Trojan? HijackThis scan result log

Question

Bonjour à vous tous, spécialistes.

J'ai fait un scan avec HijackThis et en voivi le résultat. Pouvez-vous me dire quoi faire maintenant?

Merci d'avance,
Seattle Ignorant

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:31:57 PM, on 3/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\MICROS~3apimgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\system32
tvdm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\WINDOWS\sv.exe
C:\WINDOWS\svc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32
tos.exe,
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IE7Pro\IE7Pro.dll
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL
O2 - BHO: ElnkScamBHO Class - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: ElnkPubBHO Class - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPuB.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ElnkProtectionBHO Class - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: Microsoft copyright - {971D5B7B-F7DF-43ee-B771-6B7FA09975C3} - sipov.dll (file missing)
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O2 - BHO: TBSB02678 - {BDCA7AC9-C27B-4D30-A808-9B9081279C03} - C:\PROGRA~1\QUICKN~1\YOUTUB~1.DLL
O2 - BHO: ElnkLegacyUninstBHO Class - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL
O3 - Toolbar: Youtube-Download-Convert-Toolbar - {6AE02E1C-8859-4F57-9097-5A55A56A4CAF} - C:\Program Files\Quicknation\YouTubeDownload-Convert.dll
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [netsv32] C:\WINDOWS\sv.exe
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" /m=0
O4 - HKLM\..\Run: [netc] C:\WINDOWS\svc.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsft Windows Adapter 5.1.3013] C:\Documents and Settings\Owner\Application Data\hxwdlea.exe
O4 - HKCU\..\Run: [userinit] C:\WINDOWS\system32
tos.exe
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [userinit] C:\WINDOWS\system32
tos.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [SetDefaultMidi] MIDIDEF.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [SetDefaultMidi] MIDIDEF.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Download File - C:\Program Files\Winferno\Secure IE\Scripts\AddToTransferQueue.htm
O8 - Extra context menu item: &Highlight - C:\Program Files\Winferno\Secure IE\Scripts\highlight.htm
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll/search.htm
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZSzed095YYUS_ZNxdm117IYUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: EarthLink Google Search - res://C:\Program Files\EarthLink TotalAccess\Toolbar\SearchUI.dll/search.html
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/229?bb6778072776431b91e43b41c210d5c0
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/230?bb6778072776431b91e43b41c210d5c0
O8 - Extra context menu item: Zoom &In - C:\Program Files\Winferno\Secure IE\Scripts\zoomin.htm
O8 - Extra context menu item: Zoom O&ut - C:\Program Files\Winferno\Secure IE\Scripts\zoomout.htm
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: webmail.pas.earthlink.net
O15 - Trusted Zone: *.mcafee.com
O15 - Trusted Zone: http://www.secuser.com
O15 - Trusted Zone: owa.tahoma.wednet.edu
O15 - Trusted Zone: http://www.tahoma.wednet.edu
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://cdn2.zone.msn.com/binframework/v10/ZAxRcMgr.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5126/mcfscan.cab
O18 - Protocol: bw+0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Logical Disk Manager dmserverose (dmserverose) - Unknown owner - C:\WINDOWS\system32\~.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Utilisateur anonyme · Answer

Bonsoir,

lol

Bon il y a du ménage...

Commençons par un bon coup de sot d'eau au détergents :

> Les logiciels suivants (AVG et Ccleaner) te seront utiles par la suite - ils sont à conserver...

> Télécharge et installe sur ton PC AVG anti-spyware (si tu as déjà les programmes alors fais juste les mises à jour) : http://www.commentcamarche.net/telecharger/telecharger 218 avg anti spyware, fais les mises à jour puis ferme le programme.

> Télécharge et installe Ccleaner : https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html fais les mises à jour puis ferme le programme.
Si besoin est tu trouveras des Tutoriaux ici :
https://kerio.probb.fr/t242-tuto-ccleaner-v-2 , https://www.malekal.com/tutoriel-ccleaner/ et [http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner

> Télécharge Cleaner : http://www.malekal.com/download/clean.zip (différent de Ccleaner),

> Télécharge SDFix sur ton bureau
- Double clique sur l'archive SDFix qui à été créé sur le Bureau et installe le programme (l'installation va créer un dossier (à la racine du disque dur par défaut) nommé SDFix). Ferme ensuite le programme.

> Commence par faire un copier/coller de ce poste : (conseillé)
Ouvre un nouveau fichier Bloc notes (clique sur "Démarrer" => "Programmes" =>"Accessoires" => "Bloc notes"),
puis fait un copier/coller de tout le contenu de la fenêtre de ce poste dans le fichier texte.
Sauvegarde le sur le bureau, tu pourras y avoir accès même déconnecté ou en mode sans échec.

> Démarre en mode sans échec : (image). Si problème : tuto ici

> Lance AVG,
- Clique sur le menu Analyse (de la barre d'outils). Clique après sur l'onglet Paramètres, puis <Dans Comment réagir?> clique sur <Actions recommandées> et choisi <Quarantaine>.
- Vérifie que toutes les cases sont cochées dans <Comment faire l'analyse ?> et dans <Programmes potentiellement dangereux> et vérifie que le bouton-radio <Générer un rapport après chaque analyse> soit aussi coché.
- Vas dans l'onglet 'Analyse', puis clique <Analyse complète du système>.
Remarque : Une fois l'analyse terminée, il faut faire un clique droit sur un fichier infecté et demander à "AVG Anti-Spyware 7.5" de le supprimer.
Puis clique sur "Appliquer toutes les actions" afin de tout supprimer automatiquement.
- Clique sur "Enregistrer le rapport" puis enregistre le sur ton bureau.
- Fais un copier/coller du rapport généré dans ton prochain poste.

> Lance Ccleaner,
- Choisi l’onglet "Options" puis clique sur "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier temp de Windows, plus vieux que 48 heures" (tout doit être supprimé).
- Dans l'onglet "Nettoyeur" clique sur "Analyse".
- Une fois l'analyse terminée, clique sur "Lancer le Nettoyage".
- Dans l'onglet "registre" => Recherches des erreurs => Réparer les erreurs sélectionnées => enregistre une sauvegarde => corriger toutes erreurs sélectionnées => ok => fermer.
N.B : Si Ccleaner te propose d'enregistrer une sauvegarde, reponds oui et enregistre sous 'Bureau'
Recommence jusqu’à ce qu’il ne trouve plus rien (cela varie en général entre 1 et 4 fois).

> Pour Clean (encore en mode sans échec) :
- Double-clic sur clean.cmd
- Une fenêtre va apparaître, choisis l'option 2, suis les consignes et poste le rapport clean
NB : Si besoin, clean : http://mickael.barroux.free.fr/securite/clean.php

> Pour SDFix (toujours en mode sans échec) :
- Vas dans c:/SDFix et double-clique sur RunThis.bat
- Appuie sur < Y > puis < Entrée >....Le nettoyage commance....patience...
- Le programme va te demander de relancer le PC, frappe une touche...
- Le nettoyage se termine...un rapport apparait...
-Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse

> Relance ton PC en mode normal

> Relance Hijackthis :
Puis sélectionne < do a system scan and save a logfile >,

Et envoie moi, par collier/coller, ton log Hijackthis stp,

Bon courage,

:)

A+

booddha · Answer

Bonsoir
Ne pas surfer ailleurs que sur le site
Couper MSN ou tout autre connexion hormis celle sur le site
Appliquer exactement les procédures indiquées.
Rester devant la machine en rafraichissant souvent le forum pour voir les nouvelles réponses.
Répondre sans attendre à toutes les questions posées
Ne pas quitter tant qu'il n'est pas dit explicitement que le problème est résolu ou qu'il
dépasse les compétences de celui ou ceux qui vous aident.

Ne pas oublier : nous sommes des bénévoles.
Une réponse peut mettre un certain temps à parvenir. Cela ne veut pas dire qu'on vous oublie.
Nous mangeons, nous dormons nous avons une vie de famille aussi.


Préalable
	•	Vider la corbeille
	•	Fermer toutes les applications

===================== CCLEANER ========================

Nettoyage avec CCleaner
On va commencer par faire un peu le ménage

	•	Télécharger CCLeaner et l'installer sur le bureau en refusant l'installation de la barre Yahoo.
	        http://download.piriform.com/ccsetup205.exe
	•	Fermer toutes les applications
	•	Lancer CCLeaner
	        S'il n'est pas en Français cliquer sur Options, Setting, Language 
          et sélectionner Français
	•	cocher dans le menu Nettoyeur - onglet Windows :
	        Internet Explorer: Fichiers Internet Temporaires, Cookies
	•	Système: Vider la Poubelle, Fichiers Temporaires, Presse-papiers
	•	Avancé: Vieilles données du Prefetch
	•	Décocher dans le menu Options - sous-menu Avancé :
	        Effacer uniquement les fichiers, du dossier temp de Windows, plus vieux que 48 heures
	•	Cocher dans le menu Nettoyeur - onglet Applications : Internet: Sun Java
	•	Cocher , si cela est possible, dans le menu Nettoyeur - onglet Applications :
	        Firefox/Mozilla: Cache Internet, Cookies 
	•	Click sur Analyse
	•	Click sur le bouton Lancer le nettoyage dans le menu Nettoyeur. 
	•	Click sur Registre
	•	Sélectionner tout
	•	Click sur Chercher des erreurs (En bas)

	Une fois le scan terminé sélectionner tout  
	•	Click sur Réparer les erreurs sélectionnées
Relancer la machine mettre un nouveau rapport HitjackThis

seattle.ignorant · Answer

Wow, merci booddha. Il y a en effet du travail... Je m'y mets de suite et je poste les logs.

A +

seattle.ignorant · Answer

Ah je m'excuse DllD, C'est toi que je dois remercier, et pas seulement boodha. Oopsy! Merci et à +

Je m'y mets, promis

seattle.ignorant · Answer

OK, voilà donc les rapports de AVG, clean et SDFix

AVG Anti-Spyware - Scan Report
---------------------------------------------------------

 + Created at:	8:14:26 PM 3/1/2008

 + Scan result:	



C:\Program Files\Common Files\Real\WeatherBug\MiniBugTransporter.dll -> Adware.Minibug : Cleaned.
HKLM\SOFTWARE\Classes\CLSID\{6AE02E1C-8859-4F57-9097-5A55A56A4CAF} -> Adware.MyTool : Cleaned.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{6AE02E1C-8859-4F57-9097-5A55A56A4CAF} -> Adware.MyTool : Cleaned.
HKU\S-1-5-21-3962291611-4163577834-692928192-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{6AE02E1C-8859-4F57-9097-5A55A56A4CAF} -> Adware.MyTool : Cleaned.
HKU\S-1-5-21-3962291611-4163577834-692928192-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6AE02E1C-8859-4F57-9097-5A55A56A4CAF} -> Adware.MyTool : Cleaned.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\O9O7QDLH\xpl[1].wmf -> Exploit.MS05-053-WMF : Cleaned.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\SS0RJ8A3\xpl[1].wmf -> Exploit.MS05-053-WMF : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@sexlist[2].txt -> TrackingCookie.Sexlist : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@counter15.sextracker[1].txt -> TrackingCookie.Sextracker : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@sextracker[1].txt -> TrackingCookie.Sextracker : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@anad.tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.


::Report end

___________________________________________________________________________________________
Script executed in Safe Mode 
Rapport clean par Malekal_morte - http://www.malekal.com 
Script executed in Safe Mode Sat 03/01/2008 a 20:49:28.82 

Microsoft Windows XP [Version 5.1.2600]
 
*** Suppression  C: 
 
*** Suppression  C:\WINDOWS\ 
 
*** Suppression  C:\WINDOWS\system32 
 
*** Suppression  C:\Program Files 
tentative de suppression de "C:\Program Files\MyWebSearch\" 
Impossible de supprimer "C:\Program Files\MyWebSearch\"  
 
*** Deletion of the registry keys successful.. 
*** End of the report ! 

_________________________________________________________________________________________

[b]SDFix: Version 1.150 /b

Run by Owner on Sat 03/01/2008 at 08:56 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services /b:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


[b]Checking Files /b: 

Trojan Files Found:

C:\WINDOWS\SYSTEM32\FM20EN~1.DLL - Deleted
C:\WINDOWS\system32\~.exe  - Deleted
C:\WINDOWS\system32\sft.res  - Deleted
C:\WINDOWS\system32\sipov.dll  - Deleted
C:\WINDOWS\system32
tos.exe  - Deleted
C:\WINDOWS\system32\wsnpoem\audio.dll  - Deleted
C:\WINDOWS\system32\wsnpoem\audio.dll.cla  - Deleted
C:\WINDOWS\system32\wsnpoem\video.dll  - Deleted



Folder C:\WINDOWS\system32\wsnpoem - Removed


Removing Temp Files

[b]ADS Check /b:
 


                                 [b]Final Check /b:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-01 21:09:35
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update]
"NextDetectionTime"="2008-03-02 05:07:46"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Detect]
"LastSuccessTime"="2008-03-01 05:36:46"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services /b:



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\WINDOWS\surfmonkey\SMProxy.exe"="C:\WINDOWS\surfmonkey\SMProxy.exe:*:Enabled:EarthLink Parental Controls"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\Program Files\Common Files\Adobe\ESD\AdobeDownloadManager.exe"="C:\Program Files\Common Files\Adobe\ESD\AdobeDownloadManager.exe:LocalSubNet:Enabled:Adobe Download Manager"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposid01.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\Windows Media Player\wmplayer.exe"="C:\Program Files\Windows Media Player\wmplayer.exe:*:Enabled:Windows Media Player"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[b]Remaining Files /b:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes /b:

Fri 22 Mar 2002        36,864 A.SHR --- "C:\Program Files\Detto\DettoWeb.exe"
Fri 22 Mar 2002     2,513,981 A.SHR --- "C:\Program Files\Detto\IntelliMover Demo.exe"
Wed 18 May 2005         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 23 Jan 2007           401 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv16.bak"
Wed 18 May 2005           401 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv18.bak"
Wed 18 May 2005           400 A.SH. --- "C:\Documents and Settings\All Users\DRM\v2ks.bla.bak"
Wed 18 May 2005            48 A.SH. --- "C:\Documents and Settings\All Users\DRM\v2ks.sec.bak"
Wed 18 May 2005           400 A.SH. --- "C:\Documents and Settings\All Users\DRM\v3ks.bla.bak"
Sun  2 Apr 2006        96,256 A..H. --- "C:\Documents and Settings\Owner\Desktop\~WRL0476.tmp"
Sat 16 Dec 2006           114 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti2D.tmp"
Fri 17 Aug 2007             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Sun 13 Jan 2008        37,888 ...H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\~WRL2535.tmp"
Thu  4 Jan 2007        32,256 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Templates\~WRL3803.tmp"
Tue 12 Dec 2006        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL0003.tmp"
Wed  8 Nov 2006        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL0004.tmp"
Fri  1 Dec 2006        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL0005.tmp"
Wed 27 Dec 2006        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL0006.tmp"
Wed  7 Mar 2007        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL0007.tmp"
Mon  7 May 2007        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL0008.tmp"
Mon 11 Jun 2007        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL0009.tmp"
Thu  2 Nov 2006        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL0164.tmp"
Wed 13 Dec 2006        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL0665.tmp"
Wed 13 Dec 2006        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL1004.tmp"
Mon  9 Apr 2007        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL1089.tmp"
Mon 26 Nov 2007        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL1291.tmp"
Tue 13 Mar 2007        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL1332.tmp"
Wed 16 May 2007        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL1735.tmp"
Mon 28 Jan 2008        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL1736.tmp"
Sun 17 Jun 2007        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL1813.tmp"
Mon 31 Oct 2005        29,696 A..H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL2591.tmp"
Mon 17 Sep 2007        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL2790.tmp"
Wed 13 Dec 2006        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL2824.tmp"
Mon  7 May 2007        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL2843.tmp"
Sat  7 Apr 2007        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL2988.tmp"
Fri 23 Nov 2007        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL3161.tmp"
Tue 16 Oct 2007        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL3216.tmp"
Mon 11 Dec 2006        30,208 ...H. --- "C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL3497.tmp"
Mon 29 May 2006        20,992 ...H. --- "C:\Documents and Settings\Owner\My Documents\Nath\GeneralTeaching\~WRL1385.tmp"
Thu  8 Sep 2005        21,504 A..H. --- "C:\Documents and Settings\Owner\My Documents\Nath\Household\~WRL1921.tmp"
Wed 16 May 2007        40,960 ...H. --- "C:\Documents and Settings\Owner\My Documents\Nath\Perso\~WRL1868.tmp"
Sun 15 May 2005         1,610 A.SH. --- "C:\Documents and Settings\Owner\Application Data\Roxio\Dragon\DiscInfoCache\HP_______DVD_Writer_300n__1.25_300_DICV017_DRGV200021C.TMP"
Mon  7 May 2007        32,768 ...H. --- "C:\Documents and Settings\Owner\My Documents\Nath\THS 2006-2007\Look I Can Talk More\~WRL2432.tmp"
Wed 25 Apr 2007        34,304 ...H. --- "C:\Documents and Settings\Owner\My Documents\Nath\THS 2006-2007\United Streaming\~WRL1333.tmp"
Mon 17 Sep 2007        32,768 ...H. --- "C:\Documents and Settings\Owner\My Documents\Nath\THS 2007-2008\French I-II\~WRL1506.tmp"
Mon 17 Sep 2007        35,328 ...H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Football\2007\~WRL0199.tmp"
Sun 26 Feb 2006       335,872 A..H. --- "C:\Documents and Settings\Owner\My Documents\Nath\GeneralTeaching\THS 2005-2006\Chapitre VI\~WRL1442.tmp"
Sun 26 Feb 2006       616,448 A..H. --- "C:\Documents and Settings\Owner\My Documents\Nath\GeneralTeaching\THS 2005-2006\Chapitre VI\~WRL2268.tmp"
Sun 26 Feb 2006        20,480 A..H. --- "C:\Documents and Settings\Owner\My Documents\Nath\GeneralTeaching\THS 2005-2006\Chapitre VI\~WRL2729.tmp"
Sun 26 Feb 2006       624,128 A..H. --- "C:\Documents and Settings\Owner\My Documents\Nath\GeneralTeaching\THS 2005-2006\Chapitre VI\~WRL3649.tmp"
Mon 30 Jan 2006        28,160 A..H. --- "C:\Documents and Settings\Owner\My Documents\Nath\GeneralTeaching\THS 2005-2006\Chapitre V\~WRL1803.tmp"
Fri  6 Oct 2006       261,120 ...H. --- "C:\Documents and Settings\Owner\My Documents\Nath\THS 2006-2007\Raconte-Moi Davantage\RMD I\~WRL3832.tmp"
Tue 29 Aug 2006       118,784 ...H. --- "C:\Documents and Settings\Owner\My Documents\Nath\THS 2006-2007\Raconte-Moi Davantage\RMD IV\~WRL1211.tmp"
Mon  1 Sep 2003       134,144 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\2004\AP Psychology\Chapter 2\~WRL1713.tmp"
Mon  1 Sep 2003       202,240 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\2004\AP Psychology\Chapter 2\~WRL1889.tmp"
Mon  1 Sep 2003       110,592 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\2004\AP Psychology\Chapter 2\~WRL2083.tmp"
Mon  1 Sep 2003       213,504 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\2004\AP Psychology\Chapter 2\~WRL2585.tmp"
Mon  1 Sep 2003       120,832 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\2004\AP Psychology\Chapter 2\~WRL2625.tmp"
Thu  4 Sep 2003        24,576 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\2004\Psychology\Chapter 6 - Brain and Nervous System\~WRL3828.tmp"
Sun 13 Jan 2002        22,016 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\2004\Rex's Documents\Golf\~WRL1687.tmp"
Sun 13 Jan 2002        26,112 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\2004\Rex's Documents\Golf\~WRL2207.tmp"
Sun 11 Jun 2006        43,008 ...H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Masters\EDU 530 Summer 2006\Module 4\~WRL1622.tmp"
Sun 24 Jun 2007        32,256 ...H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Masters\EDU 560 Spring 2007\Module 7\~WRL0146.tmp"
Mon 16 Dec 2002       239,104 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Rex's Documents\2004\Rex's Documents\~WRL4057.tmp"
Sat 26 Nov 2005        39,936 A..H. --- "C:\Documents and Settings\Owner\My Documents\Nath\GeneralTeaching\THS 2005-2006\Chapitre IV\Assessment\~WRL0710.tmp"
Fri 25 Nov 2005        48,640 A..H. --- "C:\Documents and Settings\Owner\My Documents\Nath\GeneralTeaching\THS 2005-2006\Chapitre IV\ChIVL3\~WRL1595.tmp"
Wed 27 Sep 2006        25,600 ...H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Football\Football Folder\Coaching Staff Folder\Blog\~WRL1253.tmp"
Tue 29 Oct 2002        54,784 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Rex's Documents\2004\Rex's Documents\HighlandPark\~WRL3114.tmp"
Wed 31 Aug 2005        38,912 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Football\Football Folder\Kentwood Scouting Folder\Opponents\Auburn 2005\~WRL0001.tmp"
Mon 21 Jan 2002        25,600 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Rex's Documents\2004\Rex's Documents\HighlandPark\HPFOOTBALL\~WRL2181.tmp"
Mon 16 Dec 2002       120,832 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Rex's Documents\2004\Rex's Documents\HighlandPark\W. Geo\World Geography\~WRL0201.tmp"
Mon 16 Dec 2002       121,344 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Rex's Documents\2004\Rex's Documents\HighlandPark\W. Geo\World Geography\~WRL0546.tmp"
Mon 16 Dec 2002       124,416 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Rex's Documents\2004\Rex's Documents\HighlandPark\W. Geo\World Geography\~WRL0732.tmp"
Mon 16 Dec 2002       123,392 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Rex's Documents\2004\Rex's Documents\HighlandPark\W. Geo\World Geography\~WRL1272.tmp"
Mon 16 Dec 2002       117,248 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Rex's Documents\2004\Rex's Documents\HighlandPark\W. Geo\World Geography\~WRL1675.tmp"
Mon 16 Dec 2002       120,320 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Rex's Documents\2004\Rex's Documents\HighlandPark\W. Geo\World Geography\~WRL1726.tmp"
Mon 16 Dec 2002       123,392 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Rex's Documents\2004\Rex's Documents\HighlandPark\W. Geo\World Geography\~WRL2206.tmp"
Mon 16 Dec 2002       121,856 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Rex's Documents\2004\Rex's Documents\HighlandPark\W. Geo\World Geography\~WRL2381.tmp"
Mon 16 Dec 2002       121,856 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Rex's Documents\2004\Rex's Documents\HighlandPark\W. Geo\World Geography\~WRL2957.tmp"
Mon 16 Dec 2002       121,344 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Rex's Documents\2004\Rex's Documents\HighlandPark\W. Geo\World Geography\~WRL2966.tmp"
Mon 16 Dec 2002       118,784 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Rex's Documents\2004\Rex's Documents\HighlandPark\W. Geo\World Geography\~WRL3158.tmp"
Mon 16 Dec 2002       124,416 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Rex's Documents\2004\Rex's Documents\HighlandPark\W. Geo\World Geography\~WRL3621.tmp"
Mon 16 Dec 2002       123,392 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Rex's Documents\2004\Rex's Documents\HighlandPark\W. Geo\World Geography\~WRL3846.tmp"
Mon 16 Dec 2002       123,904 A..H. --- "C:\Documents and Settings\Owner\My Documents\Rex's Documents\Rex's Documents\2004\Rex's Documents\HighlandPark\W. Geo\World Geography\~WRL3856.tmp"

[b]Finished!/b

MERCI!

seattle.ignorant · Answer

Voici le log de HijackThis après les démarches (que j;ai suivies à la lettre...) HA!

ça m'a pris du temps mais je me suis mis à bien travailler...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:31:35 PM, on 3/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\MICROS~3apimgr.exe
C:\WINDOWS\system32
tvdm.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
O2 - BHO: IE7Pro BHO - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IE7Pro\IE7Pro.dll
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL (file missing)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ElnkScamBHO Class - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: ElnkPubBHO Class - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPuB.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ElnkProtectionBHO Class - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O2 - BHO: TBSB02678 Class - {BDCA7AC9-C27B-4D30-A808-9B9081279C03} - C:\PROGRA~1\QUICKN~1\YOUTUB~1.DLL
O2 - BHO: ElnkLegacyUninstBHO Class - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" /m=0
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [SetDefaultMidi] MIDIDEF.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [SetDefaultMidi] MIDIDEF.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Download File - C:\Program Files\Winferno\Secure IE\Scripts\AddToTransferQueue.htm
O8 - Extra context menu item: &Highlight - C:\Program Files\Winferno\Secure IE\Scripts\highlight.htm
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll/search.htm
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZSzed095YYUS_ZNxdm117IYUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: EarthLink Google Search - res://C:\Program Files\EarthLink TotalAccess\Toolbar\SearchUI.dll/search.html
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/229?bb6778072776431b91e43b41c210d5c0
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/230?bb6778072776431b91e43b41c210d5c0
O8 - Extra context menu item: Zoom &In - C:\Program Files\Winferno\Secure IE\Scripts\zoomin.htm
O8 - Extra context menu item: Zoom O&ut - C:\Program Files\Winferno\Secure IE\Scripts\zoomout.htm
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: webmail.pas.earthlink.net
O15 - Trusted Zone: *.mcafee.com
O15 - Trusted Zone: http://www.secuser.com
O15 - Trusted Zone: owa.tahoma.wednet.edu
O15 - Trusted Zone: http://www.tahoma.wednet.edu
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://cdn2.zone.msn.com/binframework/v10/ZAxRcMgr.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5126/mcfscan.cab
O18 - Protocol: bw+0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Logical Disk Manager dmserverose (dmserverose) - Unknown owner - C:\WINDOWS\system32\~.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

booddha · Answer

LOP XP
1ere phase

Télécharger Lopxp http://sosvirus.changelog.fr/Green_day/Lopxpsetup.exe

	•	Double-click sur Lopxpsetup.exe pour lancer l'installation
	•	Au menu, choisir l'option 1
	•	Patienter un peu 
	•	Un rapport sera alors créé à copier/coller ici

seattle.ignorant · Answer

Rapport lopxp. Merci :)

# Rapport Lopxp fait le Sun 03/02/2008 à 10:20:22
# Exécuté dans : C:\Program Files\Lopxp
# Version 3.09 - Maj du 28/02/2008

  Killing 'iexplore.exe'
"C:\Program Files\Internet Explorer\iexplore.exe"  (2064)

========== Listing des dossiers Application Data

+- C:\Documents and Settings\Administrator\Application Data

 2002-10-29 à 02:48:39 - Microsoft 

+- C:\Documents and Settings\Administrator.NORRISFAMILY\Application Data

 2002-10-29 à 02:13:47 - Adobe 
 2002-10-29 à 00:36:39 - Identities 
 2002-10-29 à 02:13:47 - InterTrust 
 2005-09-18 à 04:12:19 - Macromedia 
 2005-09-18 à 06:00:54 - Microsoft 
 2005-05-19 à 14:08:43 - Motive 
 2002-10-29 à 02:30:55 - SampleView 
 2002-10-29 à 01:50:50 - Share-to-Web Upload Folder
 2002-10-29 à 01:57:27 - VERITAS 

+- C:\Documents and Settings\Administrator.NORRISFAMILY\Local Settings\Application Data

 2002-10-29 à 00:40:05 - Microsoft 

+- C:\Documents and Settings\All Users\Application Data

 2006-06-13 à 03:32:25 - Adobe 
 2006-10-25 à 17:11:54 - Apple Computer
 2006-12-26 à 00:14:41 - Creative 
 2002-10-29 à 02:20:00 - Freedom 
 2008-03-01 à 23:59:13 - Grisoft 
 2006-11-26 à 23:14:27 - HP 
 2006-02-26 à 18:59:39 - InstallShield 
 2007-11-15 à 00:48:27 - Lavasoft 
 2007-10-07 à 21:15:59 - McAfee 
 2007-08-18 à 05:05:26 - Microsoft 
 2002-10-29 à 02:34:49 - Motive 
 2006-02-02 à 08:30:40 - MSN Search Toolbar
 2007-06-25 à 22:30:29 - MumboJumbo 
 2006-04-11 à 16:33:21 - nView_Profiles 
 2005-04-15 à 03:32:57 - QuickTime 
 2002-10-29 à 00:41:01 - SBSI 
 2006-12-26 à 23:10:39 - Skype 
 2006-11-26 à 23:08:56 - Sonic 
 2008-01-10 à 03:47:45 - Spybot - Search & Destroy
 2006-02-26 à 17:45:55 - Symantec 
 2007-07-12 à 02:33:30 - TEMP 
 2006-07-13 à 16:13:18 - Windows Genuine Advantage
 2007-08-18 à 03:09:16 - YAHOO 
 2008-03-02 à 00:10:17 - Yahoo! Companion

+- C:\Documents and Settings\Default User\Application Data

 2002-10-29 à 02:13:47 - Adobe 
 2002-10-29 à 00:36:39 - Identities 
 2002-10-29 à 02:13:47 - InterTrust 
 2002-10-29 à 00:39:37 - Microsoft 
 2002-10-29 à 02:30:55 - SampleView 
 2002-10-29 à 01:50:50 - Share-to-Web Upload Folder
 2002-10-29 à 01:57:27 - VERITAS 

+- C:\Documents and Settings\Default User\Local Settings\Application Data

 2002-10-29 à 00:40:05 - Microsoft 

+- C:\Documents and Settings\LocalService\Application Data

 2002-10-29 à 00:39:27 - Microsoft 

+- C:\Documents and Settings\LocalService\Local Settings\Application Data

 2007-08-18 à 05:05:27 - Microsoft 

+- C:\Documents and Settings\NetworkService\Application Data

 2007-12-01 à 11:10:06 - Microsoft 

+- C:\Documents and Settings\NetworkService\Local Settings\Application Data

 2002-10-29 à 00:39:26 - Microsoft 

+- C:\Documents and Settings\Owner\Application Data

 2006-02-07 à 19:11:35 - Adobe 
 2006-02-07 à 05:23:49 - AdobeAUM 
 2007-01-28 à 07:40:39 - AdobeUM 
 2006-02-07 à 03:00:55 - Apple Computer
 2005-04-25 à 13:44:20 - ArcSoft 
 2008-02-24 à 19:52:26 - Awola 
 2006-12-28 à 04:23:22 - Creative 
 2006-02-26 à 19:07:55 - Earthlink 
 2006-02-26 à 19:08:32 - EarthLink Toolbar
 2005-04-12 à 01:34:14 - FotoWire 
 2005-04-15 à 18:16:30 - Freedom 
 2008-03-02 à 00:21:26 - Grisoft 
 2005-04-25 à 13:45:21 - Help 
 2006-12-02 à 01:34:44 - HP 
 2002-10-29 à 00:36:39 - Identities 
 2007-10-09 à 02:13:24 - IE7Pro 
 2005-04-13 à 17:23:07 - InterVideo 
 2005-05-18 à 01:08:36 - Leadertech 
 2005-06-04 à 17:31:48 - Macromedia 
 2008-01-10 à 03:45:44 - Microsoft 
 2005-04-16 à 17:27:50 - Motive 
 2007-01-29 à 16:19:11 - Mozilla 
 2005-10-16 à 01:09:59 - Mozilla(2) 
 2006-02-02 à 08:35:57 - MSN Search Toolbar
 2005-11-05 à 20:35:17 - Musicmatch 
 2007-07-12 à 00:48:24 - PlayFirst 
 2005-12-27 à 18:18:22 - Real 
 2005-05-16 à 02:44:10 - Roxio 
 2002-10-29 à 02:30:55 - SampleView 
 2002-10-29 à 01:50:50 - Share-to-Web Upload Folder
 2008-02-11 à 23:00:15 - Skype 
 2006-01-04 à 22:41:59 - Snapfish 
 2005-04-12 à 03:44:35 - Symantec 
 2005-04-15 à 21:57:54 - VERITAS 
 2008-01-09 à 12:31:07 - VersionTracker Pro
 2008-02-28 à 08:21:14 - WeatherBug 
 2007-10-07 à 22:20:43 - Winferno 

+- C:\Documents and Settings\Owner\Local Settings\Application Data

 2005-05-08 à 23:25:46 - Adobe 
 2005-12-14 à 15:24:22 - Apple Computer
 2008-03-02 à 18:05:42 - ApplicationHistory 
 2005-04-25 à 13:45:21 - Help 
 2006-11-26 à 23:36:17 - HP 
 2005-04-13 à 21:18:09 - Identities 
 2006-11-26 à 23:37:07 - IsolatedStorage 
 2008-03-01 à 02:25:39 - Microsoft 
 2007-01-29 à 16:19:11 - Mozilla 
 2007-08-18 à 04:05:54 - MTV Networks
 2005-11-07 à 06:06:31 - Musicmatch 
 2007-08-18 à 03:09:15 - Yahoo 

========== Listing du dossier Program Files

+- C:\Program Files

 2005-12-12 à 16:39:06 - Adobe 
 2006-10-25 à 17:49:58 - Apple Software Update
 2006-03-01 à 01:49:01 - ArcSoft 
 2002-10-29 à 02:20:52 - AtBackup 
 2006-12-26 à 00:45:36 - Audible 
 2002-10-29 à 05:36:43 - AWS 
 2002-10-29 à 02:30:00 - BackWeb 
 2008-03-02 à 00:07:09 - CCleaner 
 2007-11-15 à 00:40:58 - Common Files
 2002-10-29 à 00:33:06 - ComPlus Applications
 2002-10-29 à 02:15:35 - Corel 
 2008-03-01 à 04:37:19 - Creative 
 2006-12-26 à 00:40:08 - Creative Installation Information
 2002-10-29 à 02:13:06 - Detto 
 2005-04-12 à 01:36:42 - directx 
 2006-03-01 à 01:47:30 - EarthLink 
 2008-03-01 à 05:16:44 - EarthLink TotalAccess
 2007-07-01 à 05:31:32 - GameSpy Arcade
 2007-06-07 à 04:56:32 - Google 
 2008-03-01 à 23:59:07 - Grisoft 
 2006-11-26 à 23:14:31 - Hewlett-Packard 
 2006-11-26 à 22:45:21 - HP 
 2002-10-29 à 02:30:01 - hp center
 2002-10-29 à 02:34:48 - HP Instant Support
 2002-10-29 à 01:47:05 - HP Photosmart 11
 2007-10-09 à 02:13:06 - IE7Pro 
 2006-12-26 à 00:30:15 - illiminable 
 2007-10-08 à 00:00:57 - InstallShield Installation Information
 2006-12-17 à 06:16:47 - InterActual 
 2008-02-24 à 11:25:26 - Internet Explorer
 2002-10-29 à 01:56:02 - InterVideo 
 2008-02-06 à 03:58:07 - iPod 
 2008-02-06 à 03:58:44 - iTunes 
 2005-09-18 à 03:26:09 - iTunes(2) 
 2007-11-15 à 00:48:59 - Lavasoft 
 2002-10-29 à 01:31:03 - Ligos 
 2005-04-12 à 01:34:27 - Logitech 
 2008-03-02 à 18:20:37 - Lopxp 
 2005-05-22 à 18:59:16 - Messenger 
 2008-01-10 à 03:45:47 - Microsoft ActiveSync
 2006-02-26 à 19:01:10 - Microsoft Agent
 2002-10-29 à 00:36:43 - microsoft frontpage
 2006-09-09 à 16:16:46 - Microsoft Office
 2005-05-18 à 01:41:21 - Movie Maker
 2007-01-29 à 16:56:46 - Mozilla Firefox(2)
 2002-10-29 à 00:32:22 - MSN 
 2007-08-18 à 03:13:14 - MSN Games
 2002-10-29 à 00:32:12 - MSN Gaming Zone
 2007-10-22 à 02:41:17 - MSN Messenger
 2006-02-02 à 08:32:28 - MSN Toolbar Suite
 2006-01-03 à 02:58:09 - MsnMusic 
 2006-11-15 à 11:03:35 - MSXML 4.0
 2007-08-18 à 04:05:45 - MTV Networks
 2006-02-13 à 21:47:41 - MUSICMATCH 
 2005-05-13 à 17:57:09 - My Company Name
 2008-03-02 à 04:26:48 - MyWebSearch 
 2007-08-17 à 03:01:44 - Netflix 
 2005-05-18 à 01:36:16 - NetMeeting 
 2002-10-29 à 05:35:46 - NortonAV 
 2002-10-29 à 02:30:55 - OEMLink 
 2005-04-15 à 22:54:49 - OfficeUpdate11 
 2002-10-29 à 02:26:05 - Online Services
 2007-06-13 à 11:04:54 - Outlook Express
 2005-10-16 à 01:09:59 - Photodex Presenter(2)
 2007-10-07 à 23:54:55 - Quicken 
 2007-10-09 à 02:17:20 - Quicknation 
 2006-12-10 à 19:09:49 - QuickTime 
 2006-06-22 à 23:13:18 - Real 
 2005-11-21 à 19:38:09 - RecordNow 
 2005-04-12 à 03:06:25 - Repair Registry Pro
 2002-10-29 à 02:11:12 - Simple Backup for My Pictures
 2006-12-26 à 23:10:39 - Skype 
 2002-10-29 à 02:48:23 - Sonic 
 2008-01-10 à 03:47:46 - Spybot - Search & Destroy
 2007-08-18 à 03:21:37 - Symantec 
 2006-02-26 à 18:16:33 - SymNetDrv 
 2007-11-15 à 00:58:07 - TechTracker 
 2007-12-28 à 04:53:11 - Touch by HTC User Guide
 2008-02-24 à 18:54:24 - Trend Micro
 2002-10-29 à 00:39:42 - Uninstall Information
 2002-10-29 à 01:57:26 - VERITAS Software
 2002-10-29 à 02:00:20 - WildTangent 
 2006-04-19 à 20:03:17 - Windows Live Safety Center
 2005-04-12 à 01:33:47 - Windows Media Components
 2007-08-18 à 03:35:13 - Windows Media Connect 2
 2007-08-18 à 03:36:53 - Windows Media Player
 2005-05-18 à 01:36:02 - Windows NT
 2005-04-15 à 18:17:34 - WindowsUpdate 
 2002-10-29 à 00:36:43 - xerox 
 2008-02-24 à 19:00:42 - XoftSpySE 
 2007-08-18 à 03:09:14 - Yahoo! 
 2006-11-04 à 04:26:43 - Zone Labs

========== Tâches planifiées

AppleSoftwareUpdate.job: C:\Program Files\Apple Software Update\SoftwareUpdate.exe -Task
SecurityScan.job: C:\Program Files\Winferno\Secure IE\SecurityScan\SecurityScan.exe /ac 
wscupdtr.job: C:\Program Files\Common Files\Winferno\WSCUpdtr.exe 
XoftSpySE 2.job: C:\Program Files\XoftSpySE\XoftSpy.exe ShowReminders
XoftSpySE.job: C:\Program Files\XoftSpySE\XoftSpy.exe -t

========== Clés registre


========== Bloqueur popups Internet Explorer

 prod.campuscruiser.com
 zonenxt.msn-int.com
 zonenxt.msn-ppe.com
 zone.msn.com
 entertainment.msn.com/radio/launchradio.aspx
 *webmessenger.msn.com/
 my.msn.com
 launchcast.launch.yahoo.com/radio/player
 stream1.adsertion.com/radio
 www.wlsam.com
 www.streamaudio.com/listen
 windowsmedia.com/radiotuner
 entertainment.msn.com/radio
 my.msn.com/video
 windowsmedia.com
 betavideo.my.msn.com
 launchcast.launch.yahoo.com/radio
 www.streamaudio.com
 www.color-connection.com/VWVW/Lessons
 www.ratp.info

==========    Suggestion ( /!\ Nécessite une interprétation.)    ==========


+- Registre : Aucune suggestion.


- Fin du rapport -

booddha · Answer

•	Démarrer
	•	Exécuter
	•	puis copier/coller ce qui suit :

"%programfiles%\Lopxp\Lopxp.bat" /Fixme ( avec les guillemets )


	•	Répondre oui si la confirmation de la suppression d'un fichier est demandée.
	•	Copier/Coller le rapport dans la prochaine réponse puis un rapport Hitjackthis

seattle.ignorant · Answer

# Rapport Lopxp fait le Sun 03/02/2008 à 10:44:49
# Exécuté dans : C:\Program Files\Lopxp
# Version 3.09 - Maj du 28/02/2008


========== FixLog ==========


+- Fichiers temporaires :
Nettoyage effectué.


========== Listing des dossiers Application Data

+- C:\Documents and Settings\Administrator\Application Data

 2002-10-29 à 02:48:39 - Microsoft 

+- C:\Documents and Settings\Administrator.NORRISFAMILY\Application Data

 2002-10-29 à 02:13:47 - Adobe 
 2002-10-29 à 00:36:39 - Identities 
 2002-10-29 à 02:13:47 - InterTrust 
 2005-09-18 à 04:12:19 - Macromedia 
 2005-09-18 à 06:00:54 - Microsoft 
 2005-05-19 à 14:08:43 - Motive 
 2002-10-29 à 02:30:55 - SampleView 
 2002-10-29 à 01:50:50 - Share-to-Web Upload Folder
 2002-10-29 à 01:57:27 - VERITAS 

+- C:\Documents and Settings\Administrator.NORRISFAMILY\Local Settings\Application Data

 2002-10-29 à 00:40:05 - Microsoft 

+- C:\Documents and Settings\All Users\Application Data

 2006-06-13 à 03:32:25 - Adobe 
 2006-10-25 à 17:11:54 - Apple Computer
 2006-12-26 à 00:14:41 - Creative 
 2002-10-29 à 02:20:00 - Freedom 
 2008-03-01 à 23:59:13 - Grisoft 
 2006-11-26 à 23:14:27 - HP 
 2006-02-26 à 18:59:39 - InstallShield 
 2007-11-15 à 00:48:27 - Lavasoft 
 2007-10-07 à 21:15:59 - McAfee 
 2007-08-18 à 05:05:26 - Microsoft 
 2002-10-29 à 02:34:49 - Motive 
 2006-02-02 à 08:30:40 - MSN Search Toolbar
 2007-06-25 à 22:30:29 - MumboJumbo 
 2006-04-11 à 16:33:21 - nView_Profiles 
 2005-04-15 à 03:32:57 - QuickTime 
 2002-10-29 à 00:41:01 - SBSI 
 2006-12-26 à 23:10:39 - Skype 
 2006-11-26 à 23:08:56 - Sonic 
 2008-01-10 à 03:47:45 - Spybot - Search & Destroy
 2006-02-26 à 17:45:55 - Symantec 
 2007-07-12 à 02:33:30 - TEMP 
 2006-07-13 à 16:13:18 - Windows Genuine Advantage
 2007-08-18 à 03:09:16 - YAHOO 
 2008-03-02 à 00:10:17 - Yahoo! Companion

+- C:\Documents and Settings\Default User\Application Data

 2002-10-29 à 02:13:47 - Adobe 
 2002-10-29 à 00:36:39 - Identities 
 2002-10-29 à 02:13:47 - InterTrust 
 2002-10-29 à 00:39:37 - Microsoft 
 2002-10-29 à 02:30:55 - SampleView 
 2002-10-29 à 01:50:50 - Share-to-Web Upload Folder
 2002-10-29 à 01:57:27 - VERITAS 

+- C:\Documents and Settings\Default User\Local Settings\Application Data

 2002-10-29 à 00:40:05 - Microsoft 

+- C:\Documents and Settings\LocalService\Application Data

 2002-10-29 à 00:39:27 - Microsoft 

+- C:\Documents and Settings\LocalService\Local Settings\Application Data

 2007-08-18 à 05:05:27 - Microsoft 

+- C:\Documents and Settings\NetworkService\Application Data

 2007-12-01 à 11:10:06 - Microsoft 

+- C:\Documents and Settings\NetworkService\Local Settings\Application Data

 2002-10-29 à 00:39:26 - Microsoft 

+- C:\Documents and Settings\Owner\Application Data

 2006-02-07 à 19:11:35 - Adobe 
 2006-02-07 à 05:23:49 - AdobeAUM 
 2007-01-28 à 07:40:39 - AdobeUM 
 2006-02-07 à 03:00:55 - Apple Computer
 2005-04-25 à 13:44:20 - ArcSoft 
 2008-02-24 à 19:52:26 - Awola 
 2006-12-28 à 04:23:22 - Creative 
 2006-02-26 à 19:07:55 - Earthlink 
 2006-02-26 à 19:08:32 - EarthLink Toolbar
 2005-04-12 à 01:34:14 - FotoWire 
 2005-04-15 à 18:16:30 - Freedom 
 2008-03-02 à 00:21:26 - Grisoft 
 2005-04-25 à 13:45:21 - Help 
 2006-12-02 à 01:34:44 - HP 
 2002-10-29 à 00:36:39 - Identities 
 2007-10-09 à 02:13:24 - IE7Pro 
 2005-04-13 à 17:23:07 - InterVideo 
 2005-05-18 à 01:08:36 - Leadertech 
 2005-06-04 à 17:31:48 - Macromedia 
 2008-01-10 à 03:45:44 - Microsoft 
 2005-04-16 à 17:27:50 - Motive 
 2007-01-29 à 16:19:11 - Mozilla 
 2005-10-16 à 01:09:59 - Mozilla(2) 
 2006-02-02 à 08:35:57 - MSN Search Toolbar
 2005-11-05 à 20:35:17 - Musicmatch 
 2007-07-12 à 00:48:24 - PlayFirst 
 2005-12-27 à 18:18:22 - Real 
 2005-05-16 à 02:44:10 - Roxio 
 2002-10-29 à 02:30:55 - SampleView 
 2002-10-29 à 01:50:50 - Share-to-Web Upload Folder
 2008-02-11 à 23:00:15 - Skype 
 2006-01-04 à 22:41:59 - Snapfish 
 2005-04-12 à 03:44:35 - Symantec 
 2005-04-15 à 21:57:54 - VERITAS 
 2008-01-09 à 12:31:07 - VersionTracker Pro
 2008-02-28 à 08:21:14 - WeatherBug 
 2007-10-07 à 22:20:43 - Winferno 

+- C:\Documents and Settings\Owner\Local Settings\Application Data

 2005-05-08 à 23:25:46 - Adobe 
 2005-12-14 à 15:24:22 - Apple Computer
 2008-03-02 à 18:05:42 - ApplicationHistory 
 2005-04-25 à 13:45:21 - Help 
 2006-11-26 à 23:36:17 - HP 
 2005-04-13 à 21:18:09 - Identities 
 2006-11-26 à 23:37:07 - IsolatedStorage 
 2008-03-01 à 02:25:39 - Microsoft 
 2007-01-29 à 16:19:11 - Mozilla 
 2007-08-18 à 04:05:54 - MTV Networks
 2005-11-07 à 06:06:31 - Musicmatch 
 2007-08-18 à 03:09:15 - Yahoo 

========== Listing du dossier Program Files

+- C:\Program Files

 2005-12-12 à 16:39:06 - Adobe 
 2006-10-25 à 17:49:58 - Apple Software Update
 2006-03-01 à 01:49:01 - ArcSoft 
 2002-10-29 à 02:20:52 - AtBackup 
 2006-12-26 à 00:45:36 - Audible 
 2002-10-29 à 05:36:43 - AWS 
 2002-10-29 à 02:30:00 - BackWeb 
 2008-03-02 à 00:07:09 - CCleaner 
 2007-11-15 à 00:40:58 - Common Files
 2002-10-29 à 00:33:06 - ComPlus Applications
 2002-10-29 à 02:15:35 - Corel 
 2008-03-01 à 04:37:19 - Creative 
 2006-12-26 à 00:40:08 - Creative Installation Information
 2002-10-29 à 02:13:06 - Detto 
 2005-04-12 à 01:36:42 - directx 
 2006-03-01 à 01:47:30 - EarthLink 
 2008-03-01 à 05:16:44 - EarthLink TotalAccess
 2007-07-01 à 05:31:32 - GameSpy Arcade
 2007-06-07 à 04:56:32 - Google 
 2008-03-01 à 23:59:07 - Grisoft 
 2006-11-26 à 23:14:31 - Hewlett-Packard 
 2006-11-26 à 22:45:21 - HP 
 2002-10-29 à 02:30:01 - hp center
 2002-10-29 à 02:34:48 - HP Instant Support
 2002-10-29 à 01:47:05 - HP Photosmart 11
 2007-10-09 à 02:13:06 - IE7Pro 
 2006-12-26 à 00:30:15 - illiminable 
 2007-10-08 à 00:00:57 - InstallShield Installation Information
 2006-12-17 à 06:16:47 - InterActual 
 2008-02-24 à 11:25:26 - Internet Explorer
 2002-10-29 à 01:56:02 - InterVideo 
 2008-02-06 à 03:58:07 - iPod 
 2008-02-06 à 03:58:44 - iTunes 
 2005-09-18 à 03:26:09 - iTunes(2) 
 2007-11-15 à 00:48:59 - Lavasoft 
 2002-10-29 à 01:31:03 - Ligos 
 2005-04-12 à 01:34:27 - Logitech 
 2008-03-02 à 18:45:00 - Lopxp 
 2005-05-22 à 18:59:16 - Messenger 
 2008-01-10 à 03:45:47 - Microsoft ActiveSync
 2006-02-26 à 19:01:10 - Microsoft Agent
 2002-10-29 à 00:36:43 - microsoft frontpage
 2006-09-09 à 16:16:46 - Microsoft Office
 2005-05-18 à 01:41:21 - Movie Maker
 2007-01-29 à 16:56:46 - Mozilla Firefox(2)
 2002-10-29 à 00:32:22 - MSN 
 2007-08-18 à 03:13:14 - MSN Games
 2002-10-29 à 00:32:12 - MSN Gaming Zone
 2007-10-22 à 02:41:17 - MSN Messenger
 2006-02-02 à 08:32:28 - MSN Toolbar Suite
 2006-01-03 à 02:58:09 - MsnMusic 
 2006-11-15 à 11:03:35 - MSXML 4.0
 2007-08-18 à 04:05:45 - MTV Networks
 2006-02-13 à 21:47:41 - MUSICMATCH 
 2005-05-13 à 17:57:09 - My Company Name
 2008-03-02 à 04:26:48 - MyWebSearch 
 2007-08-17 à 03:01:44 - Netflix 
 2005-05-18 à 01:36:16 - NetMeeting 
 2002-10-29 à 05:35:46 - NortonAV 
 2002-10-29 à 02:30:55 - OEMLink 
 2005-04-15 à 22:54:49 - OfficeUpdate11 
 2002-10-29 à 02:26:05 - Online Services
 2007-06-13 à 11:04:54 - Outlook Express
 2005-10-16 à 01:09:59 - Photodex Presenter(2)
 2007-10-07 à 23:54:55 - Quicken 
 2007-10-09 à 02:17:20 - Quicknation 
 2006-12-10 à 19:09:49 - QuickTime 
 2006-06-22 à 23:13:18 - Real 
 2005-11-21 à 19:38:09 - RecordNow 
 2005-04-12 à 03:06:25 - Repair Registry Pro
 2002-10-29 à 02:11:12 - Simple Backup for My Pictures
 2006-12-26 à 23:10:39 - Skype 
 2002-10-29 à 02:48:23 - Sonic 
 2008-01-10 à 03:47:46 - Spybot - Search & Destroy
 2007-08-18 à 03:21:37 - Symantec 
 2006-02-26 à 18:16:33 - SymNetDrv 
 2007-11-15 à 00:58:07 - TechTracker 
 2007-12-28 à 04:53:11 - Touch by HTC User Guide
 2008-02-24 à 18:54:24 - Trend Micro
 2002-10-29 à 00:39:42 - Uninstall Information
 2002-10-29 à 01:57:26 - VERITAS Software
 2002-10-29 à 02:00:20 - WildTangent 
 2006-04-19 à 20:03:17 - Windows Live Safety Center
 2005-04-12 à 01:33:47 - Windows Media Components
 2007-08-18 à 03:35:13 - Windows Media Connect 2
 2007-08-18 à 03:36:53 - Windows Media Player
 2005-05-18 à 01:36:02 - Windows NT
 2005-04-15 à 18:17:34 - WindowsUpdate 
 2002-10-29 à 00:36:43 - xerox 
 2008-02-24 à 19:00:42 - XoftSpySE 
 2007-08-18 à 03:09:14 - Yahoo! 
 2006-11-04 à 04:26:43 - Zone Labs

========== Tâches planifiées

AppleSoftwareUpdate.job: C:\Program Files\Apple Software Update\SoftwareUpdate.exe -Task
SecurityScan.job: C:\Program Files\Winferno\Secure IE\SecurityScan\SecurityScan.exe /ac 
wscupdtr.job: C:\Program Files\Common Files\Winferno\WSCUpdtr.exe 
XoftSpySE 2.job: C:\Program Files\XoftSpySE\XoftSpy.exe ShowReminders
XoftSpySE.job: C:\Program Files\XoftSpySE\XoftSpy.exe -t

========== Clés registre


========== Bloqueur popups Internet Explorer

 prod.campuscruiser.com
 zonenxt.msn-int.com
 zonenxt.msn-ppe.com
 zone.msn.com
 entertainment.msn.com/radio/launchradio.aspx
 *webmessenger.msn.com/
 my.msn.com
 launchcast.launch.yahoo.com/radio/player
 stream1.adsertion.com/radio
 www.wlsam.com
 www.streamaudio.com/listen
 windowsmedia.com/radiotuner
 entertainment.msn.com/radio
 my.msn.com/video
 windowsmedia.com
 betavideo.my.msn.com
 launchcast.launch.yahoo.com/radio
 www.streamaudio.com
 www.color-connection.com/VWVW/Lessons
 www.ratp.info

==========    Suggestion ( /!\ Nécessite une interprétation.)    ==========


+- Registre : Aucune suggestion.


- Fin du rapport -

booddha · Answer

Demarrer --> Paramètres --> Panneau de configuration -->> Ajout/suppression de programmes.


Chercher une entrée contenant MyWebSearch

Selectionner et désinstaller (Supprimer à droite)

Si trouver relancer la machine et remettre un rapport hitjackthis

Si pas trouver, rendre compte ici


PS : met tes messages les uns en dessous des autres pour garder la chronologie.

Je vais diner (pas pour longtemps) A toute à l'heure

seattle.ignorant · Answer

J'ai bien trouvé MyWebSearch dna l'Ajout/Suppression de Programmes mais malheureusement quand j'ai cliqué pour le désinstaller, jai reçun le message suivant:

RunDLL
Error loading c:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsbar.dll

ARGH!

Bon appétit!

booddha · Answer

1) Avec l'explorateur de fichier trouve 

C:\Program Files\MyWebSearch

Supprime le dossier (répertoire)  MyWebSearch

2) S'il te dit que tu ne peux pas

CTRL-ALT-SUPPR --> Onglet Processus.

Cherche dedans MyWebSearch ou quelque chose qui le contient
Tu sélectionnes et tu clique sur le bouton en bas à droite Terminer le processus

Si il ne veut pas terminer le processus faire 1) mais en mode sans echec

Si tu es arrivé à le supprimer, vide ta corbeille.

Relance ta machine et met moi un nouveau rapport Hitjacthis.

Si tu n'as pas pu le supprimer fais le moi savoir

booddha · Answer

Essaye le mode sans echec, ne touches pas au processus.

seattle.ignorant · Answer

OK merci. J'essaie et je redémarre Internet.

seattle.ignorant · Answer

Meme en Mode Sans Echec, je ne peux pas desinstaller MyWebSearch. Grrr

booddha · Answer

Pourquoi? Le répertoire est invisible ? Ou il refuse (Désinstaller ou supprimer le répertoire?)

seattle.ignorant · Answer

Le répertoire est bien visible mais quand je clique sur "désinstaller" j'ai une fenetre avec un message erreur qui apparait:

RunDLL
Error loading Error loading c:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsbar.dll

booddha · Answer

Ok on va faire autrement

booddha · Answer

On va essayer ça

===================== COMBOFIX ========================

Combofix

Installer ComboFix http://download.bleepingcomputer.com/sUBs/ComboFix.exe 
sur le bureau

	•	Double click sur l'icône qui s'est installé sur ton bureau :
	•	Appuyer sur la touche 1 puis sur entrée:
	•	Laisser Combofix travailler
	•	Copier/Coller le rapport généré dans la prochaine réponse
	
Note :
Le serveur de téléchargement peut être en surcharge et renvoyer une page d'erreur. Il faut insister.

Ce n'est pas la fin du déverminage

Recolle un rapport Hitjacthis après

seattle.ignorant · Answer

Voici le rapport de ComboFix ComboFix 08-03-03.6 - Owner 2008-03-02 13:59:17.1 - NTFSx86 NETWORK Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Owner\Application Data\Awola C:\Documents and Settings\Owner\Application Data\Awola\Awola001.bas C:\Documents and Settings\Owner\Application Data\Awola\settings.ini C:\Documents and Settings\Owner\Start Menu\Programs\Awola C:\Program Files\internet explorer\msimg32.dll C:\Program Files\MyWebSearch C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL . ((((((((((((((((((((((((( Files Created from 2008-02-03 to 2008-03-03 ))))))))))))))))))))))))))))))) . 2008-03-02 10:19 . 2008-03-02 10:45 d-------- C:\Program Files\Lopxp 2008-03-01 20:51 . 2008-03-01 20:51 d-------- C:\WINDOWS\ERUNT 2008-03-01 16:21 . 2008-03-01 16:21 d-------- C:\Documents and Settings\Owner\Application Data\Grisoft 2008-03-01 16:10 . 2008-03-01 16:10 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion 2008-03-01 16:09 . 2008-03-01 21:15 d-------- C:\SDFix 2008-03-01 15:59 . 2008-03-01 15:59 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft 2008-03-01 15:59 . 2007-05-30 04:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-02-27 06:14 . 2008-02-27 06:14 268 --ah----- C:\sqmdata12.sqm 2008-02-27 06:14 . 2008-02-27 06:14 244 --ah----- C:\sqmnoopt13.sqm 2008-02-25 03:11 . 2008-03-02 13:18 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-02-25 03:11 . 2008-02-25 03:11 1,409 --a------ C:\WINDOWS\QTFont.for 2008-02-24 11:39 . 2008-02-24 12:36 d-------- C:\WINDOWS\BDOSCAN8 2008-02-24 11:00 . 2008-02-24 11:00 d-------- C:\Program Files\XoftSpySE 2008-02-24 10:54 . 2008-02-24 10:54 d-------- C:\Program Files\Trend Micro 2008-02-24 03:13 . 2008-02-24 03:13 268 --ah----- C:\sqmdata11.sqm 2008-02-24 03:13 . 2008-02-24 03:13 244 --ah----- C:\sqmnoopt12.sqm 2008-02-12 09:28 . 2008-02-12 09:28 268 --ah----- C:\sqmdata10.sqm 2008-02-12 09:28 . 2008-02-12 09:28 244 --ah----- C:\sqmnoopt11.sqm 2008-02-11 15:31 . 2008-02-11 15:31 268 --ah----- C:\sqmdata09.sqm 2008-02-11 15:31 . 2008-02-11 15:31 244 --ah----- C:\sqmnoopt10.sqm 2008-02-05 19:58 . 2008-02-05 19:58 d-------- C:\Program Files\iPod 2008-02-05 19:56 . 2008-02-05 19:58 d-------- C:\Program Files\iTunes . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-02 00:07 --------- d-----w C:\Program Files\CCleaner 2008-03-01 05:16 --------- d-----w C:\Program Files\EarthLink TotalAccess 2008-03-01 04:37 --------- d-----w C:\Program Files\Creative 2008-02-28 08:21 --------- d-----w C:\Documents and Settings\Owner\Application Data\WeatherBug 2008-02-24 18:51 0 --sha-w C:\Documents and Settings\Owner\Application Data\3ff91e1a578bad303a6a1d6139883259eb3e3632.dat 2008-02-11 23:00 --------- d-----w C:\Documents and Settings\Owner\Application Data\Skype 2008-01-10 03:47 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-01-10 03:47 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy 2008-01-10 03:45 --------- d-----w C:\Program Files\Microsoft ActiveSync 2008-01-09 12:31 --------- d-----w C:\Documents and Settings\Owner\Application Data\VersionTracker Pro 2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\wininet.dll 2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll 2005-05-12 07:36 12,288 -c--a-w C:\WINDOWS\Fonts\RandFont.dll . ------- Sigcheck ------- ecf02439fd31bbd0dbc2ec05600cf08a C:\WINDOWS\system32\drivers cpip.sys -c--a-w 359,808 2005-03-14 00:55:08 C:\WINDOWS\$hf_mig$\KB893066\SP2GDR cpip.sys -c--a-w 359,936 2005-05-25 19:07:12 C:\WINDOWS\$hf_mig$\KB893066\SP2QFE cpip.sys -c--a-w 360,448 2006-01-13 17:07:08 C:\WINDOWS\$hf_mig$\KB913446\SP2QFE cpip.sys -c--a-w 360,576 2006-04-20 12:18:35 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE cpip.sys ----a-w 360,832 2007-10-30 16:53:32 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE cpip.sys -c--a-w 339,968 2005-02-23 02:00:29 C:\WINDOWS\$NtServicePackUninstall$ cpip.sys -c--a-w 359,040 2004-08-04 06:14:40 C:\WINDOWS\$NtUninstallKB893066$ cpip.sys -c--a-w 332,928 2002-08-29 12:00:00 C:\WINDOWS\$NtUninstallKB893066_0$ cpip.sys -c--a-w 359,808 2005-05-25 19:04:02 C:\WINDOWS\$NtUninstallKB913446$ cpip.sys -c----w 359,808 2006-01-13 02:28:14 C:\WINDOWS\$NtUninstallKB917953$ cpip.sys -c----w 359,808 2006-04-20 11:51:50 C:\WINDOWS\$NtUninstallKB941644$ cpip.sys -c--a-w 359,040 2004-08-04 06:14:40 C:\WINDOWS\ServicePackFiles\i386 cpip.sys -c----w 360,064 2007-10-30 17:20:55 C:\WINDOWS\system32\dllcache cpip.sys ----a-w 360,064 2007-10-30 17:20:55 C:\WINDOWS\system32\drivers cpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Weather"="C:\Program Files\AWS\WeatherBug\Weather.exe" [2005-06-07 12:58 1339392] "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54 5674352] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2005-05-31 18:37 1196032] "CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-04-28 17:08 692224] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB ealsched.exe" [2005-12-20 20:51 180269] "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 18:58 282624] "My Web Search Bar Search Scope Monitor"="C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" [ ] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 01:25 6731312] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Symantec NetDriver Warning"="C:\PROGRA~1\SYMNET~1\SNDWarn.exe" [2004-10-29 07:52 218232] "ALUAlert"="C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" [ ] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "SetDefaultMidi"="MIDIDEF.EXE" [2002-12-03 23:55 49152 C:\WINDOWS\mididef.exe] "PlayCenter2"="C:\Program Files\Creative\SBLive\PlayCenter2\MDEntry.exe" [2001-07-20 09:00 131072] C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader eader_sl.exe [2005-09-23 22:05:26 29696] HP Digital Imaging Monitor.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26 282624] HP Image Zone Fast Start.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe [2005-05-12 00:49:24 73728] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk backup=C:\WINDOWS\pss\Quicken Scheduled Updates.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Desktop Search.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Desktop Search.lnk backup=C:\WINDOWS\pss\Windows Desktop Search.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acme.PCHButton] --a--c--- 2002-10-18 01:45 159744 C:\PROGRA~1\HPINST~1\plugin\bin\pchbutton.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] --a------ 2005-06-06 23:46 57344 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoTBar] C:\hp\bin\autotbar.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlockTracker] c:\hp\bin\BlockTracker.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CamMonitor] --a--c--- 2002-06-18 06:11 69632 c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper] --a------ 2003-01-08 23:39 28672 C:\WINDOWS\system32\cthelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DDCActiveMenu] --a------ 2002-06-08 08:20 86016 C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E6TaskPanel] C:\Program Files\EarthLink TotalAccess\TaskPanl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ELNKProxy] C:\WINDOWS\surfmonkey\smproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent] --a------ 2005-05-31 18:37 1196032 C:\Program Files\Microsoft ActiveSync\wcescomm.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] --a------ 2002-09-09 14:05 114688 C:\WINDOWS\System32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv] --a--c--- 1998-05-07 23:04 52736 c:\windows\system\hpsysdrv.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection] C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD] --a------ 2001-07-07 04:56 61440 C:\HP\KBD\KBD.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM] --a------ 2006-03-21 14:51 36864 C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechGalleryRepair] --a--c--- 2002-12-10 17:32 155648 C:\Program Files\Logitech\ImageStudio\ISStart.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechImageStudioTray] --a--c--- 2002-12-10 17:31 61440 C:\Program Files\Logitech\ImageStudio\LogiTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMS] --a--c--- 2002-12-10 16:54 127022 C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2007-01-19 12:54 5674352 C:\Program Files\MSN Messenger\MsnMsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2006-03-09 14:29 7561216 C:\WINDOWS\system32\NvCpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2006-03-09 14:29 86016 C:\WINDOWS\system32\NvMcTray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg wiz] --a------ 2006-03-09 14:29 1519616 C:\WINDOWS\system32 wiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PS2] --a------ 2002-06-14 23:39 81920 C:\WINDOWS\system32\ps2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard] --a--c--- 2002-09-14 04:42 212992 C:\WINDOWS\SMINST\RECGUARD.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon] --a--c--- 2002-04-18 00:42 69632 c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] --a------ 2006-12-18 17:32 25365032 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StorageGuard] --a--c--- 2002-06-18 15:01 155648 C:\Program Files\VERITAS Software\Update Manager\sgtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2005-12-20 20:51 180269 C:\Program Files\Common Files\Real\Update_OB ealsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg] --a--c--- 2000-05-11 00:00 90112 C:\WINDOWS\UpdReg.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Weather] --a------ 2005-06-07 12:58 1339392 C:\Program Files\AWS\WeatherBug\Weather.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "SymWSC"=2 (0x2) "NVSvc"=2 (0x2) "IDriverT"=3 (0x3) "dvpapi"=2 (0x2) "Creative Service for CDROM Access"=2 (0x2) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\Messenger\msmsgs.exe"= "C:\Program Files\Microsoft ActiveSync apimgr.exe"= C:\Program Files\Microsoft ActiveSync apimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"= "C:\Program Files\Internet Explorer\iexplore.exe"= "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe"= "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe"= "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpofxm08.exe"= "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposfx08.exe"= "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposid01.exe"= "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqscnvw.exe"= "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqkygrp.exe"= "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqCopy.exe"= "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpfccopy.exe"= "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpzwiz01.exe"= "C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqPhUnl.exe"= "C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqDIA.exe"= "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoews01.exe"= "C:\Program Files\MSN Messenger\msnmsgr.exe"= "C:\Program Files\MSN Messenger\livecall.exe"= "C:\Program Files\Windows Media Player\wmplayer.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "C:\Program Files\iTunes\iTunes.exe"= "C:\Program Files\Skype\Phone\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service "8097:TCP"= 8097:TCP:EarthLink UHP Modem Support "4:TCP"= 4:TCP:RealTek R0 GRFILTER;CS NDIS Driver;C:\WINDOWS\system32\drivers\GRFILTER.sys [2005-07-11 09:36] S2 GRTdiMon;GR TDI Mon;C:\WINDOWS\system32\Drivers\GRTdiMon.sys [2005-07-11 09:38] S3 ADSFilter;ADSFilter - (Aluria Filter Driver);C:\WINDOWS\system32\DRIVERS\ADSFilter.sys [] S3 BW2NDIS5;BW2NDIS5;C:\WINDOWS\system32\Drivers\BW2NDIS5.sys [] S3 PCDRDRV;Pcdr Helper Driver;C:\PROGRA~1\PC-DOC~1\DIAGNO~1\PCDRDRV.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{22d549c8-aca5-11d9-9c72-0040ca513fba}] \Shell\AutoRun\command - G:\setupSNK.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-03 14:04:20 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-03-03 14:08:14 ComboFix-quarantined-files.txt 2008-03-03 22:07:52 . 2008-02-25 11:03:39 --- E O F ---

booddha · Answer

Il a eu sa peau

Me manque le rapport Hitjackthis

seattle.ignorant · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:33:09 PM, on 3/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\MICROS~3apimgr.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\system32
tvdm.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IE7Pro BHO - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IE7Pro\IE7Pro.dll
O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL (file missing)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ElnkScamBHO Class - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: ElnkPubBHO Class - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPuB.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ElnkProtectionBHO Class - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O2 - BHO: TBSB02678 Class - {BDCA7AC9-C27B-4D30-A808-9B9081279C03} - C:\PROGRA~1\QUICKN~1\YOUTUB~1.DLL
O2 - BHO: ElnkLegacyUninstBHO Class - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" /m=0
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [SetDefaultMidi] MIDIDEF.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [SetDefaultMidi] MIDIDEF.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Download File - C:\Program Files\Winferno\Secure IE\Scripts\AddToTransferQueue.htm
O8 - Extra context menu item: &Highlight - C:\Program Files\Winferno\Secure IE\Scripts\highlight.htm
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll/search.htm
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZSzed095YYUS_ZNxdm117IYUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: EarthLink Google Search - res://C:\Program Files\EarthLink TotalAccess\Toolbar\SearchUI.dll/search.html
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/229?bb6778072776431b91e43b41c210d5c0
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/230?bb6778072776431b91e43b41c210d5c0
O8 - Extra context menu item: Zoom &In - C:\Program Files\Winferno\Secure IE\Scripts\zoomin.htm
O8 - Extra context menu item: Zoom O&ut - C:\Program Files\Winferno\Secure IE\Scripts\zoomout.htm
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: webmail.pas.earthlink.net
O15 - Trusted Zone: *.mcafee.com
O15 - Trusted Zone: http://www.secuser.com
O15 - Trusted Zone: owa.tahoma.wednet.edu
O15 - Trusted Zone: http://www.tahoma.wednet.edu
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://cdn2.zone.msn.com/binframework/v10/ZAxRcMgr.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5126/mcfscan.cab
O18 - Protocol: bw+0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Logical Disk Manager dmserverose (dmserverose) - Unknown owner - C:\WINDOWS\system32\~.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

booddha · Answer

On voit le bout. J'arrive avec la suite.

En attendant 

=====================  ANTIVIR ========================
Télécharger ANTIVIR qui est un antivirus gratuit
https://download.cnet.com/Avira-Free-Security-with-Antivirus/3000-18510_4-10322935.html?part=dl-AviraAnti&subj=dl&tag=button&cdlpid=10322935


Car tu n'as pas d'antivirus et c'est pas bien, pas bien du tout. Ca évite de passer son week-end à déplomber son ordinateur.

On verra pour l'installer tout à l'heure.

booddha · Answer

========================= OTE MOVE IT ================================

OteMoveIt

	•	Télécharger ici http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
	•	L'installer sur le bureau
	•	Le lancer.
	•	S'Assurer que la case "Unregister Dll's and Ocx's" soit bien cochée.
	•	Copier/Coller les lignes ci-dessous en gras de OTMoveIt nommé 
  Paste Standard List of Files/Folders to move.


C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe


	•	Click sur MoveIt! pour lancer la suppression.
	•	Si OTMoveIt propose de redémarrer le PC, accepter !
	•	Lorsque un résultat apparaît dans le cadre Results, click sur Exit.
	•	Copier/Coller sur le forum le rapport de OTMoveIt situé sur C:\_OTMoveIt\MovedFiles.

(Il est tout petit le rapport)

seattle.ignorant · Answer

Rapport de OTMoveIt

File/Folder C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe not found.
 
OTMoveIt2 v1.0.20 log created on 03032008_145601

booddha · Answer

Refait la même choses avec

C:\PROGRAM FILES\MYWEBSEARCH\bar\2.bin\m3SrchMn.exe

seattle.ignorant · Answer

File/Folder C:\PROGRAM FILES\MYWEBSEARCH\bar\2.bin\m3SrchMn.exe not found.
 
OTMoveIt2 v1.0.20 log created on 03032008_150401

booddha · Answer

----------------------- Fixer des lignes  HitjackThis -------------------

Relancer Hitjackthis

	•	Fixer ces lignes


O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL (file missing)

O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)

O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" /m=0

O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/


	•	Pour fixer les lignes.
	•	Cliquer sur la petite case à gauche de la ligne à fixer.

	•	Une fois ces lignes cochées, cliquer sur le bouton en bas FIX CHECKED
	•	Fermer et relancer HitJackThis

---------------------------------------
	•	Démarrer > executer > services.msc
	•	Click-droit sur le service cité - Logical Disk Manager dmserveroses
	•	propriétés
	•	et dans type de démarrage sélectionner désactivé
	•	Ensuite si le Status du service est sur Démarré faire : arrêté
	•	Ouvrir Hijackthis puis:
	•	Open the Misc Tools Section
	•	Delete a NT Service
	•	Taper Logical Disk Manager dmserverose puis valider.

Relance la machine et renvoie un rapport hitjackthis. On tient le bon bout.

Nous n'avons pas terminé

Utilisateur anonyme · Answer

Bonsoir vous deux,

Houaaa,

Ca bosse dur ici....

seattle.ignorant tu n'as pas non plus de pare feu (pas bien...lol)

> Bon il te faut un pare feu :
Je te conseille Kerio : http://www.commentcamarche.net/telecharger/telecharger 206 kerio . Si problème, tuto : https://kerio.probb.fr/
- Si tu as des difficultés avec les configuration de Kerio, alors installe Zone Alarme : /telecharger/telecharger-157-zonealarm, en cas de problème : http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/zonealarm-tutorial-sujet_169658_1.htm 
- Installe le nouveau pare-feu, puis désactive le pare-feu windows.    



Bonne chasse,

A+

seattle.ignorant · Answer

Au risque de me faire gronder par DllD, je veux exprimer ma reconnaissance à booddha & DllD car c'est impressionant la connaissance que vous avez et le temps que vous etes en train de passer a m'aider. WOW!

Question sur le parefeu: j'utilisais ZoneAlarme depuis un bon moment mais l'annee derniere quand j'essayais de connecter mon telephone/PDA l'ordinateur crashait. Alors je l'ai descative et cela n'est plus arrive. Mais ce qui m'est arrive apres est pire, puisque je suis sur ce forum a demander de l'aide, n'est-ce pas? :)

J'ai telecharge ANTIVIR et Kerio. Est-ce qu'ils vont ralentir mon ordinateur?

booddha · Answer

Très peu.

Lance un scan antivir dès que tu peux (Mode sans echec). Clique sur le bouton rapport et sauve le rapport sur ton disque .

Et dans la foulée fait un scan en mode sans echec avec AVG Anti-spyware après avoir mis à jour sa base de données. sauve le rapport sur ton disque .

(Attention, ça peut demander un moment ce machin suivant l'encombrement de tes disques).

On finira demain si tu veux bien.

Réactive la file en collant le rapport antivir et celui d'AVG et un nouveau HITJACKTHIS

seattle.ignorant · Answer

OK merci booddha.

seattle.ignorant · Answer

OK mon modem est grillé ce matin et je ne peux plus accéder à Internet donc je t'envoie ce message du boulot. Je me reconnecte dès que je peux (c-a-d dès que j'ai un nouveau modem) pour poster les resultats des scans de Antivir et AVG

Merci

seattle.ignorant · Answer

Yeah! J'ai enfin résolu mes problèmes de connection!!! Voici donc les rapports que tu m'as demandés: Antivir puis un 2ème car il a scanné automatiquement après avoir redémarré: AntiVir PersonalEdition Classic Report file date: Monday, March 03, 2008 16:28 Scanning for 1130387 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Username: SYSTEM Computer name: NORRISFAMILY Version information: BUILD.DAT : 270 15603 Bytes 9/19/2007 13:32:00 AVSCAN.EXE : 7.0.6.1 290856 Bytes 8/23/2007 22:16:29 AVSCAN.DLL : 7.0.6.0 49192 Bytes 8/16/2007 21:23:51 LUKE.DLL : 7.0.5.3 147496 Bytes 8/15/2007 00:32:47 LUKERES.DLL : 7.0.6.1 10280 Bytes 8/21/2007 21:35:20 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 7/18/2007 23:27:15 ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 12/14/2007 00:22:29 ANTIVIR2.VDF : 7.0.2.181 1993728 Bytes 2/24/2008 00:22:29 ANTIVIR3.VDF : 7.0.2.216 135168 Bytes 3/2/2008 00:22:29 AVEWIN32.DLL : 7.6.0.73 3334656 Bytes 3/4/2008 00:22:30 AVWINLL.DLL : 1.0.0.7 14376 Bytes 2/26/2007 19:36:26 AVPREF.DLL : 7.0.2.2 25640 Bytes 7/18/2007 16:39:17 AVREP.DLL : 7.0.0.1 155688 Bytes 4/16/2007 22:16:24 AVPACK32.DLL : 7.6.0.3 360488 Bytes 3/4/2008 00:22:31 AVREG.DLL : 7.0.1.6 30760 Bytes 7/18/2007 16:17:06 AVARKT.DLL : 1.0.0.20 278568 Bytes 8/28/2007 21:26:33 AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 7/18/2007 16:10:18 NETNT.DLL : 7.0.0.0 7720 Bytes 3/8/2007 20:09:42 RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 8/7/2007 21:38:13 RCTEXT.DLL : 7.0.62.0 86056 Bytes 8/21/2007 21:50:37 SQLITE3.DLL : 3.3.17.1 339968 Bytes 7/23/2007 18:37:21 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: off Scan boot sector.................: on Boot sectors.....................: D:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: Monday, March 03, 2008 16:28 The scan of running processes will be started Scan process 'avscan.exe' - '0' Module(s) have been scanned Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'WINWORD.EXE' - '1' Module(s) have been scanned Scan process 'usnsvc.exe' - '1' Module(s) have been scanned Scan process 'iexplore.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'iPodService.exe' - '1' Module(s) have been scanned Scan process 'ntvdm.exe' - '1' Module(s) have been scanned Scan process 'hprblog.exe' - '1' Module(s) have been scanned Scan process 'hpqimzone.exe' - '1' Module(s) have been scanned Scan process 'hpqste08.exe' - '1' Module(s) have been scanned Scan process 'MsPMSPSv.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned Scan process 'guard.exe' - '0' Module(s) have been scanned Scan process 'rapimgr.exe' - '1' Module(s) have been scanned Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'CTSyncU.exe' - '1' Module(s) have been scanned Scan process 'wcescomm.exe' - '1' Module(s) have been scanned Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned Scan process 'Weather.exe' - '1' Module(s) have been scanned Scan process 'avgas.exe' - '1' Module(s) have been scanned Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned Scan process 'qttask.exe' - '1' Module(s) have been scanned Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned Scan process 'realsched.exe' - '1' Module(s) have been scanned Scan process 'apdproxy.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 43 processes with 43 modules were scanned Start scanning boot sectors: Boot sector 'C:\' [NOTE] No virus was found! Boot sector 'D:\' [NOTE] No virus was found! Starting to scan the registry. The registry was scanned ( '25' files ). Starting the file scan: Begin scan in 'C:\' C:\hiberfil.sys [WARNING] The file could not be opened! C:\pagefile.sys [WARNING] The file could not be opened! C:\SDFix\backups\backups.zip [0] Archive type: ZIP --> backups/sipov.dll [DETECTION] Is the Trojan horse TR/Click.Agent.LU --> backups/~.exe [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] A backup was created as '482faba0.qua' ( QUARANTINE ) [INFO] The file was deleted! C:\SDFix\backups\catchme.zip [0] Archive type: ZIP --> ntos.exe [DETECTION] Is the Trojan horse TR/PSW.Zbot.D [INFO] The file was moved to '4840aba8.qua'! C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP1011\A0350845.exe [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen [INFO] The file was moved to '47ffac2e.qua'! C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP1011\A0350846.exe [DETECTION] Is the Trojan horse TR/Agent.203776.3 [INFO] The file was moved to '47ffadb4.qua'! C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP1017\A0351461.exe [DETECTION] Is the Trojan horse TR/Mitglieder.203776 [INFO] The file was moved to '47ffb578.qua'! C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP1017\A0351462.exe [DETECTION] Is the Trojan horse TR/Click.Agent.MJ [INFO] The file was moved to '47ffb57a.qua'! C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP1017\A0351498.exe [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '47ffb581.qua'! C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP1017\A0351499.dll [DETECTION] Is the Trojan horse TR/Click.Agent.LU [INFO] The file was moved to '47ffb583.qua'! C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP1017\A0351509.dll [DETECTION] Is the Trojan horse TR/Click.Agent.LU [INFO] The file was moved to '47ffb587.qua'! C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP1017\A0351510.exe [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '47ffb589.qua'! Begin scan in 'D:\' End of the scan: Monday, March 03, 2008 19:27 Used time: 2:59:15 min The scan has been done completely. 8074 Scanning directories 461174 Files were scanned 11 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 1 files were deleted 0 files were repaired 10 files were moved to quarantine 0 files were renamed 2 Files cannot be scanned 461163 Files not concerned 20111 Archives were scanned 2 Warnings 0 Notes _______________________________________________________________________________ AntiVir PersonalEdition Classic Report file date: Monday, March 03, 2008 22:11 Scanning for 1130387 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Username: SYSTEM Computer name: NORRISFAMILY Version information: BUILD.DAT : 270 15603 Bytes 9/19/2007 13:32:00 AVSCAN.EXE : 7.0.6.1 290856 Bytes 8/23/2007 22:16:29 AVSCAN.DLL : 7.0.6.0 49192 Bytes 8/16/2007 21:23:51 LUKE.DLL : 7.0.5.3 147496 Bytes 8/15/2007 00:32:47 LUKERES.DLL : 7.0.6.1 10280 Bytes 8/21/2007 21:35:20 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 7/18/2007 23:27:15 ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 12/14/2007 00:22:29 ANTIVIR2.VDF : 7.0.2.181 1993728 Bytes 2/24/2008 00:22:29 ANTIVIR3.VDF : 7.0.2.216 135168 Bytes 3/2/2008 00:22:29 AVEWIN32.DLL : 7.6.0.73 3334656 Bytes 3/4/2008 00:22:30 AVWINLL.DLL : 1.0.0.7 14376 Bytes 2/26/2007 19:36:26 AVPREF.DLL : 7.0.2.2 25640 Bytes 7/18/2007 16:39:17 AVREP.DLL : 7.0.0.1 155688 Bytes 4/16/2007 22:16:24 AVPACK32.DLL : 7.6.0.3 360488 Bytes 3/4/2008 00:22:31 AVREG.DLL : 7.0.1.6 30760 Bytes 7/18/2007 16:17:06 AVARKT.DLL : 1.0.0.20 278568 Bytes 8/28/2007 21:26:33 AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 7/18/2007 16:10:18 NETNT.DLL : 7.0.0.0 7720 Bytes 3/8/2007 20:09:42 RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 8/7/2007 21:38:13 RCTEXT.DLL : 7.0.62.0 86056 Bytes 8/21/2007 21:50:37 SQLITE3.DLL : 3.3.17.1 339968 Bytes 7/23/2007 18:37:21 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: off Scan boot sector.................: on Boot sectors.....................: D:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: Monday, March 03, 2008 22:11 The scan of running processes will be started Scan process 'iPodService.exe' - '1' Module(s) have been scanned Scan process 'wuauclt.exe' - '1' Module(s) have been scanned Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'MsPMSPSv.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'ntvdm.exe' - '1' Module(s) have been scanned Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned Scan process 'guard.exe' - '0' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'hpqimzone.exe' - '1' Module(s) have been scanned Scan process 'hpqste08.exe' - '1' Module(s) have been scanned Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned Scan process 'reader_sl.exe' - '1' Module(s) have been scanned Scan process 'rapimgr.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'CTSyncU.exe' - '1' Module(s) have been scanned Scan process 'wcescomm.exe' - '1' Module(s) have been scanned Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned Scan process 'Weather.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'avgas.exe' - '1' Module(s) have been scanned Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned Scan process 'qttask.exe' - '1' Module(s) have been scanned Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned Scan process 'realsched.exe' - '1' Module(s) have been scanned Scan process 'apdproxy.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 39 processes with 39 modules were scanned Start scanning boot sectors: Boot sector 'C:\' [NOTE] No virus was found! Boot sector 'D:\' [NOTE] No virus was found! Starting to scan the registry. The registry was scanned ( '25' files ). Starting the file scan: Begin scan in 'C:\' C:\hiberfil.sys [WARNING] The file could not be opened! C:\pagefile.sys [WARNING] The file could not be opened! Begin scan in 'D:\' End of the scan: Tuesday, March 04, 2008 00:04 Used time: 1:53:41 min The scan has been done completely. 8073 Scanning directories 460659 Files were scanned 0 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 0 files were moved to quarantine 0 files were renamed 2 Files cannot be scanned 460659 Files not concerned 20109 Archives were scanned 2 Warnings 0 Notes _____________________________________________________________________________________ Yeah! J;ai enfin résolu mes problèmes de connection!!! Voici donc les rapports que tu m'as demandés: Antivir puis un 2ème car il a scanné automatiquement après avoir redémarré: AntiVir PersonalEdition Classic Report file date: Monday, March 03, 2008 16:28 Scanning for 1130387 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Username: SYSTEM Computer name: NORRISFAMILY Version information: BUILD.DAT : 270 15603 Bytes 9/19/2007 13:32:00 AVSCAN.EXE : 7.0.6.1 290856 Bytes 8/23/2007 22:16:29 AVSCAN.DLL : 7.0.6.0 49192 Bytes 8/16/2007 21:23:51 LUKE.DLL : 7.0.5.3 147496 Bytes 8/15/2007 00:32:47 LUKERES.DLL : 7.0.6.1 10280 Bytes 8/21/2007 21:35:20 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 7/18/2007 23:27:15 ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 12/14/2007 00:22:29 ANTIVIR2.VDF : 7.0.2.181 1993728 Bytes 2/24/2008 00:22:29 ANTIVIR3.VDF : 7.0.2.216 135168 Bytes 3/2/2008 00:22:29 AVEWIN32.DLL : 7.6.0.73 3334656 Bytes 3/4/2008 00:22:30 AVWINLL.DLL : 1.0.0.7 14376 Bytes 2/26/2007 19:36:26 AVPREF.DLL : 7.0.2.2 25640 Bytes 7/18/2007 16:39:17 AVREP.DLL : 7.0.0.1 155688 Bytes 4/16/2007 22:16:24 AVPACK32.DLL : 7.6.0.3 360488 Bytes 3/4/2008 00:22:31 AVREG.DLL : 7.0.1.6 30760 Bytes 7/18/2007 16:17:06 AVARKT.DLL : 1.0.0.20 278568 Bytes 8/28/2007 21:26:33 AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 7/18/2007 16:10:18 NETNT.DLL : 7.0.0.0 7720 Bytes 3/8/2007 20:09:42 RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 8/7/2007 21:38:13 RCTEXT.DLL : 7.0.62.0 86056 Bytes 8/21/2007 21:50:37 SQLITE3.DLL : 3.3.17.1 339968 Bytes 7/23/2007 18:37:21 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: off Scan boot sector.................: on Boot sectors.....................: D:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: Monday, March 03, 2008 16:28 The scan of running processes will be started Scan process 'avscan.exe' - '0' Module(s) have been scanned Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'WINWORD.EXE' - '1' Module(s) have been scanned Scan process 'usnsvc.exe' - '1' Module(s) have been scanned Scan process 'iexplore.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'iPodService.exe' - '1' Module(s) have been scanned Scan process 'ntvdm.exe' - '1' Module(s) have been scanned Scan process 'hprblog.exe' - '1' Module(s) have been scanned Scan process 'hpqimzone.exe' - '1' Module(s) have been scanned Scan process 'hpqste08.exe' - '1' Module(s) have been scanned Scan process 'MsPMSPSv.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned Scan process 'guard.exe' - '0' Module(s) have been scanned Scan process 'rapimgr.exe' - '1' Module(s) have been scanned Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'CTSyncU.exe' - '1' Module(s) have been scanned Scan process 'wcescomm.exe' - '1' Module(s) have been scanned Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned Scan process 'Weather.exe' - '1' Module(s) have been scanned Scan process 'avgas.exe' - '1' Module(s) have been scanned Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned Scan process 'qttask.exe' - '1' Module(s) have been scanned Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned Scan process 'realsched.exe' - '1' Module(s) have been scanned Scan process 'apdproxy.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 43 processes with 43 modules were scanned Start scanning boot sectors: Boot sector 'C:\' [NOTE] No virus was found! Boot sector 'D:\' [NOTE] No virus was found! Starting to scan the registry. The registry was scanned ( '25' files ). Starting the file scan: Begin scan in 'C:\' C:\hiberfil.sys [WARNING] The file could not be opened! C:\pagefile.sys [WARNING] The file could not be opened! C:\SDFix\backups\backups.zip [0] Archive type: ZIP --> backups/sipov.dll [DETECTION] Is the Trojan horse TR/Click.Agent.LU --> backups/~.exe [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] A backup was created as '482faba0.qua' ( QUARANTINE ) [INFO] The file was deleted! C:\SDFix\backups\catchme.zip [0] Archive type: ZIP --> ntos.exe [DETECTION] Is the Trojan horse TR/PSW.Zbot.D [INFO] The file was moved to '4840aba8.qua'! C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP1011\A0350845.exe [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen [INFO] The file was moved to '47ffac2e.qua'! C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP1011\A0350846.exe [DETECTION] Is the Trojan horse TR/Agent.203776.3 [INFO] The file was moved to '47ffadb4.qua'! C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP1017\A0351461.exe [DETECTION] Is the Trojan horse TR/Mitglieder.203776 [INFO] The file was moved to '47ffb578.qua'! C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP1017\A0351462.exe [DETECTION] Is the Trojan horse TR/Click.Agent.MJ [INFO] The file was moved to '47ffb57a.qua'! C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP1017\A0351498.exe [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '47ffb581.qua'! C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP1017\A0351499.dll [DETECTION] Is the Trojan horse TR/Click.Agent.LU [INFO] The file was moved to '47ffb583.qua'! C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP1017\A0351509.dll [DETECTION] Is the Trojan horse TR/Click.Agent.LU [INFO] The file was moved to '47ffb587.qua'! C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP1017\A0351510.exe [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '47ffb589.qua'! Begin scan in 'D:\' End of the scan: Monday, March 03, 2008 19:27 Used time: 2:59:15 min The scan has been done completely. 8074 Scanning directories 461174 Files were scanned 11 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 1 files were deleted 0 files were repaired 10 files were moved to quarantine 0 files were renamed 2 Files cannot be scanned 461163 Files not concerned 20111 Archives were scanned 2 Warnings 0 Notes _______________________________________________________________________________ AntiVir PersonalEdition Classic Report file date: Monday, March 03, 2008 22:11 Scanning for 1130387 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Username: SYSTEM Computer name: NORRISFAMILY Version information: BUILD.DAT : 270 15603 Bytes 9/19/2007 13:32:00 AVSCAN.EXE : 7.0.6.1 290856 Bytes 8/23/2007 22:16:29 AVSCAN.DLL : 7.0.6.0 49192 Bytes 8/16/2007 21:23:51 LUKE.DLL : 7.0.5.3 147496 Bytes 8/15/2007 00:32:47 LUKERES.DLL : 7.0.6.1 10280 Bytes 8/21/2007 21:35:20 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 7/18/2007 23:27:15 ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 12/14/2007 00:22:29 ANTIVIR2.VDF : 7.0.2.181 1993728 Bytes 2/24/2008 00:22:29 ANTIVIR3.VDF : 7.0.2.216 135168 Bytes 3/2/2008 00:22:29 AVEWIN32.DLL : 7.6.0.73 3334656 Bytes 3/4/2008 00:22:30 AVWINLL.DLL : 1.0.0.7 14376 Bytes 2/26/2007 19:36:26 AVPREF.DLL : 7.0.2.2 25640 Bytes 7/18/2007 16:39:17 AVREP.DLL : 7.0.0.1 155688 Bytes 4/16/2007 22:16:24 AVPACK32.DLL : 7.6.0.3 360488 Bytes 3/4/2008 00:22:31 AVREG.DLL : 7.0.1.6 30760 Bytes 7/18/2007 16:17:06 AVARKT.DLL : 1.0.0.20 278568 Bytes 8/28/2007 21:26:33 AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 7/18/2007 16:10:18 NETNT.DLL : 7.0.0.0 7720 Bytes 3/8/2007 20:09:42 RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 8/7/2007 21:38:13 RCTEXT.DLL : 7.0.62.0 86056 Bytes 8/21/2007 21:50:37 SQLITE3.DLL : 3.3.17.1 339968 Bytes 7/23/2007 18:37:21 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: off Scan boot sector.................: on Boot sectors.....................: D:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: Monday, March 03, 2008 22:11 The scan of running processes will be started Scan process 'iPodService.exe' - '1' Module(s) have been scanned Scan process 'wuauclt.exe' - '1' Module(s) have been scanned Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'MsPMSPSv.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'ntvdm.exe' - '1' Module(s) have been scanned Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned Scan process 'guard.exe' - '0' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'hpqimzone.exe' - '1' Module(s) have been scanned Scan process 'hpqste08.exe' - '1' Module(s) have been scanned Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned Scan process 'reader_sl.exe' - '1' Module(s) have been scanned Scan process 'rapimgr.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'CTSyncU.exe' - '1' Module(s) have been scanned Scan process 'wcescomm.exe' - '1' Module(s) have been scanned Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned Scan process 'Weather.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'avgas.exe' - '1' Module(s) have been scanned Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned Scan process 'qttask.exe' - '1' Module(s) have been scanned Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned Scan process 'realsched.exe' - '1' Module(s) have been scanned Scan process 'apdproxy.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 39 processes with 39 modules were scanned Start scanning boot sectors: Boot sector 'C:\' [NOTE] No virus was found! Boot sector 'D:\' [NOTE] No virus was found! Starting to scan the registry. The registry was scanned ( '25' files ). Starting the file scan: Begin scan in 'C:\' C:\hiberfil.sys [WARNING] The file could not be opened! C:\pagefile.sys [WARNING] The file could not be opened! Begin scan in 'D:\' End of the scan: Tuesday, March 04, 2008 00:04 Used time: 1:53:41 min The scan has been done completely. 8073 Scanning directories 460659 Files were scanned 0 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 0 files were moved to quarantine 0 files were renamed 2 Files cannot be scanned 460659 Files not concerned 20109 Archives were scanned 2 Warnings 0 Notes _____________________________________________________________________________________ Rapport de AVG AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 8:14:26 PM 3/1/2008 + Scan result: C:\Program Files\Common Files\Real\WeatherBug\MiniBugTransporter.dll -> Adware.Minibug : Cleaned. HKLM\SOFTWARE\Classes\CLSID\{6AE02E1C-8859-4F57-9097-5A55A56A4CAF} -> Adware.MyTool : Cleaned. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{6AE02E1C-8859-4F57-9097-5A55A56A4CAF} -> Adware.MyTool : Cleaned. HKU\S-1-5-21-3962291611-4163577834-692928192-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{6AE02E1C-8859-4F57-9097-5A55A56A4CAF} -> Adware.MyTool : Cleaned. HKU\S-1-5-21-3962291611-4163577834-692928192-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6AE02E1C-8859-4F57-9097-5A55A56A4CAF} -> Adware.MyTool : Cleaned. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\O9O7QDLH\xpl[1].wmf -> Exploit.MS05-053-WMF : Cleaned. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\SS0RJ8A3\xpl[1].wmf -> Exploit.MS05-053-WMF : Cleaned. C:\Documents and Settings\Owner\Cookies\owner@advertising[1].txt -> TrackingCookie.Advertising : Cleaned. C:\Documents and Settings\Owner\Cookies\owner@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned. C:\Documents and Settings\Owner\Cookies\owner@sexlist[2].txt -> TrackingCookie.Sexlist : Cleaned. C:\Documents and Settings\Owner\Cookies\owner@counter15.sextracker[1].txt -> TrackingCookie.Sextracker : Cleaned. C:\Documents and Settings\Owner\Cookies\owner@sextracker[1].txt -> TrackingCookie.Sextracker : Cleaned. C:\Documents and Settings\Owner\Cookies\owner@anad.tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned. ::Report end ________________________________________________________________________________________ HijackThis Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:58:37 PM, on 3/5/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\Common Files\Real\Update_OB ealsched.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\AWS\WeatherBug\Weather.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\MICROS~3 apimgr.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\system32 tvdm.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Product Assistant\bin\hprblog.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\TrueSwitchComcast\TrueWizard.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: IE7Pro BHO - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IE7Pro\IE7Pro.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: ElnkScamBHO Class - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O2 - BHO: ElnkPubBHO Class - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPuB.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: ElnkProtectionBHO Class - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll O2 - BHO: TBSB02678 Class - {BDCA7AC9-C27B-4D30-A808-9B9081279C03} - C:\PROGRA~1\QUICKN~1\YOUTUB~1.DLL (file missing) O2 - BHO: ElnkLegacyUninstBHO Class - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB ealsched.exe" -osboot O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1 O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [SetDefaultMidi] MIDIDEF.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [SetDefaultMidi] MIDIDEF.EXE (User 'Default user') O4 - Startup: TrueAssistant.lnk = C:\Program Files\TrueSwitchComcast\TrueWizard.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader eader_sl.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &Download File - C:\Program Files\Winferno\Secure IE\Scripts\AddToTransferQueue.htm O8 - Extra context menu item: &Highlight - C:\Program Files\Winferno\Secure IE\Scripts\highlight.htm O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll/search.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: EarthLink Google Search - res://C:\Program Files\EarthLink TotalAccess\Toolbar\SearchUI.dll/search.html O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/229?bb6778072776431b91e43b41c210d5c0 O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/230?bb6778072776431b91e43b41c210d5c0 O8 - Extra context menu item: Zoom &In - C:\Program Files\Winferno\Secure IE\Scripts\zoomin.htm O8 - Extra context menu item: Zoom O&ut - C:\Program Files\Winferno\Secure IE\Scripts\zoomout.htm O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: webmail.pas.earthlink.net O15 - Trusted Zone: *.mcafee.com O15 - Trusted Zone: http://www.secuser.com O15 - Trusted Zone: owa.tahoma.wednet.edu O15 - Trusted Zone: http://www.tahoma.wednet.edu O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://cdn2.zone.msn.com/binframework/v10/ZAxRcMgr.cab31267.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5126/mcfscan.cab O18 - Protocol: bw+0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw+0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: bwg0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwg0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: offline-8876480 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

booddha · Answer

TrueWizard ça te parles ? Ce doit être un anti-spyware. Tu l'as acheté ? 

Tahoma School district ça te parles ? Site internet scolaire en Anglais.

Je ne serais pas là ce matin ni peut-être cet après-Midi. Réponds moi à ces questions.


En attendant gros ménage de fait. 

----------------------- Fixer des lignes  HitjackThis -------------------

Relancer Hitjackthis

	•	Fixer cette/ces lignes


O2 - BHO: TBSB02678 Class - {BDCA7AC9-C27B-4D30-A808-9B9081279C03} - C:\PROGRA~1\QUICKN~1\YOUTUB~1.DLL (file missing)


	•	Pour fixer cette/ces lignes.
	•	Cliquer sur la petite case à gauche de chaque ligne à fixer.

	•	Une fois cette/ces lignes cochées, cliquer sur le bouton en bas FIX CHECKED
	•	Redemarrer la machine et relancer HitJackThis
	•	Copier/Coller le nouveau rapport sur le forum.


Nous avons presque fini

seattle.ignorant · Answer

TrueWizard, c'est un logiciel pour transférer mon email person. Je viens de l'installer parce que j;ai changée de companie pour l'internet. 

Tahoma School District c'est ou je travaille donc pas de probleme .

seattle.ignorant · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:24:59 AM, on 3/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MICROS~3apimgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\TrueSwitchComcast\TrueWizard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32
tvdm.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\usnsvc.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IE7Pro BHO - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IE7Pro\IE7Pro.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ElnkScamBHO Class - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: ElnkPubBHO Class - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPuB.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ElnkProtectionBHO Class - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O2 - BHO: ElnkLegacyUninstBHO Class - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [SetDefaultMidi] MIDIDEF.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [SetDefaultMidi] MIDIDEF.EXE (User 'Default user')
O4 - Startup: TrueAssistant.lnk = C:\Program Files\TrueSwitchComcast\TrueWizard.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Download File - C:\Program Files\Winferno\Secure IE\Scripts\AddToTransferQueue.htm
O8 - Extra context menu item: &Highlight - C:\Program Files\Winferno\Secure IE\Scripts\highlight.htm
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: EarthLink Google Search - res://C:\Program Files\EarthLink TotalAccess\Toolbar\SearchUI.dll/search.html
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/229?bb6778072776431b91e43b41c210d5c0
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/230?bb6778072776431b91e43b41c210d5c0
O8 - Extra context menu item: Zoom &In - C:\Program Files\Winferno\Secure IE\Scripts\zoomin.htm
O8 - Extra context menu item: Zoom O&ut - C:\Program Files\Winferno\Secure IE\Scripts\zoomout.htm
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: webmail.pas.earthlink.net
O15 - Trusted Zone: *.mcafee.com
O15 - Trusted Zone: http://www.secuser.com
O15 - Trusted Zone: owa.tahoma.wednet.edu
O15 - Trusted Zone: http://www.tahoma.wednet.edu
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://cdn2.zone.msn.com/binframework/v10/ZAxRcMgr.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5126/mcfscan.cab
O18 - Protocol: bw+0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {8E4CBA29-435E-451F-96CD-27FE67DD33FE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

booddha · Answer

Je m'excuse auprès de DllD à qui j'avais laissé la place ce dont je ne me souvenais plus.

Fait cette dernière intervention

Regarder dans Demarrer --> Parametres --> Panneau de configuration -->> ajout de suppression si

LOPXP
COMBOFIX
OTEMOVEIT
Hijackthis
SDFix
Clean

se trouvent dans la liste,

Pour ceux que tu trouvent désinstalle les.

Ceux que tu ne trouvent pas sont simplement à supprimer de l'emplacement ou ils se trouvent sur ton disque dur.

Repasse un coup de CCLeaner avec les mêmes paramètres qu'au début. (Celui la tu peux le garder pour nettoyer de temps en temps)

Puis

=========== POINT DE RESTAURATION SYSTEME =============

* Désactivation :
Clic droit sur le "Poste de travail" > Propriétés > onglet "Restauration du système" > cocher la case "Désactiver la Restauration du système sur tous les lecteurs"
	•	Appliquer 
	•	patienter jusqu’a ce que cela soit marqué "désactivé" puis Ok.

* Activation :
Suivre le même chemin ; décocher la case "Désactiver la Restauration du système sur tous les lecteurs"
	•	Appliquer 
	•	patienter que cela soit à nouveau sur "surveillance" puis Ok. 
	•	Redémarrer l'ordinateur..  

Voilà, je pense que nous en avons terminé.

Je pense que le PC va bien ?

Utilisateur anonyme · Answer

Bonsoir vous deux,

Mais il n'y a pas de soucis....
Vous avez bien bossés....

booddha, Je ne sais pas si tu connaîs ToolsCleaner : http://www.commentcamarche.net/faq/sujet 8341 toolscleaner suppression des fix de force brute

=> Pratique pour supprimer les tous les fix d'un coup.

Bonne soirée,

A+

seattle.ignorant · Answer

Woa! Merci encore booddha (et DllD) pour TOUTE ton aide. Je suis très impressionée et très reconaissante!

Oui, l'ordinateur va bien, il est protégé ET nous n'avons plus ces horribles "pop-ups" à contenu moins que recommandable...

Encore merci. J'ai bien retenu ma leçon, ça c'est sur!

Je vais faire la même chose avec mon portable mais je vais attendre une paire de semaines... HA!

Mille mercis

booddha · Answer

Y a pas de quoi ;-)

Trojan? HijackThis scan result log

42 réponses

Discussions similaires

Newsletters