefox\components\npclntax.xpt
          - C:\Documents and Settings\maxime\Application Data\ShoppingReport
          - C:\Documents and Settings\maxime\Application Data\HbTools
          - C:\Documents and Settings\maxime\Application Data\Hotbar
          - C:\Documents and Settings\maxime\Application Data\WeatherDPA
          - C:\Documents and Settings\All Users\Application Data\HotbarSA
          - C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
          - C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Hotbar

          ---> Analyse terminée

          Je n'ai pas de prb de détournement de DNS

          Merci de votre aide.
          1. Loutsky Auteur
            Bonjour à tous et merci encore de votre aide,
            J'ai fait tout ce que t'as dit g!rly et voici mes 2 rapports :

            BTFix 1.066 (par bibi26) - 11/12/2007 09:30:46 - Nettoyage - Mode sans échec
            Lancé depuis C:\BTFix\BTFix\BTFix.exe

            ---> Fichiers/dossiers supprimés

            - Fichiers temporaires effacés
            - [Heuristique : Hotbar] C:\WINDOWS\system32\nqpurucf.exe
            - C:\Program Files\Hotbar
            - C:\Program Files\Mozilla Firefox\components\npclntax.xpt
            - C:\Documents and Settings\maxime\Application Data\HbTools
            - C:\Documents and Settings\maxime\Application Data\Hotbar
            - C:\Documents and Settings\maxime\Application Data\WeatherDPA
            - C:\Documents and Settings\All Users\Application Data\HotbarSA
            - C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
            - C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Hotbar

            ---> Nettoyage terminé

            Logfile of HijackThis v1.99.1
            Scan saved at 09:42:55, on 11/12/2007
            Platform: Windows XP SP2 (WinNT 5.01.2600)
            MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\spoolsv.exe
            c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
            C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for Workstation 5\kavmm.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\Explorer.EXE
            C:\Program Files\Analog Devices\Core\smax4pnp.exe
            C:\WINDOWS\system32\hkcmd.exe
            C:\WINDOWS\system32\igfxpers.exe
            C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for Workstation 5\kwsprod.exe
            C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
            C:\WINDOWS\system32\dla\tfswctrl.exe
            C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe
            C:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2011\AutoEJCD.EXE
            C:\WINDOWS\system32\LVCOMSX.EXE
            C:\Program Files\Logitech\Video\CameraAssistant.exe
            C:\WINDOWS\system32\ElkCtrl.exe
            C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
            C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
            C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
            C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
            C:\WINDOWS\system32\ctfmon.exe
            C:\Program Files\MSN Messenger\MsnMsgr.Exe
            C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
            C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
            C:\WINDOWS\CROSOF~1.NET\notepad.exe
            C:\Program Files\?dobe\?vchost.exe
            C:\Program Files\ZyXEL Communications Corporation\ZyXEL G-220F Utility\ZyXEL_G-220F_GUI.exe
            C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
            C:\WINDOWS\system32\wuauclt.exe
            C:\WINDOWS\system32\rundll32.exe
            C:\HijackThis.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
            O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
            O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
            O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
            O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
            O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
            O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
            O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
            O4 - HKLM\..\Run: [KAV50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for Workstation 5\kwsprod.exe" -run -n Workstation -v 5.0.0.0 -chkss
            O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
            O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
            O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
            O4 - HKLM\..\Run: [AutoEJCD_0ACE2011] C:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2011\AutoEJCD.EXE /VID=0ACE /PID=2011
            O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
            O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Logitech\Video\CameraAssistant.exe
            O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Logitech\Video\InstallHelper.exe /inspect
            O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
            O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
            O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
            O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
            O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
            O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
            O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
            O4 - HKCU\..\Run: [Toae] "C:\WINDOWS\CROSOF~1.NET\notepad.exe" -vt yazb
            O4 - HKCU\..\Run: [Vkh] "C:\Program Files\?dobe\?vchost.exe"
            O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
            O4 - Global Startup: ZyXEL G-220F Utility GUI.lnk = ?
            O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
            O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
            O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?c2ee41dcfe3245d59a132aeff8bac0c8
            O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?c2ee41dcfe3245d59a132aeff8bac0c8
            O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Companion\Modules\messmod4\v6\yhexbmes.dll
            O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Companion\Modules\messmod4\v6\yhexbmes.dll
            O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
            O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
            O17 - HKLM\System\CCS\Services\Tcpip\..\{EFED3DE9-161A-450E-80E4-C058033BBB86}: NameServer = 194.2.0.20,194.2.0.50
            O18 - Protocol: bw+0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw+0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw-0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw-0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw00 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw00s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw10 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw10s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw20 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw20s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw30 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw30s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw40 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw40s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw50 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw50s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw60 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw60s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw70 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw70s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw80 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw80s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw90 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw90s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwa0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwa0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwb0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwb0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwc0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwc0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwd0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwd0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwe0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwe0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwf0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwf0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
            O18 - Protocol: bwg0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwg0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwh0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwh0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwi0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwi0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwj0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwj0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwk0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwk0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwl0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwl0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwm0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwm0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwn0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwn0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwo0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwo0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwp0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwp0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwq0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwq0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwr0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwr0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bws0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bws0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwt0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwt0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwu0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwu0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwv0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwv0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bww0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bww0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwx0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwx0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwy0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwy0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwz0 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwz0s - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
            O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
            O18 - Protocol: offline-8876480 - {FDE5D469-C4B1-480C-9191-37D56DA83B15} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
            O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
            O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
            O23 - Service: KLBLMain - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for Workstation 5\kavmm.exe" -run bl -n Workstation -v 5.0.0.0 -ttsr 10000000 (file missing)
            O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
            1. g!rly Contributeur
              salut loutsky,

              instal un antivirus et un par feu de toute urgence, sinon cela ne va servir a rien tout ce que l´on est en train de faire...

              Telecharge et instal l'antivirus Antivir Personal Edition Classic :

              ->https://www.malekal.com/avira-free-security-antivirus-gratuit/

              et

              par feu : kerio

              http://www.malekal.com/kerio_firewall.php#mozTocId721480

              https://www.vulgarisation-informatique.com/kerio.php

              ou zone alarm plus facil a configurer mais moins performant

              http://www.kachouri.com/tuto/tuto-143-zonealarm-installation-du-firewall--pare-feu.html

              ca te dis quelque chose ceci :

              C:\Program Files\ZyXEL Communications Corporation\ZyXEL G-220F Utility\ZyXEL_G-220F_GUI.exe

              C:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2011\AutoEJCD.EXE

              si ca ne te dis rien, fais analyser ces fichiers ici :

              http://virusscan.jotti.org/de/

              et post les rapports generés ici .

              ensuite fais ceci :

              Télécharge combofix.exe (par sUBs) sur ton Bureau.

              -> http://download.bleepingcomputer.com/sUBs/ComboFix.exe

              -> Double clique combofix.exe.
              -> Tape sur la touche 1 (Yes) pour démarrer le scan.
              -> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

              NOTE : Le rapport se trouve également ici : C:\Combofix.txt

              @+
              1. Loutsky Auteur
                L'ordinateur possède déjà Kaspersky comme antivirus (il n'avait pas été mis à jour depuis un moement). Je vais voir pour installer un firewall (sur le reseau ou je suis pour l'instant, il n'y en a un).

                Les deux fichiers permettent le fonctionnement d'une clé USB pour le WIFI
                (C:\Program Files\ZyXEL Communications Corporation\ZyXEL G-220F Utility\ZyXEL_G-220F_GUI.exe
                et C:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2011\AutoEJCD.EXE )

                Voici le rapport que me donne combofix :

                ComboFix 07-12-09.1 - maxime 2007-12-11 10:51:38.1 - NTFSx86
                Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.533 [GMT 1:00]
                Running from: C:\Soft\ComboFix.exe
                * Created a new restore point
                .

                (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                .

                C:\Documents and Settings\maxime\Application Data\WinTouch
                C:\Documents and Settings\maxime\Application Data\WinTouch\wintouch.cfg
                C:\Documents and Settings\maxime\Menu Démarrer\Programmes\Outerinfo
                C:\Documents and Settings\maxime\Menu Démarrer\Programmes\Outerinfo\Terms.lnk
                C:\Documents and Settings\maxime\Menu Démarrer\Programmes\Outerinfo\Uninstall.lnk
                C:\Program Files\dobe~1
                C:\Program Files\dobe~1\?vchost.exe
                C:\Program Files\outerinfo
                C:\Program Files\outerinfo\FF\chrome.manifest
                C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt
                C:\Program Files\outerinfo\FF\install.rdf
                C:\Program Files\outerinfo\Terms.rtf
                C:\WINDOWS\crosof~1.net
                C:\WINDOWS\crosof~1.net\??crosoft.NET\
                C:\WINDOWS\crosof~1.net\notepad.exe
                C:\WINDOWS\racle~1
                C:\WINDOWS\system32\ajsqrnaw.dll
                C:\WINDOWS\system32\boxguftp.dll
                C:\WINDOWS\system32\bpgkkkmv.dll
                C:\WINDOWS\system32\ewuplgbe.dll
                C:\WINDOWS\system32\fasuxoqa.dll
                C:\WINDOWS\system32\fvcgblxn.dll
                C:\WINDOWS\system32\fvwcnlih.dll
                C:\WINDOWS\system32\hhhkj.bak1
                C:\WINDOWS\system32\hhhkj.bak2
                C:\WINDOWS\system32\hhhkj.ini
                C:\WINDOWS\system32\hhhkj.ini2
                C:\WINDOWS\system32\hhhkj.tmp
                C:\WINDOWS\system32\icgbnxdj.dll
                C:\WINDOWS\system32\ieinqtha.dll
                C:\WINDOWS\system32\ijrpemma.dll
                C:\WINDOWS\system32\iudicqqk.dll
                C:\WINDOWS\system32\jkhhh.dll
                C:\WINDOWS\system32\kovfibjc.dll
                C:\WINDOWS\system32\kwlhkuyg.dll
                C:\WINDOWS\system32\ljnvqdcx.ini
                C:\WINDOWS\system32\mpmumdfi.dll
                C:\WINDOWS\system32\ngygbeyp.dll
                C:\WINDOWS\system32\nxkxtpxt.dll
                C:\WINDOWS\system32\nxlbgcvf.ini
                C:\WINDOWS\system32\omtpybhg.dll
                C:\WINDOWS\system32\qdbffxuj.dll
                C:\WINDOWS\system32\rcetmfpt.dll
                C:\WINDOWS\system32\rcffdyky.dll
                C:\WINDOWS\system32\rwcjgohx.dll
                C:\WINDOWS\system32\sbtjqjsy.dll
                C:\WINDOWS\system32\scyuoyyp.dll
                C:\WINDOWS\system32\tejxebgn.dll
                C:\WINDOWS\system32\tgkurdmm.dll
                C:\WINDOWS\system32\tmjnylev.dll
                C:\WINDOWS\system32\tvdccfhy.dll
                C:\WINDOWS\system32\ucfbltaj.dll
                C:\WINDOWS\system32\vmkkkgpb.ini
                C:\WINDOWS\system32\vtjgnhnv.dll
                C:\WINDOWS\system32\xcdqvnjl.dll
                C:\WINDOWS\system32\xttubhoj.dll
                C:\WINDOWS\system32\ygetqjik.dll

                .
                ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-11 to 2007-12-11 ))))))))))))))))))))))))))))))))))))
                .

                2007-12-11 09:49 . 2007-12-11 10:49 <REP> d-------- C:\Soft
                2007-12-11 09:19 . 2007-12-11 09:19 <REP> d-------- C:\Program Files\CCleaner
                2007-12-10 18:42 . 2007-12-10 18:42 <REP> d-------- C:\Documents and Settings\maxime\Application Data\Lavasoft
                2007-12-10 18:41 . 2007-12-10 18:41 <REP> d-------- C:\Program Files\Lavasoft
                2007-12-10 12:19 . 2007-12-10 12:19 <REP> d-------- C:\Documents and Settings\maxime\Application Data\Grisoft
                2007-12-10 12:18 . 2007-12-10 12:18 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
                2007-12-10 11:37 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
                2007-12-10 11:37 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
                2007-12-10 11:37 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
                2007-12-10 11:37 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
                2007-12-10 11:37 . 2007-09-28 14:26 25,088 --a------ C:\WINDOWS\system32\WS2Fix.exe
                2007-12-10 11:37 . 2007-12-10 18:07 3,992 --a------ C:\WINDOWS\system32\tmp.reg
                2007-12-10 11:31 . 2007-12-10 11:31 54,156 --ah----- C:\WINDOWS\QTFont.qfn
                2007-12-10 11:31 . 2007-12-10 11:31 1,409 --a------ C:\WINDOWS\QTFont.for
                2007-12-06 21:52 . 2007-12-08 12:30 918,113 ---hs---- C:\WINDOWS\system32\rdxhvfpb.ini
                2007-12-04 21:53 . 2007-12-06 21:44 963,749 ---hs---- C:\WINDOWS\system32\jjxtuuyy.ini
                2007-12-02 17:07 . 2007-12-04 21:47 794,204 ---hs---- C:\WINDOWS\system32\wjbuorrr.ini
                2007-12-02 17:01 . 2007-12-02 17:10 143 --a------ C:\WINDOWS\system32\mcrh.tmp
                2007-11-30 19:08 . 2007-11-30 19:08 <REP> d-------- C:\Program Files\Windows Live Favorites
                2007-11-30 18:48 . 2007-12-02 17:01 834,657 ---hs---- C:\WINDOWS\system32\wrpqwsus.ini
                2007-11-29 22:07 . 2007-11-30 18:42 789,959 ---hs---- C:\WINDOWS\system32\sqdinkte.ini
                2007-11-29 21:59 . 2007-11-29 21:59 268 --ah----- C:\sqmdata03.sqm
                2007-11-29 21:59 . 2007-11-29 21:59 244 --ah----- C:\sqmnoopt03.sqm
                2007-11-29 21:57 . 2007-11-29 21:57 268 --ah----- C:\sqmdata02.sqm
                2007-11-29 21:57 . 2007-11-29 21:57 244 --ah----- C:\sqmnoopt02.sqm
                2007-11-28 21:44 . 2007-11-28 21:44 268 --ah----- C:\sqmdata01.sqm
                2007-11-28 21:44 . 2007-11-28 21:44 244 --ah----- C:\sqmnoopt01.sqm
                2007-11-25 11:40 . 2007-11-29 22:02 789,839 ---hs---- C:\WINDOWS\system32\rtqyrbin.ini
                2007-11-19 18:23 . 2007-11-22 22:26 685,943 ---hs---- C:\WINDOWS\system32\vahgvxjw.ini
                2007-11-16 20:06 . 2007-11-19 18:14 678,285 ---hs---- C:\WINDOWS\system32\ilodbywp.ini
                2007-11-13 19:24 . 2007-11-13 19:24 664,888 ---hs---- C:\WINDOWS\system32\xajopydr.ini

                .
                (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                .
                2007-12-10 09:54 --------- d-----w C:\Documents and Settings\maxime\Application Data\Sonic
                2007-12-04 21:37 --------- d-----w C:\Program Files\Windows Live Toolbar
                2007-12-04 21:00 --------- d-----w C:\Documents and Settings\maxime\Application Data\LimeWire
                2007-10-26 16:44 --------- d-----w C:\Program Files\iTunes
                2007-10-26 16:44 --------- d-----w C:\Program Files\iPod
                2007-10-26 16:41 --------- d-----w C:\Program Files\QuickTime
                2007-10-26 16:38 --------- d-----w C:\Program Files\Apple Software Update
                2007-10-26 16:37 --------- d-----w C:\Program Files\Fichiers communs\Apple
                2007-10-26 16:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
                .

                ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                .
                .
                REGEDIT4
                *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

                [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00]
                "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:55]
                "LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2006-07-26 13:00]
                "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-04 18:36]
                "Toae"="C:\WINDOWS\CROSOF~1.NET\notepad.exe" []
                "Vkh"="C:\Program Files\?dobe\?vchost.exe" []

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 14:42]
                "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-04-05 21:22]
                "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-04-05 21:19]
                "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-04-05 21:23]
                "KAV50"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for Workstation 5\kwsprod.exe" [2005-01-24 17:30]
                "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 08:04]
                "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 01:05]
                "UpdateManager"="C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2004-01-07 01:01]
                "AutoEJCD_0ACE2011"="C:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2011\AutoEJCD.exe" [2004-08-11 19:02]
                "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-12-09 14:32]
                "LogitechCameraAssistant"="C:\Program Files\Logitech\Video\CameraAssistant.exe" [2006-01-05 06:58]
                "LogitechVideo[inspector]"="C:\Program Files\Logitech\Video\InstallHelper.exe" [2006-01-05 07:15]
                "LogitechCameraService(E)"="C:\WINDOWS\system32\ElkCtrl.exe" [2004-11-01 16:22]
                "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" []
                "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06]
                "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-28 11:49]
                "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00]

                [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00]

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KLBLMain]
                @="Service"

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotbarOE]
                C:\Program Files\Hotbar\bin\10.0.356.0\OEAddOn.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotbarSA]
                C:\Program Files\Hotbar\bin\10.0.356.0\HotbarSA.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
                2007-09-26 13:42 267064 --a------ C:\Program Files\iTunes\iTunesHelper.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mezer]
                C:\Program Files\MSN Gaming Zone\mezer77798.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
                C:\Program Files\QuickTime\qttask.exe -atboottime

                R0 Klmc;Klmc;C:\WINDOWS\system32\Drivers\klmc.sys
                R3 LVPrcMon;Logitech LVPrcMon Driver;\??\C:\WINDOWS\system32\drivers\LVPrcMon.sys
                R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
                R3 ZDPNDIS5;ZDPNDIS5 NDIS Protocol Driver;\??\C:\WINDOWS\system32\ZDPNDIS5.SYS
                S3 USBAAPL;Apple Mobile USB Driver;C:\WINDOWS\system32\Drivers\usbaapl.sys
                S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys
                S3 ZD1211U(ZyXEL);ZyXEL G-220F 802.11g Wireless USB Adapter Driver (USB)(ZyXEL);C:\WINDOWS\system32\DRIVERS\zd1211u.sys

                [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{13575b14-959b-11da-aec2-0013493b8125}]
                \Shell\AutoRun\command - F:\LaunchU3.exe

                .
                Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
                "2007-10-26 16:38:33 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
                - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
                "2007-12-11 09:20:01 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
                .
                --------------------- DLLs Loaded Under Running Processes ---------------------

                PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
                -> C:\DOCUME~1\maxime\LOCALS~1\Temp\fkilvifxE.dll
                .
                **************************************************************************

                catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                Rootkit scan 2007-12-11 10:56:11
                Windows 5.1.2600 Service Pack 2 NTFS

                scanning hidden processes ...

                scanning hidden autostart entries ...

                scanning hidden files ...

                **************************************************************************
                .
                Completion time: 2007-12-11 10:57:52 - machine was rebooted
                .
                --- E O F ---
                1. g!rly Contributeur
                  re,

                  fais la mise a jour de kaspersky toute urgence puis occupe toi du par feu...

                  puis :

                  Copie le texte ci-dessous :

                  File::
                  C:\Program Files\Hotbar\bin\10.0.356.0\OEAddOn.exe
                  C:\Program Files\Hotbar\bin\10.0.356.0\HotbarSA.exe
                  C:\DOCUME~1\maxime\LOCALS~1\Temp\fkilvifxE.dll
                  C:\WINDOWS\system32\WS2Fix.exe
                  C:\WINDOWS\system32\tmp.reg
                  C:\WINDOWS\QTFont.qfn
                  C:\WINDOWS\QTFont.for
                  C:\WINDOWS\system32\rdxhvfpb.ini
                  C:\WINDOWS\system32\jjxtuuyy.ini
                  C:\WINDOWS\system32\wjbuorrr.ini
                  C:\WINDOWS\system32\mcrh.tmp
                  C:\WINDOWS\system32\wrpqwsus.ini
                  C:\WINDOWS\system32\sqdinkte.ini
                  C:\sqmdata03.sqm
                  C:\sqmnoopt03.sqm
                  C:\sqmdata02.sqm
                  C:\sqmnoopt02.sqm
                  C:\sqmdata01.sqm
                  C:\sqmnoopt01.sqm
                  C:\WINDOWS\system32\rtqyrbin.ini
                  C:\WINDOWS\system32\vahgvxjw.ini
                  C:\WINDOWS\system32\ilodbywp.ini
                  C:\WINDOWS\system32\xajopydr.ini

                  Registry::
                  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "Toae"=-
                  "Vkh"=-
                  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotbarOE]
                  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotbarSA]

                  Ouvre le Bloc-Notes puis colle le texte copié.
                  (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
                  Sauvegarde ce fichier sous le nom de CFScript.txt.

                  Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

                  http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

                  Cela va relancer Combofix,

                  Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

                  Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

                  Ne touche à rien tant que le scan n'est pas terminé.

                  Après redémarrage, poste le contenu du rapport Combofix2.txt

                  puis passe sdfix aussi apres combofix et post aussi le rapport

                  Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
                  http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
                  Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
                  • Redémarre ton ordinateur
                  • Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
                  • A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
                  • Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
                  • Choisis ton compte.
                  Déroule la liste des instructions ci-dessous :
                  • Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
                  • Appuie sur Y pour commencer le processus de nettoyage.
                  • Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
                  • Appuie sur une touche pour redémarrer le PC.
                  • Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
                  • Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
                  • Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
                  • Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
                  • Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

                  @+
                  1. Loutsky Auteur
                    Bonjour g!rly,
                    Merci de votre aide
                    J'ai fait ce que tu m'a ecrit et voici mes rapports :

                    Combofix :

                    ComboFix 07-12-09.1 - maxime 2007-12-18 9:42:02.2 - NTFSx86
                    Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.555 [GMT 1:00]
                    Running from: C:\Soft\ComboFix.exe
                    Command switches used :: C:\Documents and Settings\maxime\Bureau\CFScript.txt
                    * Created a new restore point
                    .

                    ((((((((((((((((((((((((((((( Fichiers créés 2007-11-18 to 2007-12-18 ))))))))))))))))))))))))))))))))))))
                    .

                    2007-12-18 09:27 . 2007-12-18 09:27 <REP> d-------- C:\WINDOWS\LastGood
                    2007-12-11 09:49 . 2007-12-11 10:49 <REP> d-------- C:\Soft
                    2007-12-11 09:19 . 2007-12-11 09:19 <REP> d-------- C:\Program Files\CCleaner
                    2007-12-10 18:42 . 2007-12-10 18:42 <REP> d-------- C:\Documents and Settings\maxime\Application Data\Lavasoft
                    2007-12-10 18:41 . 2007-12-10 18:41 <REP> d-------- C:\Program Files\Lavasoft
                    2007-12-10 12:19 . 2007-12-10 12:19 <REP> d-------- C:\Documents and Settings\maxime\Application Data\Grisoft
                    2007-12-10 12:18 . 2007-12-10 12:18 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
                    2007-12-10 11:37 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
                    2007-12-10 11:37 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
                    2007-12-10 11:37 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
                    2007-12-10 11:37 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
                    2007-12-10 11:37 . 2007-09-28 14:26 25,088 --a------ C:\WINDOWS\system32\WS2Fix.exe
                    2007-12-10 11:37 . 2007-12-10 18:07 3,992 --a------ C:\WINDOWS\system32\tmp.reg
                    2007-12-10 11:31 . 2007-12-10 11:31 54,156 --ah----- C:\WINDOWS\QTFont.qfn
                    2007-12-10 11:31 . 2007-12-10 11:31 1,409 --a------ C:\WINDOWS\QTFont.for
                    2007-12-06 21:52 . 2007-12-08 12:30 918,113 ---hs---- C:\WINDOWS\system32\rdxhvfpb.ini
                    2007-12-04 21:53 . 2007-12-06 21:44 963,749 ---hs---- C:\WINDOWS\system32\jjxtuuyy.ini
                    2007-12-02 17:07 . 2007-12-04 21:47 794,204 ---hs---- C:\WINDOWS\system32\wjbuorrr.ini
                    2007-12-02 17:01 . 2007-12-02 17:10 143 --a------ C:\WINDOWS\system32\mcrh.tmp
                    2007-11-30 19:08 . 2007-11-30 19:08 <REP> d-------- C:\Program Files\Windows Live Favorites
                    2007-11-30 18:48 . 2007-12-02 17:01 834,657 ---hs---- C:\WINDOWS\system32\wrpqwsus.ini
                    2007-11-29 22:07 . 2007-11-30 18:42 789,959 ---hs---- C:\WINDOWS\system32\sqdinkte.ini
                    2007-11-29 21:59 . 2007-11-29 21:59 268 --ah----- C:\sqmdata03.sqm
                    2007-11-29 21:59 . 2007-11-29 21:59 244 --ah----- C:\sqmnoopt03.sqm
                    2007-11-29 21:57 . 2007-11-29 21:57 268 --ah----- C:\sqmdata02.sqm
                    2007-11-29 21:57 . 2007-11-29 21:57 244 --ah----- C:\sqmnoopt02.sqm
                    2007-11-28 21:44 . 2007-11-28 21:44 268 --ah----- C:\sqmdata01.sqm
                    2007-11-28 21:44 . 2007-11-28 21:44 244 --ah----- C:\sqmnoopt01.sqm
                    2007-11-25 11:40 . 2007-11-29 22:02 789,839 ---hs---- C:\WINDOWS\system32\rtqyrbin.ini
                    2007-11-19 18:23 . 2007-11-22 22:26 685,943 ---hs---- C:\WINDOWS\system32\vahgvxjw.ini

                    .
                    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                    .
                    2007-12-10 09:54 --------- d-----w C:\Documents and Settings\maxime\Application Data\Sonic
                    2007-12-10 09:34 46,080 ----a-w C:\WINDOWS\system32\ftp.exe
                    2007-12-04 21:37 --------- d-----w C:\Program Files\Windows Live Toolbar
                    2007-12-04 21:00 --------- d-----w C:\Documents and Settings\maxime\Application Data\LimeWire
                    2007-10-26 16:44 --------- d-----w C:\Program Files\iTunes
                    2007-10-26 16:44 --------- d-----w C:\Program Files\iPod
                    2007-10-26 16:41 --------- d-----w C:\Program Files\QuickTime
                    2007-10-26 16:38 --------- d-----w C:\Program Files\Apple Software Update
                    2007-10-26 16:37 --------- d-----w C:\Program Files\Fichiers communs\Apple
                    2007-10-26 16:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
                    .

                    ((((((((((((((((((((((((((((( snapshot@2007-12-11_10.56.22.25 )))))))))))))))))))))))))))))))))))))))))
                    .
                    .
                    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                    .
                    .
                    REGEDIT4
                    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

                    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00]
                    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:55]
                    "LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2006-07-26 13:00]
                    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-04 18:36]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                    "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 14:42]
                    "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-04-05 21:22]
                    "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-04-05 21:19]
                    "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-04-05 21:23]
                    "KAV50"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for Workstation 5\kwsprod.exe" [2005-01-24 17:30]
                    "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 08:04]
                    "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 01:05]
                    "UpdateManager"="C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2004-01-07 01:01]
                    "AutoEJCD_0ACE2011"="C:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2011\AutoEJCD.exe" [2004-08-11 19:02]
                    "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-12-09 14:32]
                    "LogitechCameraAssistant"="C:\Program Files\Logitech\Video\CameraAssistant.exe" [2006-01-05 06:58]
                    "LogitechVideo[inspector]"="C:\Program Files\Logitech\Video\InstallHelper.exe" [2006-01-05 07:15]
                    "LogitechCameraService(E)"="C:\WINDOWS\system32\ElkCtrl.exe" [2004-11-01 16:22]
                    "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" [2005-06-23 20:33]
                    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06]
                    "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-28 11:49]
                    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00]

                    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00]

                    C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                    Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2006-07-26 13:00:57]
                    ZyXEL G-220F Utility GUI.lnk - C:\Program Files\ZyXEL Communications Corporation\ZyXEL G-220F Utility\ZyXEL_G-220F_GUI.exe [2006-02-03 09:15:35]

                    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KLBLMain]
                    @="Service"

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
                    2007-09-26 13:42 267064 --a------ C:\Program Files\iTunes\iTunesHelper.exe

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mezer]
                    C:\Program Files\MSN Gaming Zone\mezer77798.exe

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
                    C:\Program Files\QuickTime\qttask.exe -atboottime

                    R0 Klmc;Klmc;C:\WINDOWS\system32\Drivers\klmc.sys
                    R3 LVPrcMon;Logitech LVPrcMon Driver;\??\C:\WINDOWS\system32\drivers\LVPrcMon.sys
                    R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
                    R3 ZDPNDIS5;ZDPNDIS5 NDIS Protocol Driver;\??\C:\WINDOWS\system32\ZDPNDIS5.SYS
                    S3 USBAAPL;Apple Mobile USB Driver;C:\WINDOWS\system32\Drivers\usbaapl.sys
                    S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys
                    S3 ZD1211U(ZyXEL);ZyXEL G-220F 802.11g Wireless USB Adapter Driver (USB)(ZyXEL);C:\WINDOWS\system32\DRIVERS\zd1211u.sys

                    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{13575b14-959b-11da-aec2-0013493b8125}]
                    \Shell\AutoRun\command - F:\LaunchU3.exe

                    .
                    Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
                    "2007-10-26 16:38:33 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
                    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe

                    "2007-12-11 10:20:00 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
                    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
                    .
                    **************************************************************************

                    catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                    Rootkit scan 2007-12-18 09:43:18
                    Windows 5.1.2600 Service Pack 2 NTFS

                    scanning hidden processes ...

                    scanning hidden autostart entries ...

                    scanning hidden files ...

                    **************************************************************************
                    .
                    Completion time: 2007-12-18 9:44:31
                    C:\ComboFix2.txt ... 2007-12-11 10:57
                    .
                    --- E O F ---

                    et mon rapport SDFix :

                    SDFix: Version 1.118

                    Run by maxime on 18/12/2007 at 09:56

                    Microsoft Windows XP [version 5.1.2600]

                    Running From: C:\SDFix

                    Safe Mode:
                    Checking Services:

                    Restoring Windows Registry Values
                    Restoring Windows Default Hosts File

                    Rebooting...

                    Normal Mode:
                    Checking Files:

                    Trojan Files Found:

                    C:\PROGRA~1\WINDOW~2\RTEMEK~1.HTM - Deleted

                    Removing Temp Files...

                    ADS Check:

                    C:\WINDOWS
                    No streams found.

                    C:\WINDOWS\system32
                    No streams found.

                    C:\WINDOWS\system32\svchost.exe
                    No streams found.

                    C:\WINDOWS\system32\ntoskrnl.exe
                    No streams found.

                    Final Check:

                    catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                    Rootkit scan 2007-12-18 10:00:41
                    Windows 5.1.2600 Service Pack 2 NTFS

                    scanning hidden processes ...

                    IPC error: 2 Le fichier spécifié est introuvable.
                    scanning hidden services & system hive ...

                    scanning hidden registry entries ...

                    scanning hidden files ...

                    scan completed successfully
                    hidden processes: 0
                    hidden services: 0
                    hidden files: 25351

                    Remaining Services:
                    ------------------

                    Authorized Application Key Export:

                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
                    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Messenger"
                    "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"

                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

                    Remaining Files:
                    ---------------

                    File Backups: - C:\SDFix\backups\backups.zip

                    Files with Hidden Attributes:

                    Thu 5 Aug 2004 60,416 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe"
                    Thu 18 Jan 2001 32,768 A..H. --- "C:\Program Files\RM-X DVrecorder\ASProtect.dll"
                    Thu 25 Oct 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
                    Fri 21 Sep 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\778fd2fc3fe6b905e366b5ddbba384c8\BIT38.tmp"
                    Sun 7 Oct 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b8426e25532eb668f59dd4d969b4a550\BIT23.tmp"

                    Finished!
                    1. Loutsky Auteur
                      Bonsoir,

                      Quelqu'un pourrais me dire si mes deux derniers rapports ne presentent rien de suspect svp.

                      Merci d'avance
                      1. g!rly Contributeur
                        salut

                        peux tu refqire un combofix et poster le rapport ici stp

                        a+
                        1. orb42
                          essaye dejà de supprimer ces fichiers et dossiers:

                          C:\WINDOWS\system32\ncompat.tlb
                          C:\WINDOWS\system32\ot.ico
                          C:\WINDOWS\system32\stdole3.tlb
                          C:\WINDOWS\system32\ts.ico
                          C:\WINDOWS\system32\1024\

                          effectue un scan avec avg antispyware:
                          http://www.grisoft.cz/filedir/inst/avgas-setup-7.5.1.43.exe

                          ensuite poste un log hijackthis
                          1. ^^Marie^^
                            Salut

                            NON

                            Il suffit de passer l'option 2 de smitfraud qui fera son travail

                        2. orb42
                          lance hijackthis et fixe ces lignes:

                          O3 - Toolbar: Mirar - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - C:\WINDOWS\system32\WinNB58.dll (file missing)
                          O4 - HKLM\..\Run: [08330227] rundll32.exe "C:\WINDOWS\system32\bpgkkkmv.dll",b
                          O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} -
                          C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
                          O15 - Trusted Zone: http://click.getmirar.com (HKLM)
                          O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)
                          O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)
                          O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
                          O16 - DPF: {8A0DCBDB-6E20-489C-9041-C1E8A0352E75} (Mirar_Dummy_ATS1 Class) - http://awbeta.net-nucleus.com/FIX/WinATS.cab
                          O17 - HKLM\System\CCS\Services\Tcpip\..\{EFED3DE9-161A-450E-80E4-C058033BBB86}: NameServer = 194.2.0.20,194.2.0.50
                          O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00698E4.dat
                          1. ^^Marie^^
                            Salut

                            O17 - HKLM\System\CCS\Services\Tcpip\..\{EFED3DE9-161A-450E-80E4-C058033BBB86}: NameServer = 194.2.0.20,194.2.0.50

                            Pourquoi ???

                        3. orb42
                          tu as raison il faudrait lancer l'option 5 de smitfraudfix pour verifier qu'il ne s'agit pas d'un detournement de DNS.
                          Sinon les autres entrées il peut les fixer.

                          Discussions similaires

                          Nouveau tag ajouté | Nouvelle option activé sans permission?
                          BountyFullChest

                          1 réponse
                          Huawei P8 Lite "nouveau tag ajouté"
                          ArianeKathleen

                          25 réponses
                          Nouveau tag ajouté - Utilité
                          Eerfers

                          1 réponse
                          Impossible d'afficher le rapport de tableau croisé dynamique sur un rapport
                          Utilisateur anonyme

                          13 réponses
                          Google Chrome "  Échec de l'analyse antivirus "
                          jmpower

                          18 réponses