Pb avec antivirus xp 2008

Résolu
snow89 -  
Bonjour,
Voilà comme certaines personnes j'ai chopé le virus antivirus xp 2008 et je ne sais pas commnt faire pour l'enlever.
Merci par avance de vos conseils.
Configuration: Windows XP
Internet Explorer 7.0

46 réponses

Résumé de la discussion

Le problème central est la suppression du virus Antivirus XP 2008 sur Windows XP, qui s’invite dans les processus et les programmes au démarrage du système. Plusieurs méthodes proposent d’utiliser HijackThis pour analyser le système, renommer le programme et lancer un balayage afin de supprimer les entrées indésirables, puis de vérifier le rapport généré. D’autres recommandent Malwarebytes en mode sans échec pour effectuer un balayage complet, supprimer les éléments détectés et relancer un nouveau scan avec un rapport à poster ensuite. En cas de persistance, une vérification ciblée des éléments de démarrage et des modules complémentaires via les entrées O4 et O9 dans les rapports peut s’avérer nécessaire.

Bobot (l’IA à votre service)
  1. sKe69 Contributeur sécurité
    N'importe quoi ton lien kharec ...

    Commences par ce-ci snow89 :
    Télécharges et installes le logiciel HijackThis :

    ici :ftp://ftp.commentcamarche.com/download/HJTInstall.exe
    ou ici : http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe

    1-Cliquer sur le setup pour lancer l'installe : laisses toi guider et ne modifies pas les paramètres d'instalation .
    A la fin tu doit avoir un raccouci sur ton bureau et aussi un cheminement comme : "C:\ programme file\Trend Micro\HijackThis\HijackThis.exe " .

    Important :
    Renommer le prg HijackThis :
    Rends toi sur ton PC ici "C:\ programme file\Trend Micro\HijackThis\HijackThis.exe"<---cliques droit sur ce dernier et choisis "renommer" : tapes monjack et valide .

    tuto pour utilisation
    Regardes ici, c'est parfaitement expliqué en images :
    http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

    2-!!Déconnectes toi et fermes toute tes applications en cours !!

    Cliques sur le raccourci du bureau,
    Fais un scan monjack (ou HijackThis renommé) en cliquant sur : "Do a system scan and save a logfile"

    ---> Postes le rapport généré pour analyse ...
    1
    2. snow89
      merci de m'aider
      voici le rapport:
      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 22:23:04, on 10/07/2008
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16674)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
      C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
      C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
      C:\WINDOWS\system32\slserv.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
      C:\PROGRA~1\Wanadoo\CnxMon.exe
      C:\WINDOWS\SOUNDMAN.EXE
      C:\Apps\Powercinema\PCMService.exe
      C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
      C:\WINDOWS\ALCWZRD.EXE
      C:\apps\ABoard\ABoard.exe
      C:\apps\ABoard\AOSD.exe
      C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
      C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe
      C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
      C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
      C:\Program Files\QuickTime\QTTask.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\WINDOWS\system32\lphc3a7j0ev8p.exe
      C:\WINDOWS\system32\rundll32.exe
      C:\Program Files\Skype\Phone\Skype.exe
      C:\WINDOWS\NCLAUNCH.EXe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Save\Save.exe
      C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
      C:\WINDOWS\system32\pphc3a7j0ev8p.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\documents and settings\guillaume\local settings\application data\awcis.exe
      C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe
      C:\Program Files\Larousse\Encyclopédie Universelle Larousse\bin\hyperappel.exe
      C:\WINDOWS\System32\alg.exe
      C:\Program Files\WiFiConnector\NintendoWFCReg.exe
      C:\Program Files\Google\Google Updater\GoogleUpdater.exe
      C:\Program Files\OpenOffice.org1.1.4\program\soffice.exe
      C:\Program Files\Logitech\QuickCam10\COCIManager.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Windows Live\Messenger\usnsvc.exe
      C:\PROGRA~1\SONYER~1\MOBILE~1\DbgOut.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
      C:\Program Files\Trend Micro\HijackThis\Monjack.exe
      C:\WINDOWS\system32\wbem\wmiprvse.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
      O2 - BHO: {1f0c1ff8-4d7f-6d78-60a4-69f3a2f66bb5} - {5bb66f2a-3f96-4a06-87d6-f7d48ff1c0f1} - C:\WINDOWS\system32\ruohfw.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O2 - BHO: (no name) - {81025CD5-C017-4579-A18D-8D94C01D3B5F} - C:\WINDOWS\system32\geBrOIaw.dll
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: (no name) - {99F0A587-94D6-42A6-9A60-75EDA62F93F0} - C:\WINDOWS\system32\ljJBUkJA.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.5470\swg.dll
      O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
      O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
      O3 - Toolbar: SuperBar - {FC984B68-436E-4B1E-8E02-77B492AF758B} - (no file)
      O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
      O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
      O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
      O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
      O4 - HKLM\..\Run: [WOOKIT] C:\Program Files\Wanadoo\EspaceWanadoo.exe
      O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
      O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
      O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
      O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
      O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
      O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
      O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
      O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
      O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
      O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
      O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
      O4 - HKLM\..\Run: [djgwxln] c:\windows\system32\djgwxln.exe djgwxln
      O4 - HKLM\..\Run: [alewskvdj] c:\windows\system32\alewskvdj.exe alewskvdj
      O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
      O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
      O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
      O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [lphc3a7j0ev8p] C:\WINDOWS\system32\lphc3a7j0ev8p.exe
      O4 - HKLM\..\Run: [SMrhc7a7j0ev8p] C:\Program Files\rhc7a7j0ev8p\rhc7a7j0ev8p.exe
      O4 - HKLM\..\Run: [307fcc0f] rundll32.exe "C:\WINDOWS\system32\domdyuov.dll",b
      O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
      O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"
      O4 - HKCU\..\Run: [XP Tools] C:\Program Files\XP Tools\xptools.exe /min
      O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
      O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
      O4 - HKCU\..\Run: [awcis] c:\documents and settings\guillaume\local settings\application data\awcis.exe awcis
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Startup: OpenOffice.org 1.1.4.lnk = C:\Program Files\OpenOffice.org1.1.4\program\quickstart.exe
      O4 - Global Startup: Hyperappel de l'Encyclopédie Universelle Larousse.lnk = ?
      O4 - Global Startup: Lancer l'utilitaire d'enregistrement.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
      O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
      O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
      O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: CDPoker - {A68FC757-51CF-4f3c-B13A-BFB8CA69BB99} - C:\Poker\CDPoker\casino.exe
      O9 - Extra 'Tools' menuitem: CDPoker - {A68FC757-51CF-4f3c-B13A-BFB8CA69BB99} - C:\Poker\CDPoker\casino.exe
      O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
      O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
      O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe
      O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
      O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
      O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
      O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
      O16 - DPF: {0835BC90-6ABC-4F52-A103-4FC3A61F2C33} (A18X Control) - http://www6.albatross18.com/?tdfs=1&kw=games
      O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - https://www.linkedin.com/cab/LinkedInContactFinderControl.cab
      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by124w.bay124.mail.live.com/mail/resources/MsnPUpld.cab
      O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
      O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://express.foto.com/NewUploader/ImageUploader4.cab
      O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
      O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} (Sinstaller Class) - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
      O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/Zango/ie/bridge-c8.cab?9b91da394bb089c426c4c8fcb2032040a0984db8ccad09aad24d7ebc200f0941a5b810e6eae0e4827334f18e895434b50ff31e0c2b0e8f858ddc2e736e:e3eb4becbb5c1ba39dd084361d36488e
      O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game06.zylom.com/activex/zylomgamesplayer.cab
      O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - https://www.photobox.fr/?channel=1005
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} (CamfrogWEB Advanced Unicode Control) - https://www.bobtv.fr/download/cfweb_www.bobtv.fr-download_instmodule.exe
      O18 - Protocol: bw+0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw+0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw-0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw-0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw00 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw00s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw10 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw10s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw20 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw20s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw30 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw30s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw40 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw40s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw50 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw50s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw60 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw60s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw70 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw70s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw80 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw80s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw90 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw90s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwa0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwa0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwb0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwb0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwc0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwc0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwd0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwd0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwe0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwe0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwf0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwf0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
      O18 - Protocol: bwg0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwg0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwh0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwh0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwi0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwi0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwj0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwj0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwk0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwk0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwl0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwl0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwm0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwm0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwn0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwn0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwo0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwo0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwp0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwp0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwq0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwq0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwr0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwr0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bws0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bws0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwt0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwt0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwu0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwu0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwv0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwv0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bww0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bww0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwx0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwx0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwy0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwy0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwz0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwz0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: offline-8876480 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O20 - Winlogon Notify: geBrOIaw - C:\WINDOWS\SYSTEM32\geBrOIaw.dll
      O21 - SSODL: system32 - {0F4D8990-2216-4DB9-8590-064EF62119EC} - sysprinters.dll (file missing)
      O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
      O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
      O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
      O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Process Monitor (LVPrcSrv) - Unknown owner - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe (file missing)
      O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logishrd\SrvLnch\SrvLnch.exe
      O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
      O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
      O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
      O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
      0
      1. sKe69 Contributeur sécurité
        Pfffff ... y a du monde !!!

        Commençons par ce-ci pour voire :

        Télécharges ToolBar S&D ( de Eric_71 ) :
        https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

        ( Tuto : https://sites.google.com/site/toolbarsd/aideenimages )

        !! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

        * double-cliques sur l'.exe pour lancer l'installe et laisses toi guider ...
        * Une fois fait, cliques sur le raccourci créé sur ton bureau pour lancer l'outil .
        * Choisis l'option 1 ( "recherche") et tapes "entrée" .
        * Une fois le scan finit , un rapport va apparaître, copie/colles l'intégralité
        de son contenu dans ta prochaine réponse ...
        ( le rapport est en outre sauvegardé ici -> C:\TB.txt )
        0
        2. snow89
          volia le nouveau rapport:

          -----------\\ ToolBar S&D 1.0.3 XP/Vista

          [ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
          [ USER : guillaume ] [ "C:\Toolbar SD" ] [ Selection : 1 ]
          [ 10/07/2008 | 22:39:47,73 ] [ PC : PERRINE ]
          [ MAJ : 08-07-2008 | 22:24 ]

          -----------\\ Recherche de Fichiers / Dossiers ...

          C:\DOCUME~1\GUILLA~1\LOCALS~1\TEMPOR~1\content.IE5\SHC7A7K3\kazaabegone_big[1].gif
          C:\Program Files\Myway
          C:\Program Files\Myway\myBar
          C:\DOCUME~1\GUILLA~1\MENUDM~1\PROGRA~1\WhenU
          C:\DOCUME~1\GUILLA~1\LOCALS~1\TEMPOR~1\content.IE5\3PLPOETQ\whenusearch[1].js
          C:\DOCUME~1\GUILLA~1\LOCALS~1\TEMPOR~1\content.IE5\8X6R85YR\whenu[1].gif
          C:\DOCUME~1\GUILLA~1\LOCALS~1\TEMPOR~1\content.IE5\C9YRWDAF\whenusearch[1].js
          C:\DOCUME~1\GUILLA~1\LOCALS~1\TEMPOR~1\content.IE5\KT6NW92J\whenusearch[1].js
          C:\DOCUME~1\GUILLA~1\LOCALS~1\TEMPOR~1\content.IE5\YBORFC94\whenu_save_chr[2].gif
          C:\DOCUME~1\GUILLA~1\LOCALS~1\TEMPOR~1\content.IE5\0BBV8F7Q\3301529884818080_1[1].jpg
          C:\DOCUME~1\GUILLA~1\LOCALS~1\TEMPOR~1\content.IE5\U9K8NVL9\adlink%7C224%7C122727%7C0%7C165%7CAdId%3D1888486%3BBnId%3D1%3Bitime%3D720467698%3Blink%3D;ord=720467698[1]
          C:\WINDOWS\iun6002.exe

          -----------\\ [HKCU\..\Internet Explorer\Main]

          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

          -----------\\ Fin du rapport a 22:44:56,37
          0
          1. sKe69 Contributeur sécurité
            très bien ... on va nettoyer déjà ça :

            Nettoyage avec ToolBar S&D :

            !! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

            Relances Toolbar-S&D en double-cliquant sur le raccourci.
            -->Tapes sur l'option 2 ( "nettoyage" ) puis tapes sur "Entrée".
            Note : ne touches à rien lors de la suppression !
            Un rapport sera généré à la fin du processus : postes son contenu dans ta prochaine réponse
            accompagné d'un nouveau rapport hijackthis pour analyse ...

            ( PS : Si ton Bureau ne réapparait pas, appuies simultanément sur "Ctrl+Alt+Supp"r pour ouvrir le Gestionnaire des tâches.
            Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."
            Tapes explorer puis valides ... )
            0
            1. snow89
              voila le rapport de suppression:

              -----------\\ ToolBar S&D 1.0.3 XP/Vista

              [ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
              [ USER : guillaume ] [ "C:\Toolbar SD" ] [ Selection : 2 ]
              [ 10/07/2008 | 22:55:42,09 ] [ PC : PERRINE ]
              [ MAJ : 08-07-2008 | 22:24 ]

              -----------\\ SUPPRESSION

              Supprime! - C:\DOCUME~1\GUILLA~1\LOCALS~1\TEMPOR~1\content.IE5\SHC7A7K3\kazaabegone_big[1].gif
              Supprime! - C:\Program Files\Myway\myBar
              Supprime! - C:\DOCUME~1\GUILLA~1\MENUDM~1\PROGRA~1\WhenU
              Supprime! - C:\DOCUME~1\GUILLA~1\LOCALS~1\TEMPOR~1\content.IE5\3PLPOETQ\whenusearch[1].js
              Supprime! - C:\DOCUME~1\GUILLA~1\LOCALS~1\TEMPOR~1\content.IE5\8X6R85YR\whenu[1].gif
              Supprime! - C:\DOCUME~1\GUILLA~1\LOCALS~1\TEMPOR~1\content.IE5\C9YRWDAF\whenusearch[1].js
              Supprime! - C:\DOCUME~1\GUILLA~1\LOCALS~1\TEMPOR~1\content.IE5\KT6NW92J\whenusearch[1].js
              Supprime! - C:\DOCUME~1\GUILLA~1\LOCALS~1\TEMPOR~1\content.IE5\YBORFC94\whenu_save_chr[2].gif
              Supprime! - C:\DOCUME~1\GUILLA~1\LOCALS~1\TEMPOR~1\content.IE5\0BBV8F7Q\3301529884818080_1[1].jpg
              Supprime! - C:\DOCUME~1\GUILLA~1\LOCALS~1\TEMPOR~1\content.IE5\U9K8NVL9\adlink%7C224%7C122727%7C0%7C165%7CAdId%3D1888486%3BBnId%3D1%3Bitime%3D720467698%3Blink%3D;ord=720467698[1]
              Supprime! - C:\WINDOWS\iun6002.exe
              Supprime! - C:\Program Files\Myway

              -----------\\ Recherche de Fichiers / Dossiers ...

              -----------\\ [HKCU\..\Internet Explorer\Main]

              [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

              -----------\\ Fin du rapport a 23:05:45,01

              Et le nouveau Hijack:

              Logfile of Trend Micro HijackThis v2.0.2
              Scan saved at 23:09:05, on 10/07/2008
              Platform: Windows XP SP2 (WinNT 5.01.2600)
              MSIE: Internet Explorer v7.00 (7.00.6000.16674)
              Boot mode: Normal

              Running processes:
              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\csrss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\system32\spoolsv.exe
              C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
              C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
              C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
              C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
              C:\WINDOWS\system32\slserv.exe
              C:\WINDOWS\system32\svchost.exe
              C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
              C:\PROGRA~1\Wanadoo\CnxMon.exe
              C:\WINDOWS\SOUNDMAN.EXE
              C:\Apps\Powercinema\PCMService.exe
              C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
              C:\WINDOWS\ALCWZRD.EXE
              C:\apps\ABoard\ABoard.exe
              C:\apps\ABoard\AOSD.exe
              C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
              C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe
              C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
              C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
              C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
              C:\Program Files\QuickTime\QTTask.exe
              C:\Program Files\iTunes\iTunesHelper.exe
              C:\WINDOWS\system32\lphc3a7j0ev8p.exe
              C:\WINDOWS\system32\rundll32.exe
              C:\Program Files\Skype\Phone\Skype.exe
              C:\WINDOWS\NCLAUNCH.EXe
              C:\WINDOWS\system32\ctfmon.exe
              C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
              C:\WINDOWS\system32\pphc3a7j0ev8p.exe
              C:\Program Files\Windows Live\Messenger\msnmsgr.exe
              C:\Program Files\iPod\bin\iPodService.exe
              C:\documents and settings\guillaume\local settings\application data\awcis.exe
              C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe
              C:\Program Files\Larousse\Encyclopédie Universelle Larousse\bin\hyperappel.exe
              C:\WINDOWS\System32\alg.exe
              C:\Program Files\WiFiConnector\NintendoWFCReg.exe
              C:\Program Files\Google\Google Updater\GoogleUpdater.exe
              C:\Program Files\OpenOffice.org1.1.4\program\soffice.exe
              C:\Program Files\Logitech\QuickCam10\COCIManager.exe
              C:\WINDOWS\System32\svchost.exe
              C:\Program Files\Windows Live\Messenger\usnsvc.exe
              C:\PROGRA~1\SONYER~1\MOBILE~1\DbgOut.exe
              C:\WINDOWS\explorer.exe
              C:\Program Files\Save\Save.exe
              C:\Program Files\Wanadoo\EspaceWanadoo.exe
              C:\Program Files\Wanadoo\ComComp.exe
              C:\Program Files\Wanadoo\Watch.exe
              C:\Program Files\Internet Explorer\IEXPLORE.EXE
              C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
              C:\Program Files\Trend Micro\HijackThis\Monjack.exe
              C:\WINDOWS\system32\wbem\wmiprvse.exe

              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
              R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
              R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
              R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
              R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
              O2 - BHO: {1f0c1ff8-4d7f-6d78-60a4-69f3a2f66bb5} - {5bb66f2a-3f96-4a06-87d6-f7d48ff1c0f1} - C:\WINDOWS\system32\ruohfw.dll
              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
              O2 - BHO: (no name) - {81025CD5-C017-4579-A18D-8D94C01D3B5F} - C:\WINDOWS\system32\geBrOIaw.dll
              O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
              O2 - BHO: (no name) - {99F0A587-94D6-42A6-9A60-75EDA62F93F0} - C:\WINDOWS\system32\ljJBUkJA.dll
              O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
              O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.5470\swg.dll
              O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
              O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
              O3 - Toolbar: SuperBar - {FC984B68-436E-4B1E-8E02-77B492AF758B} - (no file)
              O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
              O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
              O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
              O4 - HKLM\..\Run: [WOOKIT] C:\Program Files\Wanadoo\EspaceWanadoo.exe
              O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
              O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
              O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
              O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
              O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
              O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
              O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
              O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
              O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
              O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
              O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
              O4 - HKLM\..\Run: [djgwxln] c:\windows\system32\djgwxln.exe djgwxln
              O4 - HKLM\..\Run: [alewskvdj] c:\windows\system32\alewskvdj.exe alewskvdj
              O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
              O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
              O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
              O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
              O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
              O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
              O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
              O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
              O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
              O4 - HKLM\..\Run: [lphc3a7j0ev8p] C:\WINDOWS\system32\lphc3a7j0ev8p.exe
              O4 - HKLM\..\Run: [SMrhc7a7j0ev8p] C:\Program Files\rhc7a7j0ev8p\rhc7a7j0ev8p.exe
              O4 - HKLM\..\Run: [307fcc0f] rundll32.exe "C:\WINDOWS\system32\domdyuov.dll",b
              O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
              O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
              O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
              O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
              O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
              O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"
              O4 - HKCU\..\Run: [XP Tools] C:\Program Files\XP Tools\xptools.exe /min
              O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
              O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
              O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
              O4 - HKCU\..\Run: [awcis] c:\documents and settings\guillaume\local settings\application data\awcis.exe awcis
              O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
              O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
              O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
              O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
              O4 - Startup: OpenOffice.org 1.1.4.lnk = C:\Program Files\OpenOffice.org1.1.4\program\quickstart.exe
              O4 - Global Startup: Hyperappel de l'Encyclopédie Universelle Larousse.lnk = ?
              O4 - Global Startup: Lancer l'utilitaire d'enregistrement.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
              O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
              O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
              O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
              O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
              O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
              O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
              O9 - Extra button: CDPoker - {A68FC757-51CF-4f3c-B13A-BFB8CA69BB99} - C:\Poker\CDPoker\casino.exe
              O9 - Extra 'Tools' menuitem: CDPoker - {A68FC757-51CF-4f3c-B13A-BFB8CA69BB99} - C:\Poker\CDPoker\casino.exe
              O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
              O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
              O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe
              O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
              O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
              O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
              O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
              O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
              O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
              O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
              O16 - DPF: {0835BC90-6ABC-4F52-A103-4FC3A61F2C33} (A18X Control) - http://www6.albatross18.com/?tdfs=1&kw=games
              O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - https://www.linkedin.com/cab/LinkedInContactFinderControl.cab
              O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by124w.bay124.mail.live.com/mail/resources/MsnPUpld.cab
              O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
              O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://express.foto.com/NewUploader/ImageUploader4.cab
              O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
              O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} (Sinstaller Class) - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
              O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/Zango/ie/bridge-c8.cab?9b91da394bb089c426c4c8fcb2032040a0984db8ccad09aad24d7ebc200f0941a5b810e6eae0e4827334f18e895434b50ff31e0c2b0e8f858ddc2e736e:e3eb4becbb5c1ba39dd084361d36488e
              O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game06.zylom.com/activex/zylomgamesplayer.cab
              O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - https://www.photobox.fr/?channel=1005
              O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
              O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} (CamfrogWEB Advanced Unicode Control) - https://www.bobtv.fr/download/cfweb_www.bobtv.fr-download_instmodule.exe
              O17 - HKLM\System\CCS\Services\Tcpip\..\{5B7E0AC0-DF13-4DAA-9267-A63BEBAA1BEE}: NameServer = 80.10.246.130 81.253.149.10
              O18 - Protocol: bw+0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw+0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw-0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw-0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw00 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw00s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw10 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw10s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw20 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw20s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw30 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw30s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw40 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw40s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw50 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw50s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw60 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw60s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw70 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw70s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw80 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw80s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw90 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bw90s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwa0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwa0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwb0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwb0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwc0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwc0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwd0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwd0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwe0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwe0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwf0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwf0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
              O18 - Protocol: bwg0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwg0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwh0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwh0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwi0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwi0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwj0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwj0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwk0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwk0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwl0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwl0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwm0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwm0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwn0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwn0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwo0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwo0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwp0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwp0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwq0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwq0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwr0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwr0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bws0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bws0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwt0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwt0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwu0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwu0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwv0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwv0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bww0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bww0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwx0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwx0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwy0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwy0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwz0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: bwz0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O18 - Protocol: offline-8876480 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
              O20 - Winlogon Notify: geBrOIaw - C:\WINDOWS\SYSTEM32\geBrOIaw.dll
              O21 - SSODL: system32 - {0F4D8990-2216-4DB9-8590-064EF62119EC} - sysprinters.dll (file missing)
              O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
              O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
              O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
              O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
              O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
              O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
              O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
              O23 - Service: Process Monitor (LVPrcSrv) - Unknown owner - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe (file missing)
              O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logishrd\SrvLnch\SrvLnch.exe
              O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
              O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
              O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
              O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
              0
              1. sKe69 Contributeur sécurité
                on continue :

                Télécharges Navilog1 sur ton bureau :

                http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

                !! Déconnectes toi,désactives tes défences( anti-virus,anti-spyware ) et fermes bien toutes tes applications le temps de la manipe !!

                Ensuite double clique sur navilog1.exe pour lancer l'installation.
                Une fois l'installation terminée, le fix s'exécutera automatiquement.
                (Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).

                Laisses-toi guider. Au menu principal, choisis 1 et valides.
                (ne fais pas le choix 2,3 ou 4 sans notre avis/accord)

                Patiente jusqu'au message :
                *** Analyse Termine le ..... ***

                Appuies sur une touche comme demandé, le bloc-note va s'ouvrir.
                Copie-colle l'intégralité de son contenu dans ta prochaine réponse et attends la suite .

                (Le rapport est en outre sauvegardé à la racine du disque "C\:fixnavi.txt" )

                TUTO (aide) : http://www.malekal.com/Adware.Magic_Control.php#mozTocId595901
                0
                1. snow89
                  voila le rapport:
                  Search Navipromo version 3.6.0 commencé le 10/07/2008 à 23:34:06,89

                  !!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
                  !!! Postez ce rapport sur le forum pour le faire analyser !!!
                  !!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

                  Outil exécuté depuis C:\Program Files\navilog1
                  Session actuelle : "guillaume"

                  Mise à jour le 27.06.2008 à 23h00 par IL-MAFIOSO

                  Microsoft Windows XP [version 5.1.2600]
                  Internet Explorer : 7.0.5730.11
                  Système de fichiers : NTFS

                  Recherche executé en mode normal

                  *** Recherche Programmes installés ***

                  WebMediaPlayer

                  *** Recherche dossiers dans "C:\WINDOWS" ***

                  *** Recherche dossiers dans "C:\Program Files" ***

                  C:\Program Files\Instant Access trouvé !
                  C:\Program Files\Montorgueil trouvé !
                  C:\Program Files\WebMediaPlayer trouvé !

                  *** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***

                  *** Recherche dossiers dans "c:\docume~1\alluse~1\menudÉ~1\progra~1" ***

                  *** Recherche dossiers dans "C:\Documents and Settings\guillaume\applic~1" ***

                  *** Recherche dossiers dans "C:\DOCUME~1\BBDAM~1\applic~1" ***

                  *** Recherche dossiers dans "C:\DOCUME~1\PROPRI~1\applic~1" ***

                  *** Recherche dossiers dans "C:\Documents and Settings\guillaume\locals~1\applic~1" ***

                  *** Recherche dossiers dans "C:\DOCUME~1\BBDAM~1\locals~1\applic~1" ***

                  *** Recherche dossiers dans "C:\Documents and Settings\guillaume\menudm~1\progra~1" ***

                  *** Recherche dossiers dans "C:\DOCUME~1\BBDAM~1\menudm~1\progra~1" ***

                  *** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
                  pour + d'infos : http://www.gmer.net

                  Aucun Fichier trouvé

                  *** Recherche avec GenericNaviSearch ***
                  !!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
                  !!! A vérifier impérativement avant toute suppression manuelle !!!

                  * Recherche dans "C:\WINDOWS\system32" *

                  * Recherche dans "C:\Documents and Settings\guillaume\locals~1\applic~1" *

                  Fichiers trouvés :

                  awcis.exe trouvé !
                  awcis.dat trouvé !
                  awcis_nav.dat trouvé !
                  awcis_navps.dat trouvé !
                  yidhgjesn.exe trouvé !
                  yidhgjesn.exe trouvé !

                  * Recherche dans "C:\DOCUME~1\BBDAM~1\locals~1\applic~1" *

                  *** Recherche fichiers ***

                  C:\Documents and Settings\guillaume\locals~1\Temp\pack.epk trouvé !
                  C:\WINDOWS\pack.epk trouvé !
                  C:\WINDOWS\tmlpcert2007 trouvé !
                  C:\WINDOWS\system32\nvs2.inf trouvé !

                  *** Recherche clés spécifiques dans le Registre ***

                  HKEY_CURRENT_USER\Software\Lanconfig trouvé !

                  *** Module de Recherche complémentaire ***
                  (Recherche fichiers spécifiques)

                  1)Recherche nouveaux fichiers Instant Access :

                  2)Recherche Heuristique :

                  * Dans "C:\WINDOWS\system32" :

                  alewskvdj.dat trouvé !
                  alewskvdj_nav.dat trouvé !
                  alewskvdj_navps.dat trouvé !
                  djgwxln.dat trouvé !
                  djgwxln_nav.dat trouvé !
                  djgwxln_navps.dat trouvé !
                  fbabohibvo.dat trouvé !
                  fbabohibvo_nav.dat trouvé !
                  fbabohibvo_navps.dat trouvé !

                  * Dans "C:\Documents and Settings\guillaume\locals~1\applic~1" :

                  awcis.dat trouvé !
                  awcis_nav.dat trouvé !
                  awcis_navps.dat trouvé !
                  gakrfyd.dat trouvé !
                  gakrfyd_nav.dat trouvé !
                  gakrfyd_navps.dat trouvé !
                  wiwnjbp.dat trouvé !
                  wiwnjbp_nav.dat trouvé !
                  wiwnjbp_navps.dat trouvé !

                  * Dans "C:\DOCUME~1\BBDAM~1\locals~1\applic~1" :

                  3)Recherche Certificats :

                  Certificat Egroup trouvé !
                  Certificat Electronic-Group trouvé !
                  Certificat OOO-Favorit trouvé !
                  Certificat Sunny-Day-Design-Ltd absent !

                  4)Recherche fichiers connus :

                  C:\WINDOWS\system32\AJkUBJjl.ini2 trouvé ! infection Vundo possible non traitée par cet outil !

                  *** Analyse terminée le 10/07/2008 à 23:38:22,18 ***
                  0
                  1. sKe69 Contributeur sécurité
                    La suite :
                    !! Déconnectes toi, désactives tes défences ( anti-virus,anti-spyware ) et fermes bien toutes tes applications le temps de la manipe !!

                    --->Double-cliques sur le raccourci Navilog1

                    Arriver au menu principal, choisir l'option 2 et valider (nettoyage "automatique" ).

                    Le fix demandera ensuite de "redémarrer le PC", fermer toutes les fenêtres ouvertes
                    et appuyer sur une touche comme demandé.( important : si le PC ne redémarre pas automatiquement, le faire manuellement )
                    Au redémarrage du PC, choisir la session habituelle si nécessaire.

                    Patienter jusqu'au message : "Nettoyage Terminé le ..."

                    Le bureau revient, puis le bloc-note s'ouvre .
                    Sauvegarder ce rapport de manière à le retrouver, puis fermer le bloc-note ...
                    (Le rapport sera en outre sauvegardé à la racine du disque "C\:cleannavi.txt")

                    Postes ce rapport dans ta nouvelle réponse accompagné d'un nouveau rapport hijacthis pour analyse et attends la suite ...

                    (PS : Si le bureau ne réapparaît pas, faire CTRL+ALT+SUPPR pour ouvrir le gestionnaire de tâches.
                    Choisir l'onglet processus. Cliquer en haut à gauche sur fichiers et choisir exécuter,
                    Taper explorer et valider.)
                    0
                    1. snow89
                      Ce fut long mais voici le rapport:
                      Clean Navipromo version 3.6.0 commencé le 10/07/2008 à 23:50:47,15

                      Outil exécuté depuis C:\Program Files\navilog1
                      Session actuelle : "guillaume"

                      Mise à jour le 27.06.2008 à 23h00 par IL-MAFIOSO

                      Microsoft Windows XP [version 5.1.2600]
                      Internet Explorer : 7.0.5730.11
                      Système de fichiers : NTFS

                      Mode suppression automatique
                      avec prise en charge résultats Catchme et GNS

                      Nettoyage exécuté au redémarrage de l'ordinateur

                      *** fsbl1.txt non trouvé ***
                      (Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)

                      *** Suppression avec sauvegardes résultats GenericNaviSearch ***

                      * Suppression dans "C:\WINDOWS\System32" *

                      C:\WINDOWS\prefetch\awcis*.pf trouvé !
                      Copie C:\WINDOWS\prefetch\awcis*.pf réalisée avec succès !
                      C:\WINDOWS\prefetch\awcis*.pf supprimé !

                      * Suppression dans "C:\Documents and Settings\guillaume\locals~1\applic~1" *

                      awcis.exe trouvé !
                      Copie awcis.exe réalisée avec succès !
                      awcis.exe supprimé !

                      awcis.dat trouvé !
                      Copie awcis.dat réalisée avec succès !
                      awcis.dat supprimé !

                      awcis_nav.dat trouvé !
                      Copie awcis_nav.dat réalisée avec succès !
                      awcis_nav.dat supprimé !

                      awcis_navps.dat trouvé !
                      Copie awcis_navps.dat réalisée avec succès !
                      awcis_navps.dat supprimé !

                      yidhgjesn.exe trouvé !
                      Copie yidhgjesn.exe réalisée avec succès !
                      yidhgjesn.exe supprimé !

                      * Suppression dans "C:\DOCUME~1\BBDAM~1\locals~1\applic~1" *

                      *** Suppression dossiers dans "C:\WINDOWS" ***

                      *** Suppression dossiers dans "C:\Program Files" ***

                      C:\Program Files\Instant Access ...suppression...
                      C:\Program Files\Instant Access supprimé !

                      C:\Program Files\Montorgueil ...suppression...
                      C:\Program Files\Montorgueil supprimé !

                      C:\Program Files\WebMediaPlayer ...suppression...
                      C:\Program Files\WebMediaPlayer supprimé !

                      *** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***

                      *** Suppression dossiers dans "c:\docume~1\alluse~1\menudÉ~1\progra~1" ***

                      *** Suppression dossiers dans "C:\Documents and Settings\guillaume\applic~1" ***

                      *** Suppression dossiers dans "C:\DOCUME~1\BBDAM~1\applic~1" ***

                      *** Suppression dossiers dans "C:\DOCUME~1\PROPRI~1\applic~1" ***

                      *** Suppression dossiers dans "C:\Documents and Settings\guillaume\locals~1\applic~1" ***

                      *** Suppression dossiers dans "C:\DOCUME~1\BBDAM~1\locals~1\applic~1" ***

                      *** Suppression dossiers dans "C:\Documents and Settings\guillaume\menudm~1\progra~1" ***

                      *** Suppression dossiers dans "C:\DOCUME~1\BBDAM~1\menudm~1\progra~1" ***

                      *** Suppression fichiers ***

                      C:\Documents and Settings\guillaume\locals~1\Temp\pack.epk supprimé !
                      C:\WINDOWS\pack.epk supprimé !
                      C:\WINDOWS\tmlpcert2007 supprimé !
                      C:\WINDOWS\system32\nvs2.inf supprimé !

                      *** Suppression fichiers temporaires ***

                      Nettoyage contenu C:\WINDOWS\Temp effectué !
                      Nettoyage contenu C:\Documents and Settings\guillaume\locals~1\Temp effectué !

                      *** Traitement Recherche complémentaire ***
                      (Recherche fichiers spécifiques)

                      1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

                      2)Recherche, création sauvegardes et suppression Heuristique :

                      * Dans "C:\WINDOWS\system32" *

                      alewskvdj.dat trouvé !
                      Copie alewskvdj.dat réalisée avec succès !
                      alewskvdj.dat supprimé !

                      djgwxln.dat trouvé !
                      Copie djgwxln.dat réalisée avec succès !
                      djgwxln.dat supprimé !

                      fbabohibvo.dat trouvé !
                      Copie fbabohibvo.dat réalisée avec succès !
                      fbabohibvo.dat supprimé !

                      alewskvdj_nav.dat trouvé !
                      Copie alewskvdj_nav.dat réalisée avec succès !
                      alewskvdj_nav.dat supprimé !

                      djgwxln_nav.dat trouvé !
                      Copie djgwxln_nav.dat réalisée avec succès !
                      djgwxln_nav.dat supprimé !

                      fbabohibvo_nav.dat trouvé !
                      Copie fbabohibvo_nav.dat réalisée avec succès !
                      fbabohibvo_nav.dat supprimé !

                      alewskvdj_navps.dat trouvé !
                      Copie alewskvdj_navps.dat réalisée avec succès !
                      alewskvdj_navps.dat supprimé !

                      djgwxln_navps.dat trouvé !
                      Copie djgwxln_navps.dat réalisée avec succès !
                      djgwxln_navps.dat supprimé !

                      fbabohibvo_navps.dat trouvé !
                      Copie fbabohibvo_navps.dat réalisée avec succès !
                      fbabohibvo_navps.dat supprimé !

                      * Dans "C:\Documents and Settings\guillaume\locals~1\applic~1" *

                      gakrfyd.dat trouvé !
                      Copie gakrfyd.dat réalisée avec succès !
                      gakrfyd.dat supprimé !

                      wiwnjbp.dat trouvé !
                      Copie wiwnjbp.dat réalisée avec succès !
                      wiwnjbp.dat supprimé !

                      gakrfyd_nav.dat trouvé !
                      Copie gakrfyd_nav.dat réalisée avec succès !
                      gakrfyd_nav.dat supprimé !

                      wiwnjbp_nav.dat trouvé !
                      Copie wiwnjbp_nav.dat réalisée avec succès !
                      wiwnjbp_nav.dat supprimé !

                      gakrfyd_navps.dat trouvé !
                      Copie gakrfyd_navps.dat réalisée avec succès !
                      gakrfyd_navps.dat supprimé !

                      wiwnjbp_navps.dat trouvé !
                      Copie wiwnjbp_navps.dat réalisée avec succès !
                      wiwnjbp_navps.dat supprimé !

                      * Dans "C:\DOCUME~1\BBDAM~1\locals~1\applic~1" *

                      *** Sauvegarde du Registre vers dossier Safebackup ***

                      sauvegarde du Registre réalisée avec succès !

                      *** Nettoyage Registre ***

                      Nettoyage Registre Ok

                      *** Certificats ***

                      Certificat Egroup supprimé !
                      Certificat Electronic-Group supprimé !
                      Certificat OOO-Favorit supprimé !
                      Certificat Sunny-Day-Design-Ltdt absent !

                      *** Nettoyage terminé le 11/07/2008 à 0:28:42,03 ***

                      Et le nouvel hijack:
                      Logfile of Trend Micro HijackThis v2.0.2
                      Scan saved at 00:35:37, on 11/07/2008
                      Platform: Windows XP SP2 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v7.00 (7.00.6000.16674)
                      Boot mode: Normal

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                      C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                      C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                      C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                      C:\WINDOWS\system32\slserv.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\Wanadoo\EspaceWanadoo.exe
                      C:\PROGRA~1\Wanadoo\CnxMon.exe
                      C:\WINDOWS\SOUNDMAN.EXE
                      C:\Apps\Powercinema\PCMService.exe
                      C:\Program Files\Wanadoo\ComComp.exe
                      C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
                      C:\WINDOWS\ALCWZRD.EXE
                      C:\apps\ABoard\ABoard.exe
                      C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
                      C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe
                      C:\apps\ABoard\AOSD.exe
                      C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
                      C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
                      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                      C:\Program Files\Wanadoo\Watch.exe
                      C:\Program Files\QuickTime\QTTask.exe
                      C:\Program Files\iTunes\iTunesHelper.exe
                      C:\WINDOWS\system32\lphc3a7j0ev8p.exe
                      C:\WINDOWS\system32\rundll32.exe
                      C:\Program Files\Skype\Phone\Skype.exe
                      C:\WINDOWS\NCLAUNCH.EXe
                      C:\WINDOWS\system32\ctfmon.exe
                      C:\Program Files\Save\Save.exe
                      C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe
                      C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                      C:\Program Files\Larousse\Encyclopédie Universelle Larousse\bin\hyperappel.exe
                      C:\Program Files\WiFiConnector\NintendoWFCReg.exe
                      C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                      C:\Program Files\OpenOffice.org1.1.4\program\soffice.exe
                      C:\Program Files\iPod\bin\iPodService.exe
                      C:\Program Files\Logitech\QuickCam10\COCIManager.exe
                      C:\Program Files\Internet Explorer\IEXPLORE.EXE
                      C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                      C:\Program Files\Windows Live\Messenger\usnsvc.exe
                      C:\Program Files\Trend Micro\HijackThis\Monjack.exe

                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
                      O2 - BHO: {1f0c1ff8-4d7f-6d78-60a4-69f3a2f66bb5} - {5bb66f2a-3f96-4a06-87d6-f7d48ff1c0f1} - C:\WINDOWS\system32\ruohfw.dll
                      O2 - BHO: (no name) - {5EF71B57-0F68-412A-AB4A-27343E1656E5} - C:\WINDOWS\system32\ljJBUkJA.dll
                      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                      O2 - BHO: (no name) - {81025CD5-C017-4579-A18D-8D94C01D3B5F} - C:\WINDOWS\system32\geBrOIaw.dll
                      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
                      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.5470\swg.dll
                      O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                      O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                      O3 - Toolbar: SuperBar - {FC984B68-436E-4B1E-8E02-77B492AF758B} - (no file)
                      O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
                      O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
                      O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
                      O4 - HKLM\..\Run: [WOOKIT] C:\Program Files\Wanadoo\EspaceWanadoo.exe
                      O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
                      O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                      O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
                      O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                      O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                      O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
                      O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                      O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
                      O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
                      O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
                      O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
                      O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
                      O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
                      O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
                      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                      O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
                      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
                      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                      O4 - HKLM\..\Run: [lphc3a7j0ev8p] C:\WINDOWS\system32\lphc3a7j0ev8p.exe
                      O4 - HKLM\..\Run: [SMrhc7a7j0ev8p] C:\Program Files\rhc7a7j0ev8p\rhc7a7j0ev8p.exe
                      O4 - HKLM\..\Run: [307fcc0f] rundll32.exe "C:\WINDOWS\system32\domdyuov.dll",b
                      O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
                      O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
                      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                      O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
                      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                      O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"
                      O4 - HKCU\..\Run: [XP Tools] C:\Program Files\XP Tools\xptools.exe /min
                      O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
                      O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                      O4 - Startup: OpenOffice.org 1.1.4.lnk = C:\Program Files\OpenOffice.org1.1.4\program\quickstart.exe
                      O4 - Global Startup: Hyperappel de l'Encyclopédie Universelle Larousse.lnk = ?
                      O4 - Global Startup: Lancer l'utilitaire d'enregistrement.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
                      O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                      O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                      O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
                      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                      O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
                      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                      O9 - Extra button: CDPoker - {A68FC757-51CF-4f3c-B13A-BFB8CA69BB99} - C:\Poker\CDPoker\casino.exe
                      O9 - Extra 'Tools' menuitem: CDPoker - {A68FC757-51CF-4f3c-B13A-BFB8CA69BB99} - C:\Poker\CDPoker\casino.exe
                      O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
                      O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
                      O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe
                      O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
                      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                      O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
                      O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
                      O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
                      O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
                      O16 - DPF: {0835BC90-6ABC-4F52-A103-4FC3A61F2C33} (A18X Control) - http://www6.albatross18.com/?tdfs=1&kw=games
                      O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - https://www.linkedin.com/cab/LinkedInContactFinderControl.cab
                      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by124w.bay124.mail.live.com/mail/resources/MsnPUpld.cab
                      O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
                      O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://express.foto.com/NewUploader/ImageUploader4.cab
                      O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
                      O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} (Sinstaller Class) - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
                      O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/Zango/ie/bridge-c8.cab?9b91da394bb089c426c4c8fcb2032040a0984db8ccad09aad24d7ebc200f0941a5b810e6eae0e4827334f18e895434b50ff31e0c2b0e8f858ddc2e736e:e3eb4becbb5c1ba39dd084361d36488e
                      O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game06.zylom.com/activex/zylomgamesplayer.cab
                      O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - https://www.photobox.fr/?channel=1005
                      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                      O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} (CamfrogWEB Advanced Unicode Control) - https://www.bobtv.fr/download/cfweb_www.bobtv.fr-download_instmodule.exe
                      O17 - HKLM\System\CCS\Services\Tcpip\..\{5B7E0AC0-DF13-4DAA-9267-A63BEBAA1BEE}: NameServer = 80.10.246.130 81.253.149.10
                      O18 - Protocol: bw+0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw+0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw-0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw-0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw00 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw00s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw10 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw10s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw20 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw20s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw30 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw30s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw40 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw40s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw50 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw50s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw60 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw60s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw70 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw70s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw80 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw80s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw90 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw90s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwa0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwa0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwb0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwb0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwc0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwc0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwd0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwd0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwe0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwe0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwf0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwf0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                      O18 - Protocol: bwg0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwg0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwh0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwh0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwi0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwi0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwj0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwj0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwk0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwk0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwl0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwl0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwm0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwm0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwn0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwn0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwo0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwo0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwp0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwp0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwq0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwq0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwr0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwr0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bws0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bws0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwt0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwt0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwu0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwu0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwv0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwv0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bww0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bww0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwx0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwx0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwy0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwy0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwz0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwz0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: offline-8876480 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O20 - Winlogon Notify: geBrOIaw - C:\WINDOWS\SYSTEM32\geBrOIaw.dll
                      O21 - SSODL: system32 - {0F4D8990-2216-4DB9-8590-064EF62119EC} - sysprinters.dll (file missing)
                      O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                      O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                      O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
                      O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                      O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                      O23 - Service: Process Monitor (LVPrcSrv) - Unknown owner - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe (file missing)
                      O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logishrd\SrvLnch\SrvLnch.exe
                      O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
                      O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
                      O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
                      O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
                      0
                      1. sKe69 Contributeur sécurité
                        Ce fut long --> vu l'état de ton PC , pas étonnant ^^

                        1- il y a des reste de Norton qui traînent qu'il faut absolument nettoyer ... pour cela :
                        Télécharges Norton removal tool sur ton bureau :
                        ftp://ftp.symantec.com/public/francais/removal_tools/Norton_Removal_Tool.exe

                        Déconnectes toi .
                        Ensuite désinstales Norton avec Norton removal tool :Tu doubles click dessus et te laisses guider : il faut bien le désinstaler ( fait la manipe 2 fois si possible ).

                        2-Télécharges : - CCleaner
                        https://www.pcastuces.com/logitheque/ccleaner.htm
                        Ce logiciel va permettre de supprimer tous les fichiers temporaires et de corrigé ton registre .Lors de l'installation, avant de cliquer sur le bouton "installer", décoche toutes les "options supplémentaires" sauf les 2 première.
                        Une fois le prg instalé et lancé, Clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures"( Par la suite, laisse-le avec ses réglages par défaut. C'est tout ).

                        Un tuto ( aide ):
                        http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm

                        ---> Utilisation:
                        vas dans "nettoyeur" : fait analyse puis nettoyage
                        et vas dans "registre" : fait chercher les erreurs et réparer ( plusieurs fois jusqu'à ce qu'il n'y est plus d'erreur ) .

                        ( CCleaner : soft à garder sur son PC , super utile pour de bons nettoyages ... )

                        3- Télécharges VirtumundoBegone sur ton bureau:
                        http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

                        !! Ce déconnecter et fermer toute ces applications le temps de la manipe !!

                        Double cliquer sur VirtumundoBeGone.exe et suivre les instructions.
                        Une fois terminé, redémarrer le PC, le rapport VBG.TXT sera crée sur le bureau .
                        (Si un message Ecran bleu "Erreur fatale" apparaît, pas d’inquiétude car c'est normal et attendu).

                        Postes le rapport VBG accompagné d'un nouveau rapport Hijackthis pour analyse ...

                        ---> j'attends donc les rapports demandés et je les analyserai demain ^^ .... au lit maintenant !

                        Je te conseille FORTEMENT de ne pas toucher à ton PC à part pour venir ici et poursuivre la désinfection ... tu es encore loin d'être tiré d'affaire ... mais rassures toi , on va y arriver ;)

                        A demain =)

                        0
                        2. sKe69 Contributeur sécurité
                          Salut,
                          disponible ... c'est quand tu veux ^^
                          0
                          1. snow89
                            voilà le vbg:

                            [07/11/2008, 12:33:39] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\guillaume\Local Settings\Temporary Internet Files\Content.IE5\HLS1S7NB\VirtumundoBeGone[1].exe" )
                            [07/11/2008, 12:33:44] - Detected System Information:
                            [07/11/2008, 12:33:44] - Windows Version: 5.1.2600, Service Pack 2
                            [07/11/2008, 12:33:44] - Current Username: guillaume (Admin)
                            [07/11/2008, 12:33:44] - Windows is in NORMAL mode.
                            [07/11/2008, 12:33:44] - Searching for Browser Helper Objects:
                            [07/11/2008, 12:33:44] - BHO 1: {4319178C-4B3E-4A29-B77F-CAF1A9A9ABBD} ()
                            [07/11/2008, 12:33:44] - WARNING: BHO has no default name. Checking for Winlogon reference.
                            [07/11/2008, 12:33:44] - Checking for HKLM\...\Winlogon\Notify\ljJBUkJA
                            [07/11/2008, 12:33:44] - Key not found: HKLM\...\Winlogon\Notify\ljJBUkJA, continuing.
                            [07/11/2008, 12:33:44] - BHO 2: {6bf7c666-d763-4e80-825e-0d4265651e27} ()
                            [07/11/2008, 12:33:44] - WARNING: BHO has no default name. Checking for Winlogon reference.
                            [07/11/2008, 12:33:44] - Checking for HKLM\...\Winlogon\Notify\wweukw
                            [07/11/2008, 12:33:44] - Key not found: HKLM\...\Winlogon\Notify\wweukw, continuing.
                            [07/11/2008, 12:33:44] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
                            [07/11/2008, 12:33:44] - BHO 4: {81025CD5-C017-4579-A18D-8D94C01D3B5F} ()
                            [07/11/2008, 12:33:44] - WARNING: BHO has no default name. Checking for Winlogon reference.
                            [07/11/2008, 12:33:44] - Checking for HKLM\...\Winlogon\Notify\geBrOIaw
                            [07/11/2008, 12:33:44] - Found: HKLM\...\Winlogon\Notify\geBrOIaw - This is probably Virtumundo.
                            [07/11/2008, 12:33:44] - Assigning {81025CD5-C017-4579-A18D-8D94C01D3B5F} MSEvents Object
                            [07/11/2008, 12:33:44] - BHO list has been changed! Starting over...
                            [07/11/2008, 12:33:44] - BHO 1: {4319178C-4B3E-4A29-B77F-CAF1A9A9ABBD} ()
                            [07/11/2008, 12:33:44] - WARNING: BHO has no default name. Checking for Winlogon reference.
                            [07/11/2008, 12:33:44] - Checking for HKLM\...\Winlogon\Notify\ljJBUkJA
                            [07/11/2008, 12:33:44] - Key not found: HKLM\...\Winlogon\Notify\ljJBUkJA, continuing.
                            [07/11/2008, 12:33:44] - BHO 2: {6bf7c666-d763-4e80-825e-0d4265651e27} ()
                            [07/11/2008, 12:33:44] - WARNING: BHO has no default name. Checking for Winlogon reference.
                            [07/11/2008, 12:33:44] - Checking for HKLM\...\Winlogon\Notify\wweukw
                            [07/11/2008, 12:33:45] - Key not found: HKLM\...\Winlogon\Notify\wweukw, continuing.
                            [07/11/2008, 12:33:45] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
                            [07/11/2008, 12:33:45] - BHO 4: {81025CD5-C017-4579-A18D-8D94C01D3B5F} (MSEvents Object)
                            [07/11/2008, 12:33:45] - ALERT: Found MSEvents Object!
                            [07/11/2008, 12:33:45] - BHO 5: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
                            [07/11/2008, 12:33:45] - BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
                            [07/11/2008, 12:33:45] - BHO 7: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
                            [07/11/2008, 12:33:45] - BHO 8: {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} (EpsonToolBandKicker Class)
                            [07/11/2008, 12:33:45] - Finished Searching Browser Helper Objects
                            [07/11/2008, 12:33:45] - *** Detected MSEvents Object
                            [07/11/2008, 12:33:45] - Trying to remove MSEvents Object...
                            [07/11/2008, 12:33:46] - Terminating Process: IEXPLORE.EXE
                            [07/11/2008, 12:33:46] - Terminating Process: RUNDLL32.EXE
                            [07/11/2008, 12:33:47] - Disabling Automatic Shell Restart
                            [07/11/2008, 12:33:47] - Terminating Process: EXPLORER.EXE
                            [07/11/2008, 12:33:47] - Suspending the NT Session Manager System Service
                            [07/11/2008, 12:33:51] - Terminating Windows NT Logon/Logoff Manager
                            [07/11/2008, 12:33:52] - Re-enabling Automatic Shell Restart
                            [07/11/2008, 12:33:52] - File to disable: C:\WINDOWS\system32\geBrOIaw.dll
                            [07/11/2008, 12:33:52] - Renaming C:\WINDOWS\system32\geBrOIaw.dll -> C:\WINDOWS\system32\geBrOIaw.dll.vir
                            [07/11/2008, 12:33:52] - File successfully renamed!
                            [07/11/2008, 12:33:52] - Removing HKLM\...\Browser Helper Objects\{81025CD5-C017-4579-A18D-8D94C01D3B5F}
                            [07/11/2008, 12:33:52] - Removing HKCR\CLSID\{81025CD5-C017-4579-A18D-8D94C01D3B5F}
                            [07/11/2008, 12:33:52] - Adding Kill Bit for ActiveX for GUID: {81025CD5-C017-4579-A18D-8D94C01D3B5F}
                            [07/11/2008, 12:33:52] - Deleting ATLEvents/MSEvents Registry entries
                            [07/11/2008, 12:33:52] - Removing HKLM\...\Winlogon\Notify\geBrOIaw
                            [07/11/2008, 12:33:52] - Searching for Browser Helper Objects:
                            [07/11/2008, 12:33:52] - BHO 1: {4319178C-4B3E-4A29-B77F-CAF1A9A9ABBD} ()
                            [07/11/2008, 12:33:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
                            [07/11/2008, 12:33:52] - Checking for HKLM\...\Winlogon\Notify\ljJBUkJA
                            [07/11/2008, 12:33:52] - Key not found: HKLM\...\Winlogon\Notify\ljJBUkJA, continuing.
                            [07/11/2008, 12:33:52] - BHO 2: {6bf7c666-d763-4e80-825e-0d4265651e27} ()
                            [07/11/2008, 12:33:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
                            [07/11/2008, 12:33:52] - Checking for HKLM\...\Winlogon\Notify\wweukw
                            [07/11/2008, 12:33:52] - Key not found: HKLM\...\Winlogon\Notify\wweukw, continuing.
                            [07/11/2008, 12:33:52] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
                            [07/11/2008, 12:33:52] - BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
                            [07/11/2008, 12:33:52] - BHO 5: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
                            [07/11/2008, 12:33:52] - BHO 6: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
                            [07/11/2008, 12:33:52] - BHO 7: {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} (EpsonToolBandKicker Class)
                            [07/11/2008, 12:33:52] - Finished Searching Browser Helper Objects
                            [07/11/2008, 12:33:52] - Finishing up...
                            [07/11/2008, 12:33:52] - A restart is needed.
                            [07/11/2008, 12:34:00] - Attempting to Restart via STOP error (Blue Screen!)

                            et le hijack:Logfile of Trend Micro HijackThis v2.0.2
                            Scan saved at 12:53:33, on 11/07/2008
                            Platform: Windows XP SP2 (WinNT 5.01.2600)
                            MSIE: Internet Explorer v7.00 (7.00.6000.16674)
                            Boot mode: Normal

                            Running processes:
                            C:\WINDOWS\System32\smss.exe
                            C:\WINDOWS\system32\winlogon.exe
                            C:\WINDOWS\system32\services.exe
                            C:\WINDOWS\system32\lsass.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\system32\spoolsv.exe
                            C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                            C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                            C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
                            C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                            C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                            C:\WINDOWS\system32\slserv.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\explorer.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\Program Files\Wanadoo\EspaceWanadoo.exe
                            C:\Program Files\Wanadoo\ComComp.exe
                            C:\Program Files\Wanadoo\Watch.exe
                            C:\Program Files\Trend Micro\HijackThis\Monjack.exe

                            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                            R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                            R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                            R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
                            O2 - BHO: (no name) - {55B764BC-B9DD-4CD0-A75B-0B03719DDCB6} - C:\WINDOWS\system32\ljJBUkJA.dll
                            O2 - BHO: {72e15656-24d0-e528-08e4-367d666c7fb6} - {6bf7c666-d763-4e80-825e-0d4265651e27} - C:\WINDOWS\system32\wweukw.dll
                            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                            O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
                            O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.5470\swg.dll
                            O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                            O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                            O3 - Toolbar: SuperBar - {FC984B68-436E-4B1E-8E02-77B492AF758B} - (no file)
                            O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
                            O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
                            O4 - HKLM\..\Run: [WOOKIT] C:\Program Files\Wanadoo\EspaceWanadoo.exe
                            O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
                            O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                            O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
                            O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                            O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                            O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
                            O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                            O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
                            O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
                            O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
                            O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
                            O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
                            O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
                            O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
                            O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                            O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
                            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
                            O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                            O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                            O4 - HKLM\..\Run: [lphc3a7j0ev8p] C:\WINDOWS\system32\lphc3a7j0ev8p.exe
                            O4 - HKLM\..\Run: [SMrhc7a7j0ev8p] C:\Program Files\rhc7a7j0ev8p\rhc7a7j0ev8p.exe
                            O4 - HKLM\..\Run: [307fcc0f] rundll32.exe "C:\WINDOWS\system32\swuskudj.dll",b
                            O4 - HKLM\..\Run: [SMshc5a7j0ev8p] C:\Program Files\shc5a7j0ev8p\shc5a7j0ev8p.exe
                            O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
                            O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
                            O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
                            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                            O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                            O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"
                            O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
                            O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                            O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                            O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                            O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                            O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                            O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                            O4 - Startup: OpenOffice.org 1.1.4.lnk = C:\Program Files\OpenOffice.org1.1.4\program\quickstart.exe
                            O4 - Global Startup: Hyperappel de l'Encyclopédie Universelle Larousse.lnk = ?
                            O4 - Global Startup: Lancer l'utilitaire d'enregistrement.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
                            O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                            O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                            O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
                            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                            O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
                            O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                            O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                            O9 - Extra button: CDPoker - {A68FC757-51CF-4f3c-B13A-BFB8CA69BB99} - C:\Poker\CDPoker\casino.exe
                            O9 - Extra 'Tools' menuitem: CDPoker - {A68FC757-51CF-4f3c-B13A-BFB8CA69BB99} - C:\Poker\CDPoker\casino.exe
                            O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
                            O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
                            O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe
                            O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
                            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                            O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
                            O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
                            O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
                            O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
                            O16 - DPF: {0835BC90-6ABC-4F52-A103-4FC3A61F2C33} (A18X Control) - http://www6.albatross18.com/?tdfs=1&kw=games
                            O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - https://www.linkedin.com/cab/LinkedInContactFinderControl.cab
                            O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by124w.bay124.mail.live.com/mail/resources/MsnPUpld.cab
                            O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
                            O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://express.foto.com/NewUploader/ImageUploader4.cab
                            O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
                            O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} (Sinstaller Class) - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
                            O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/Zango/ie/bridge-c8.cab?9b91da394bb089c426c4c8fcb2032040a0984db8ccad09aad24d7ebc200f0941a5b810e6eae0e4827334f18e895434b50ff31e0c2b0e8f858ddc2e736e:e3eb4becbb5c1ba39dd084361d36488e
                            O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game06.zylom.com/activex/zylomgamesplayer.cab
                            O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - https://www.photobox.fr/?channel=1005
                            O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                            O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} (CamfrogWEB Advanced Unicode Control) - https://www.bobtv.fr/download/cfweb_www.bobtv.fr-download_instmodule.exe
                            O18 - Protocol: bw+0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw+0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw-0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw-0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw00 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw00s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw10 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw10s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw20 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw20s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw30 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw30s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw40 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw40s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw50 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw50s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw60 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw60s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw70 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw70s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw80 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw80s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw90 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw90s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwa0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwa0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwb0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwb0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwc0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwc0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwd0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwd0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwe0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwe0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwf0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwf0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                            O18 - Protocol: bwg0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwg0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwh0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwh0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwi0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwi0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwj0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwj0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwk0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwk0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwl0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwl0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwm0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwm0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwn0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwn0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwo0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwo0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwp0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwp0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwq0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwq0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwr0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwr0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bws0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bws0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwt0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwt0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwu0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwu0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwv0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwv0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bww0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bww0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwx0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwx0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwy0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwy0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwz0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwz0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: offline-8876480 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O21 - SSODL: system32 - {0F4D8990-2216-4DB9-8590-064EF62119EC} - sysprinters.dll (file missing)
                            O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                            O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                            O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                            O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
                            O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                            O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                            O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                            O23 - Service: Process Monitor (LVPrcSrv) - Unknown owner - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe (file missing)
                            O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logishrd\SrvLnch\SrvLnch.exe
                            O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
                            O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
                            O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
                            0
                            1. sKe69 Contributeur sécurité
                              Ok ... Continuons :

                              Télécharges MalwareByte's :
                              ici ftp://ftp.commentcamarche.com/download/mbam-setup.exe
                              ou ici : http://www.malwarebytes.org/mbam.php

                              Installes le ( choisis bien "francais" ; ne modifies pas les paramètres d'installe ) et mets le à jour .

                              Potasses le tuto pour te familiariser avec le prg : https://forum.pcastuces.com/sujet.asp?f=31&s=3
                              ( cela dis, il est très simple d'utilisation ).

                              Impératif : redémarres en mode sans échec :
                              Comment aller en Mode sans échec
                              1) Redémarres ton ordi
                              2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
                              3) Tu verras un écran avec options de démarrage apparaître
                              4) Choisis la première option : Sans Échec, et valide avec "Entrée"
                              5) Choisis ton compte habituel, et non Administrateur (si besoin ... )
                              (attention : pas de connexion possible en mode sans échec , donc copies ou imprimes bien la manipe pour éviter les erreurs ...)

                              Lances Malwarebyte's .

                              Fais un scan dit "complet" ( sélectionnes bien tout tes disks avant le scan ) et supprimes tout ce qu'il peut trouver ; c.a.d :
                              --->une fois le scan terminé ,le bloc note s'ouvre : ferme le .
                              Puis click sur "résultat" : puis vérifies que tous les objets infectés soient validés, puis click sur " suppression " .

                              Redémarres ton PC ( mode normal ).

                              Postes le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes) accompagné d'un nouvel hijackthis ( fait en mode normal ) pour analyse ...
                              0
                              1. snow89
                                Après plus de 10h d'analyse voici le rapport:
                                Malwarebytes' Anti-Malware 1.20
                                Version de la base de données: 938
                                Windows 5.1.2600 Service Pack 2

                                00:36:07 12/07/2008
                                mbam-log-7-12-2008 (00-36-07).txt

                                Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|)
                                Eléments examinés: 191779
                                Temps écoulé: 10 hour(s), 33 minute(s), 15 second(s)

                                Processus mémoire infecté(s): 0
                                Module(s) mémoire infecté(s): 1
                                Clé(s) du Registre infectée(s): 34
                                Valeur(s) du Registre infectée(s): 8
                                Elément(s) de données du Registre infecté(s): 4
                                Dossier(s) infecté(s): 32
                                Fichier(s) infecté(s): 71

                                Processus mémoire infecté(s):
                                (Aucun élément nuisible détecté)

                                Module(s) mémoire infecté(s):
                                C:\WINDOWS\system32\ljJBUkJA.dll (Trojan.Vundo) -> Unloaded module successfully.

                                Clé(s) du Registre infectée(s):
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0aa78264-f5cb-4e32-8314-6a357270fb41} (Trojan.Vundo) -> Delete on reboot.
                                HKEY_CLASSES_ROOT\CLSID\{0aa78264-f5cb-4e32-8314-6a357270fb41} (Trojan.Vundo) -> Delete on reboot.
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{90b5a95a-afd5-4d11-b9bd-a69d53d22226} (Adware.Hotbar) -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8109fd3d-d891-4f80-8339-50a4913ace6f} (Adware.Zango) -> Quarantined and deleted successfully.
                                HKEY_CLASSES_ROOT\AppID\{127df9b4-d75d-44a6-af78-8c3a8ceb03db} (Adware.WhenUSave) -> Quarantined and deleted successfully.
                                HKEY_CLASSES_ROOT\acm.acmfactory (Adware.WhenUSave) -> Quarantined and deleted successfully.
                                HKEY_CLASSES_ROOT\TypeLib\{df901432-1b9f-4f5b-9e56-301c553f9095} (Adware.WhenUSave) -> Quarantined and deleted successfully.
                                HKEY_CLASSES_ROOT\CLSID\{a9aae1ab-9688-42c5-86f5-c12f6b9015ad} (Adware.WhenUSave) -> Quarantined and deleted successfully.
                                HKEY_CLASSES_ROOT\acm.acmfactory.1 (Adware.WhenUSave) -> Quarantined and deleted successfully.
                                HKEY_CLASSES_ROOT\Interface\{43382522-a846-46f4-ac57-1f71ae6e1086} (Adware.WhenUSave) -> Quarantined and deleted successfully.
                                HKEY_CLASSES_ROOT\Interface\{572fb162-c0ba-4edf-8cff-e3846153b9b0} (Adware.WhenUSave) -> Quarantined and deleted successfully.
                                HKEY_CLASSES_ROOT\Interface\{72a836d1-bc00-43c0-a941-17960e4fb842} (Adware.WhenUSave) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{90c61707-c8f8-43db-a25c-c1f4b18ee41e} (Spyware.Comet.Cursor) -> Quarantined and deleted successfully.
                                HKEY_CLASSES_ROOT\Interface\{610e0e95-8f2f-4b71-966e-f91701d4dc2c} (Adware.180Solutions) -> Quarantined and deleted successfully.
                                HKEY_CLASSES_ROOT\mediagatewayx.installer (Adware.180Solutions) -> Quarantined and deleted successfully.
                                HKEY_CLASSES_ROOT\mediagatewayx.installer.1 (Adware.180Solutions) -> Quarantined and deleted successfully.
                                HKEY_CLASSES_ROOT\CLSID\{8fcdf9d9-a28b-480f-8c3d-581f119a8ab8} (Adware.180Solutions) -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8fcdf9d9-a28b-480f-8c3d-581f119a8ab8} (Adware.180Solutions) -> Quarantined and deleted successfully.
                                HKEY_CLASSES_ROOT\Interface\{67a89831-6bc7-4cc0-a2c3-560f9a581e64} (Adware.180Solutions) -> Quarantined and deleted successfully.
                                HKEY_CLASSES_ROOT\Typelib\{91e523db-2a1c-4231-bb06-9be27c28739a} (Adware.180Solutions) -> Quarantined and deleted successfully.
                                HKEY_CLASSES_ROOT\Interface\{dd469a88-316c-441d-b712-783d9b9a6707} (Adware.180Solutions) -> Quarantined and deleted successfully.
                                HKEY_CLASSES_ROOT\Typelib\{981bda1d-c8ad-46ff-be2c-fddd859ac6f5} (Adware.180Solutions) -> Quarantined and deleted successfully.
                                HKEY_CLASSES_ROOT\AppID\{d28cd14c-50be-4cfa-951e-b37f25da3472} (Adware.180Solutions) -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SOFTWARE\superbar (Adware.SuperBar) -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SOFTWARE\Screensavers.com (Adware.Comet) -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSave (Adware.WhenUSave) -> Quarantined and deleted successfully.
                                HKEY_CLASSES_ROOT\AppID\ACM.DLL (Adware.WhenUSave) -> Quarantined and deleted successfully.
                                HKEY_CLASSES_ROOT\WUSN.1 (Adware.WhenUSave) -> Quarantined and deleted successfully.

                                Valeur(s) du Registre infectée(s):
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\307fcc0f (Trojan.Vundo) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\whenusave (Adware.WhenUSave) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{4e7bd74f-2b8d-469e-a0e8-ed6ab685fa7d} (Adware.2020Search) -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smrhc7a7j0ev8p (Rogue.Multiple) -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smshc5a7j0ev8p (Rogue.Multiple) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\mysearchnow.com (Malware.Trace) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\www.mysearchnow.com (Malware.Trace) -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphc3a7j0ev8p (Trojan.FakeAlert) -> Quarantined and deleted successfully.

                                Elément(s) de données du Registre infecté(s):
                                HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\ljjbukja -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\ljjbukja -> Delete on reboot.
                                HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

                                Dossier(s) infecté(s):
                                C:\Program Files\Screensavers.com (Adware.Comet) -> Quarantined and deleted successfully.
                                C:\Program Files\Screensavers.com\Installer (Adware.Comet) -> Quarantined and deleted successfully.
                                C:\Program Files\Screensavers.com\Installer\bin (Adware.Comet) -> Quarantined and deleted successfully.
                                C:\Program Files\Screensavers.com\Installer\Ready (Adware.Comet) -> Quarantined and deleted successfully.
                                C:\Program Files\Screensavers.com\Installer\temp (Adware.Comet) -> Quarantined and deleted successfully.
                                C:\Program Files\Screensavers.com\Installer\Upload (Adware.Comet) -> Quarantined and deleted successfully.
                                C:\Program Files\Screensavers.com\Wallpaper (Adware.Comet) -> Quarantined and deleted successfully.
                                C:\Program Files\Save (Adware.WhenUSave) -> Quarantined and deleted successfully.
                                C:\Program Files\rhc7a7j0ev8p (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\shc5a7j0ev8p (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\rhc7a7j0ev8p (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\rhc7a7j0ev8p\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\rhc7a7j0ev8p\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\rhc7a7j0ev8p\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\rhc7a7j0ev8p\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\rhc7a7j0ev8p\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\rhc7a7j0ev8p\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\rhc7a7j0ev8p\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\rhc7a7j0ev8p\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\rhc7a7j0ev8p\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\rhc7a7j0ev8p\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\shc5a7j0ev8p (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\shc5a7j0ev8p\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\shc5a7j0ev8p\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\shc5a7j0ev8p\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\shc5a7j0ev8p\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\shc5a7j0ev8p\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\shc5a7j0ev8p\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\shc5a7j0ev8p\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\shc5a7j0ev8p\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\shc5a7j0ev8p\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\shc5a7j0ev8p\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.

                                Fichier(s) infecté(s):
                                C:\WINDOWS\system32\ljJBUkJA.dll (Trojan.Vundo) -> Delete on reboot.
                                C:\WINDOWS\system32\AJkUBJjl.ini (Trojan.Vundo) -> Delete on reboot.
                                C:\WINDOWS\system32\AJkUBJjl.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\domdyuov.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\vouydmod.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\swuskudj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\jduksuws.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\ydmopecb.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\bcepomdy.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
                                C:\Program Files\Save\Save.exe (Adware.WhenUSave) -> Quarantined and deleted successfully.
                                C:\Program Files\Save\ACM.dll (Adware.WhenUSave) -> Quarantined and deleted successfully.
                                C:\Program Files\rhc7a7j0ev8p\rhc7a7j0ev8pSkin.dll (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP1021\A0242775.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP1021\A0243756.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP1021\A0244756.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP1021\A0244841.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP1021\A0245821.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP1021\A0246822.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP1021\A0247847.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP1021\A0248847.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP1021\A0249941.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\2.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\2C.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\3.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\4.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\5.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\6.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\7.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\8.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\isgdhc.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\wcsoiawn.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                                C:\Program Files\Screensavers.com\Installer\bin\iebyterange.xml (Adware.Comet) -> Quarantined and deleted successfully.
                                C:\Program Files\Screensavers.com\Installer\bin\iebyterange.xml.backup (Adware.Comet) -> Quarantined and deleted successfully.
                                C:\Program Files\Screensavers.com\Installer\bin\siuninst.exe (Adware.Comet) -> Quarantined and deleted successfully.
                                C:\Program Files\Screensavers.com\Installer\temp\dm79F.tmp (Adware.Comet) -> Quarantined and deleted successfully.
                                C:\Program Files\Screensavers.com\Wallpaper\swpstart.exe (Adware.Comet) -> Quarantined and deleted successfully.
                                C:\Program Files\Screensavers.com\Wallpaper\Triple H.jpg (Adware.Comet) -> Quarantined and deleted successfully.
                                C:\Program Files\Save\ffext.mod (Adware.WhenUSave) -> Quarantined and deleted successfully.
                                C:\Program Files\Save\save.db (Adware.WhenUSave) -> Quarantined and deleted successfully.
                                C:\Program Files\Save\save.htm (Adware.WhenUSave) -> Quarantined and deleted successfully.
                                C:\Program Files\Save\SaveUninst.exe (Adware.WhenUSave) -> Quarantined and deleted successfully.
                                C:\Program Files\Save\store.db (Adware.WhenUSave) -> Quarantined and deleted successfully.
                                C:\Program Files\rhc7a7j0ev8p\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\rhc7a7j0ev8p\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\rhc7a7j0ev8p\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\rhc7a7j0ev8p\rhc7a7j0ev8p.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\rhc7a7j0ev8p\Uninstall.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\shc5a7j0ev8p\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\shc5a7j0ev8p\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\shc5a7j0ev8p\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\shc5a7j0ev8p\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\shc5a7j0ev8p\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\shc5a7j0ev8p\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\shc5a7j0ev8p\shc5a7j0ev8p.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\shc5a7j0ev8p\shc5a7j0ev8p.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\shc5a7j0ev8p\shc5a7j0ev8pSkin.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\shc5a7j0ev8p\Uninstall.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\All Users\Bureau\Malware Protector 2008.lnk (Rogue.MalwareProtector2008) -> Quarantined and deleted successfully.
                                C:\WINDOWS\dialerexe.ini (Adware.NaviPromo) -> Quarantined and deleted successfully.
                                C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\clbdll.dll (Trojan.Agent) -> Delete on reboot.
                                C:\WINDOWS\system32\drivers\clbdriver.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\efcATJCS.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\blphc3a7j0ev8p.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\lphc3a7j0ev8p.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\phc3a7j0ev8p.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\WINDOWS\myalbum2007.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Application Data\Microsoft\Internet Explorer\Quick Launch\Malware Protector 2008.lnk (Rogue.MalwareProtector2008) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Local Settings\Temp\.tt1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\guillaume\Local Settings\Temp\.tt8.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

                                Et le hijack:
                                Logfile of Trend Micro HijackThis v2.0.2
                                Scan saved at 00:50:07, on 12/07/2008
                                Platform: Windows XP SP2 (WinNT 5.01.2600)
                                MSIE: Internet Explorer v7.00 (7.00.6000.16674)
                                Boot mode: Normal

                                Running processes:
                                C:\WINDOWS\System32\smss.exe
                                C:\WINDOWS\system32\winlogon.exe
                                C:\WINDOWS\system32\services.exe
                                C:\WINDOWS\system32\lsass.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\WINDOWS\system32\spoolsv.exe
                                C:\WINDOWS\Explorer.EXE
                                C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                                C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                                C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                                C:\WINDOWS\system32\slserv.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\PROGRA~1\Wanadoo\Watch.exe
                                C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
                                C:\Program Files\Wanadoo\EspaceWanadoo.exe
                                C:\PROGRA~1\Wanadoo\CnxMon.exe
                                C:\WINDOWS\SOUNDMAN.EXE
                                C:\Program Files\Wanadoo\ComComp.exe
                                C:\Apps\Powercinema\PCMService.exe
                                C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
                                C:\WINDOWS\ALCWZRD.EXE
                                C:\apps\ABoard\ABoard.exe
                                C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
                                C:\apps\ABoard\AOSD.exe
                                C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe
                                C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
                                C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
                                C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                                C:\Program Files\QuickTime\QTTask.exe
                                C:\Program Files\iTunes\iTunesHelper.exe
                                C:\Program Files\Skype\Phone\Skype.exe
                                C:\WINDOWS\NCLAUNCH.EXe
                                C:\WINDOWS\system32\ctfmon.exe
                                C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                                C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                                C:\Program Files\Larousse\Encyclopédie Universelle Larousse\bin\hyperappel.exe
                                C:\Program Files\WiFiConnector\NintendoWFCReg.exe
                                C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                                C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe
                                C:\Program Files\OpenOffice.org1.1.4\program\soffice.exe
                                C:\Program Files\iPod\bin\iPodService.exe
                                C:\Program Files\Logitech\QuickCam10\COCIManager.exe
                                C:\Program Files\Internet Explorer\IEXPLORE.EXE
                                C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\Program Files\Windows Live\Messenger\usnsvc.exe
                                C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
                                C:\WINDOWS\system32\NOTEPAD.EXE
                                C:\Program Files\Trend Micro\HijackThis\Monjack.exe

                                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
                                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
                                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                                R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                                R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
                                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
                                O2 - BHO: (no name) - {67D813DE-658F-4861-864C-B396E7DC0CEA} - C:\WINDOWS\system32\ljJBUkJA.dll
                                O2 - BHO: {72e15656-24d0-e528-08e4-367d666c7fb6} - {6bf7c666-d763-4e80-825e-0d4265651e27} - C:\WINDOWS\system32\wweukw.dll
                                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                                O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
                                O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.5470\swg.dll
                                O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                                O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                                O3 - Toolbar: SuperBar - {FC984B68-436E-4B1E-8E02-77B492AF758B} - (no file)
                                O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
                                O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
                                O4 - HKLM\..\Run: [WOOKIT] C:\Program Files\Wanadoo\EspaceWanadoo.exe
                                O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
                                O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                                O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
                                O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                                O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                                O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
                                O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                                O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
                                O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
                                O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
                                O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
                                O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
                                O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
                                O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
                                O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                                O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
                                O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
                                O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                                O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                                O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                                O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
                                O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
                                O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                                O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                                O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
                                O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                                O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                                O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                                O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                                O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                                O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                                O4 - Startup: OpenOffice.org 1.1.4.lnk = C:\Program Files\OpenOffice.org1.1.4\program\quickstart.exe
                                O4 - Global Startup: Hyperappel de l'Encyclopédie Universelle Larousse.lnk = ?
                                O4 - Global Startup: Lancer l'utilitaire d'enregistrement.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
                                O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                                O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                                O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
                                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                                O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
                                O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                                O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                                O9 - Extra button: CDPoker - {A68FC757-51CF-4f3c-B13A-BFB8CA69BB99} - C:\Poker\CDPoker\casino.exe
                                O9 - Extra 'Tools' menuitem: CDPoker - {A68FC757-51CF-4f3c-B13A-BFB8CA69BB99} - C:\Poker\CDPoker\casino.exe
                                O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
                                O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
                                O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe
                                O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
                                O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
                                O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
                                O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
                                O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
                                O16 - DPF: {0835BC90-6ABC-4F52-A103-4FC3A61F2C33} (A18X Control) - http://www6.albatross18.com/?tdfs=1&kw=games
                                O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - https://www.linkedin.com/cab/LinkedInContactFinderControl.cab
                                O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by124w.bay124.mail.live.com/mail/resources/MsnPUpld.cab
                                O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
                                O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://express.foto.com/NewUploader/ImageUploader4.cab
                                O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
                                O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} (Sinstaller Class) - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
                                O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game06.zylom.com/activex/zylomgamesplayer.cab
                                O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - https://www.photobox.fr/?channel=1005
                                O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                                O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} (CamfrogWEB Advanced Unicode Control) - https://www.bobtv.fr/download/cfweb_www.bobtv.fr-download_instmodule.exe
                                O17 - HKLM\System\CCS\Services\Tcpip\..\{5B7E0AC0-DF13-4DAA-9267-A63BEBAA1BEE}: NameServer = 80.10.246.130 81.253.149.10
                                O18 - Protocol: bw+0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw+0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw-0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw-0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw00 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw00s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw10 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw10s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw20 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw20s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw30 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw30s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw40 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw40s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw50 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw50s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw60 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw60s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw70 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw70s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw80 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw80s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw90 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw90s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwa0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwa0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwb0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwb0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwc0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwc0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwd0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwd0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwe0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwe0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwf0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwf0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                                O18 - Protocol: bwg0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwg0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwh0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwh0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwi0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwi0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwj0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwj0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwk0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwk0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwl0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwl0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwm0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwm0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwn0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwn0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwo0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwo0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwp0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwp0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwq0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwq0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwr0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwr0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bws0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bws0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwt0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwt0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwu0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwu0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwv0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwv0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bww0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bww0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwx0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwx0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwy0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwy0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwz0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwz0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: offline-8876480 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O21 - SSODL: system32 - {0F4D8990-2216-4DB9-8590-064EF62119EC} - sysprinters.dll (file missing)
                                O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                                O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                                O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                                O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
                                O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                                O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                                O23 - Service: Process Monitor (LVPrcSrv) - Unknown owner - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe (file missing)
                                O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logishrd\SrvLnch\SrvLnch.exe
                                O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
                                O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
                                O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
                                0
                                1. sKe69 Contributeur sécurité
                                  10 h 30 ! Et bé ... Entout cas il a bien bossé ....

                                  Mais il reste pas mal de chose ...

                                  Fais exactement ce qui suit :

                                  Télécharges ComboFix (par sUBs) sur ton Bureau (et pas ailleur !):
                                  http://download.bleepingcomputer.com/sUBs/ComboFix.exe <--- clik droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix et valide .

                                  --------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
                                  !! déconnectes toi,fermes tes applications en cours et DESACTIVES TOUTES TES DEFENCES (anti-virus, guardes anti spy-ware, pare-feu) le temps de la manipe :
                                  en effet , activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil ( voir planter le PC )...Tu les réactiveras donc après !!
                                  --->Important : si tu rencontres des difficultés à ce niveau là, fais m'en part avant de poursuivre ...
                                  Tuto ( aide ) ici : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
                                  ---------------------------------------------------------------------------------------------------------------------------------

                                  Ensuite :
                                  double-cliques C-Fix.exe ( = combofix.exe ) .

                                  Appuyes sur la touche Y (Yes) pour démarrer le scan .

                                  Attention : n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
                                  ---> si un message d'erreur windows apparait à un momment : clik sur la croix rouge en haut à droite de la fenêtre pour la fermer ( et pas sur autre chose ! sinon pas de rapport ... )

                                  Le rapport sera crée dans: C:\Combofix.txt

                                  Postes le rapport Combofix accompagné d'un nouveau rapport hijackthis pour analyse ...

                                  0
                                  1. snow89
                                    volia le rapport combo fix:
                                    ComboFix 08-07-11.1 - guillaume 2008-07-12 9:41:18.1 - NTFSx86
                                    Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.567 [GMT 2:00]
                                    Endroit: C:\Documents and Settings\guillaume\Bureau\C-Fix.exe
                                    * Création d'un nouveau point de restauration
                                    .

                                    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                                    .

                                    C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malware Protector 2008
                                    C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malware Protector 2008.lnk
                                    C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malware Protector 2008\How to Register Malware Protector 2008.lnk
                                    C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malware Protector 2008\License Agreement.lnk
                                    C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malware Protector 2008\Malware Protector 2008.lnk
                                    C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malware Protector 2008\Register Malware Protector 2008.lnk
                                    C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malware Protector 2008\Uninstall.lnk
                                    C:\Documents and Settings\guillaume\new.txt
                                    C:\WINDOWS\config.ini
                                    C:\WINDOWS\Downloaded Program Files\UWAS6V_0001_N68M1103NetInstaller.exe
                                    C:\WINDOWS\system32\AJkUBJjl.ini
                                    C:\WINDOWS\system32\AJkUBJjl.ini2
                                    C:\WINDOWS\system32\clbdll.dll
                                    C:\WINDOWS\system32\clbinit.dll
                                    C:\WINDOWS\system32\mcrh.tmp
                                    C:\WINDOWS\system32\MSINET.oca
                                    C:\WINDOWS\system32\oeminfo.ini

                                    .
                                    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
                                    .

                                    -------\Legacy_CLBDRIVER
                                    -------\Service_clbdriver

                                    ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-12 to 2008-07-12 ))))))))))))))))))))))))))))))))))))
                                    .

                                    2381-05-27 03:08 . 2381-05-27 03:08 3,120 --a--c--- C:\WINDOWS\MF_C421.lfa
                                    2381-05-27 03:08 . 2381-05-27 03:08 3,120 --a--c--- C:\WINDOWS\MF_C420.lfa
                                    2008-07-12 09:36 . 2008-07-12 09:36 116,864 --a------ C:\WINDOWS\system32\apnnjxkh.dll
                                    2008-07-12 09:36 . 2008-07-12 09:36 116,864 --a------ C:\WINDOWS\system32\ahslun.dll
                                    2008-07-11 13:12 . 2008-07-11 13:12 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                                    2008-07-11 13:12 . 2008-07-11 13:12 <REP> d-------- C:\Documents and Settings\guillaume\Application Data\Malwarebytes
                                    2008-07-11 13:12 . 2008-07-11 13:12 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                                    2008-07-11 13:12 . 2008-07-07 17:35 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
                                    2008-07-11 13:12 . 2008-07-07 17:35 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                                    2008-07-11 11:58 . 2008-07-11 11:58 <REP> d-------- C:\Program Files\CCleaner
                                    2008-07-11 01:08 . 2008-07-11 01:08 116,352 --a------ C:\WINDOWS\system32\wweukw.dll
                                    2008-07-11 01:08 . 2008-07-11 01:08 116,352 --a------ C:\WINDOWS\system32\olgatgrm.dll
                                    2008-07-10 23:15 . 2008-07-11 00:28 <REP> d-------- C:\Program Files\Navilog1
                                    2008-07-10 22:39 . 2008-07-10 23:05 <REP> d-------- C:\Toolbar SD
                                    2008-07-10 22:19 . 2008-07-10 22:19 <REP> d-------- C:\Program Files\Trend Micro
                                    2008-07-10 21:44 . 2008-07-11 09:40 <REP> d-------- C:\Program Files\RogueRemover FREE
                                    2008-07-10 21:25 . 2008-07-10 21:25 <REP> d-------- C:\Program Files\Enigma Software Group
                                    2008-07-10 18:05 . 2008-07-10 18:05 116,352 --a------ C:\WINDOWS\system32\ruohfw.dll
                                    2008-07-10 18:05 . 2008-07-10 18:05 116,352 --a------ C:\WINDOWS\system32\kbwffejo.dll
                                    2008-07-10 18:03 . 2008-07-10 18:03 116,352 --a------ C:\WINDOWS\system32\vgrxka.dll
                                    2008-07-10 18:03 . 2008-07-10 18:03 116,352 --a------ C:\WINDOWS\system32\ugclkobk.dll
                                    2008-07-10 16:00 . 2008-07-10 16:00 318,720 --------- C:\WINDOWS\system32\ljJBUkJA.dll
                                    2008-07-10 15:55 . 2008-07-10 15:55 29,056 --a------ C:\WINDOWS\system32\geBrOIaw.dll.vir
                                    2008-07-10 15:55 . 2004-08-05 15:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
                                    2008-07-03 13:18 . 2008-07-03 13:18 <REP> d-------- C:\Program Files\iPod
                                    2008-06-25 00:15 . 2008-06-25 00:15 <REP> d-------- C:\Program Files\ffdshow
                                    2008-06-25 00:15 . 2006-12-11 15:38 5,120 --a------ C:\WINDOWS\system32\ff_vfw.dll
                                    2008-06-25 00:15 . 2006-12-11 15:33 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest
                                    2008-06-20 19:41 . 2008-06-20 19:41 247,808 --------- C:\WINDOWS\system32\dllcache\mswsock.dll
                                    2008-06-20 12:44 . 2008-06-20 12:44 138,368 --------- C:\WINDOWS\system32\dllcache\afd.sys

                                    .
                                    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                                    .
                                    2008-07-12 07:56 36,363,296 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
                                    2008-07-12 07:55 1,207,072 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
                                    2008-07-12 07:51 --------- d-----w C:\Program Files\Wanadoo
                                    2008-07-12 07:48 491,120 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
                                    2008-07-12 07:48 116,228 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
                                    2008-07-12 07:34 --------- d-----w C:\Documents and Settings\guillaume\Application Data\Skype
                                    2008-07-12 07:14 --------- d-----w C:\Program Files\OpenOffice.org1.1.4
                                    2008-07-12 07:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
                                    2008-07-10 13:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
                                    2008-07-05 20:32 --------- d-----w C:\Program Files\Everest Poker
                                    2008-07-05 17:39 --------- d-----w C:\Program Files\Google
                                    2008-07-03 14:13 --------- d-----w C:\Program Files\Apple Software Update
                                    2008-07-03 11:18 --------- d-----w C:\Program Files\iTunes
                                    2008-07-03 11:17 --------- d-----w C:\Program Files\QuickTime
                                    2008-06-29 20:59 --------- d-----w C:\Program Files\Soulseek
                                    2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
                                    2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
                                    2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
                                    2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
                                    2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
                                    2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
                                    2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
                                    2008-06-18 16:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\TrackMania
                                    2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
                                    2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\dllcache\bthport.sys
                                    2008-06-09 20:55 --------- d-----w C:\Program Files\LimeWire
                                    2008-06-09 19:45 96,966 ----a-w C:\WINDOWS\system32\drivers\klin.dat
                                    2008-06-09 19:45 88,774 ----a-w C:\WINDOWS\system32\drivers\klick.dat
                                    2008-06-09 19:45 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
                                    2008-05-24 13:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zylom
                                    2008-05-13 18:00 --------- d-----w C:\Program Files\TmNationsForever
                                    2008-05-08 12:28 202,752 ------w C:\WINDOWS\system32\dllcache\rmcast.sys
                                    2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
                                    2008-05-07 05:15 1,293,824 ------w C:\WINDOWS\system32\dllcache\quartz.dll
                                    2008-04-23 20:16 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
                                    2008-04-22 07:41 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
                                    2008-04-22 07:41 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
                                    2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
                                    2008-04-20 05:07 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
                                    2007-09-25 16:19 57,888 ----a-w C:\Documents and Settings\guillaume\Application Data\GDIPFONTCACHEV1.DAT
                                    2005-06-16 21:00 56 -csh--r C:\WINDOWS\system32\AA2DE4B386.sys
                                    .

                                    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                                    .
                                    .
                                    REGEDIT4
                                    *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

                                    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{831124a2-1c60-49b5-85ab-97fd491cba8d}]
                                    2008-07-12 09:36 116864 --a------ C:\WINDOWS\system32\ahslun.dll

                                    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{93E7BA20-E8F9-414C-8B43-762BC7A8DE0F}]
                                    2008-07-10 16:00 318720 --------- C:\WINDOWS\system32\ljJBUkJA.dll

                                    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                    "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-10-13 18:20 20058152]
                                    "NCLaunch"="C:\WINDOWS\NCLAUNCH.EXe" [2004-12-31 17:33 40960]
                                    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 15:00 15360]
                                    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-05 23:06 68856]
                                    "MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2006-12-21 20:46 190024]
                                    "LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-09-15 18:29 36864]
                                    "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]

                                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                    "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-05-13 10:28 24576]
                                    "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\TaskbarIcon.exe" [2004-05-13 10:28 49152]
                                    "WOOKIT"="C:\Program Files\Wanadoo\EspaceWanadoo.exe" [2004-05-13 10:28 688128]
                                    "WooCnxMon"="C:\PROGRA~1\Wanadoo\CnxMon.exe" [2004-05-13 10:28 24576]
                                    "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 15:00 455168]
                                    "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 15:00 455168]
                                    "PCMService"="c:\Apps\Powercinema\PCMService.exe" [2004-10-08 04:14 81920]
                                    "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 15:00 208952]
                                    "ATIPTA"="C:\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-12 22:10 339968]
                                    "ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 11:31 24576]
                                    "LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe" [2006-06-26 09:46 497200]
                                    "LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2006-06-26 10:34 614960]
                                    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
                                    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
                                    "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-04-16 20:55 185896]
                                    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
                                    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-06-02 11:13 267048]
                                    "SoundMan"="SOUNDMAN.EXE" [2004-09-10 19:29 77824 C:\WINDOWS\SoundMan.exe]
                                    "Raccourci vers la page des propriétés de High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 16:10 61952 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
                                    "AlcWzrd"="ALCWZRD.EXE" [2004-09-15 12:20 2557952 C:\WINDOWS\ALCWZRD.EXE]

                                    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                                    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15:00 15360]

                                    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
                                    "AntiVirusDisableNotify"=dword:00000001

                                    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
                                    "DisableMonitoring"=dword:00000001

                                    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
                                    "DisableMonitoring"=dword:00000001

                                    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
                                    "DisableMonitoring"=dword:00000001

                                    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                                    "EnableFirewall"= 0 (0x0)

                                    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                                    "%ProgramFiles%\\AOL 9.0\\aol.exe"=
                                    "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
                                    "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
                                    "%windir%\\system32\\sessmgr.exe"=
                                    "C:\\APPS\\Inventime\\my.exe"=
                                    "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
                                    "C:\\Program Files\\Java\\j2re1.4.2_05\\bin\\javaw.exe"=
                                    "C:\\Program Files\\JVTorrent\\btdownloadgui.exe"=
                                    "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
                                    "C:\\Program Files\\Soulseek\\slsk.exe"=
                                    "C:\\Program Files\\LimeWire\\LimeWire.exe"=
                                    "C:\\Documents and Settings\\guillaume\\Mes documents\\Accessoires\\eMule\\emule.exe"=
                                    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                                    "C:\\Program Files\\Electronic Arts\\La Bataille pour la Terre du Milieu II\\game.dat"=
                                    "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
                                    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                                    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                                    "C:\\Program Files\\WiFiConnector\\NintendoWFCReg.exe"=
                                    "C:\\Documents and Settings\\guillaume\\Mes documents\\eMule\\emule.exe"=
                                    "C:\\Program Files\\TmNationsForever\\TmForever.exe"=
                                    "C:\\Program Files\\iTunes\\iTunes.exe"=
                                    "C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"=
                                    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

                                    R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 14:28]
                                    R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]
                                    R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]
                                    S3 Boonty Games;Boonty Games;C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe [2005-05-14 09:21]

                                    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
                                    \Shell\AutoRun\command - D:\NintendoWFCReg\setup.exe

                                    .
                                    Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
                                    "2008-07-12 08:00:00 C:\WINDOWS\Tasks\AD4D87AC91863B28.job"
                                    - c:\docume~1\bbdam~1\applic~1\intert~1\For Test Help.exe
                                    "2008-07-03 11:11:22 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
                                    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
                                    "2004-12-28 13:39:34 C:\WINDOWS\Tasks\Rappel d'enregistrement 2.job"
                                    - C:\WINDOWS\system32\OOBE\oobebaln.exe
                                    "2004-12-28 13:39:34 C:\WINDOWS\Tasks\Rappel d'enregistrement 3.job"
                                    - C:\WINDOWS\system32\OOBE\oobebaln.exe
                                    "2008-07-11 22:56:14 C:\WINDOWS\Tasks\User_Feed_Synchronization-{6D81B135-5827-4337-ACA2-06F9BEF8F18F}.job"
                                    - C:\WINDOWS\system32\msfeedssync.exe
                                    .
                                    - - - - ORPHANS REMOVED - - - -

                                    Toolbar-{FC984B68-436E-4B1E-8E02-77B492AF758B} - (no file)
                                    WebBrowser-{FC984B68-436E-4B1E-8E02-77B492AF758B} - (no file)
                                    HKLM-Run-Adobe Photo Downloader - C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
                                    ShellExecuteHooks-{81025CD5-C017-4579-A18D-8D94C01D3B5F} - (no file)

                                    **************************************************************************

                                    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                                    Rootkit scan 2008-07-12 09:51:55
                                    Windows 5.1.2600 Service Pack 2 NTFS

                                    Balayage processus cach‚s ...

                                    Balayage cach‚ autostart entries ...

                                    Balayage des fichiers cach‚s ...

                                    **************************************************************************

                                    [HKEY_LOCAL_MACHINE\System\ControlSet006\Services\MysqlInventime]
                                    "ImagePath"="c:\mysql\bin\mysqld-nt MysqlInventime"
                                    .
                                    ------------------------ Other Running Processes ------------------------
                                    .
                                    C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                                    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                                    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
                                    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                    C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                                    C:\WINDOWS\system32\cmd.exe
                                    C:\WINDOWS\system32\wscntfy.exe
                                    C:\APPS\ABOARD\AOSD.EXE
                                    C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe
                                    C:\Program Files\Logitech\QuickCam10\COCIManager.exe
                                    C:\Program Files\iPod\bin\iPodService.exe
                                    .
                                    **************************************************************************
                                    .
                                    Temps d'accomplissement: 2008-07-12 10:06:57 - machine was rebooted
                                    ComboFix-quarantined-files.txt 2008-07-12 08:05:41

                                    Pre-Run: 6,880,956,416 octets libres
                                    Post-Run: 7,458,316,288 octets libres

                                    235 --- E O F --- 2008-07-09 11:48:31

                                    Et le hijack:
                                    Logfile of Trend Micro HijackThis v2.0.2
                                    Scan saved at 10:09:56, on 12/07/2008
                                    Platform: Windows XP SP2 (WinNT 5.01.2600)
                                    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
                                    Boot mode: Normal

                                    Running processes:
                                    C:\WINDOWS\System32\smss.exe
                                    C:\WINDOWS\system32\winlogon.exe
                                    C:\WINDOWS\system32\services.exe
                                    C:\WINDOWS\system32\lsass.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\WINDOWS\System32\svchost.exe
                                    C:\WINDOWS\system32\spoolsv.exe
                                    C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                                    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                                    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                    C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\WINDOWS\system32\wscntfy.exe
                                    C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
                                    C:\PROGRA~1\Wanadoo\CnxMon.exe
                                    C:\WINDOWS\SOUNDMAN.EXE
                                    C:\WINDOWS\System32\svchost.exe
                                    C:\Apps\Powercinema\PCMService.exe
                                    C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
                                    C:\WINDOWS\ALCWZRD.EXE
                                    C:\apps\ABoard\ABoard.exe
                                    C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
                                    C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe
                                    C:\apps\ABoard\AOSD.exe
                                    C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
                                    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
                                    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                                    C:\Program Files\QuickTime\QTTask.exe
                                    C:\Program Files\iTunes\iTunesHelper.exe
                                    C:\Program Files\Skype\Phone\Skype.exe
                                    C:\WINDOWS\NCLAUNCH.EXe
                                    C:\WINDOWS\system32\ctfmon.exe
                                    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                                    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                                    C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe
                                    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                                    C:\Program Files\Logitech\QuickCam10\COCIManager.exe
                                    C:\Program Files\iPod\bin\iPodService.exe
                                    C:\WINDOWS\explorer.exe
                                    C:\WINDOWS\system32\notepad.exe
                                    C:\Program Files\Wanadoo\EspaceWanadoo.exe
                                    C:\Program Files\Wanadoo\ComComp.exe
                                    C:\Program Files\Wanadoo\Watch.exe
                                    C:\Program Files\Internet Explorer\IEXPLORE.EXE
                                    C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                                    C:\Program Files\Windows Live\Messenger\usnsvc.exe
                                    C:\WINDOWS\system32\rundll32.exe
                                    C:\Program Files\Trend Micro\HijackThis\Monjack.exe

                                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                    R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
                                    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                                    O2 - BHO: {d8abc194-df79-ba58-5b94-06c12a421138} - {831124a2-1c60-49b5-85ab-97fd491cba8d} - C:\WINDOWS\system32\ahslun.dll
                                    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
                                    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.5470\swg.dll
                                    O2 - BHO: (no name) - {D2E69333-1411-44A7-BEB8-3CC63631CA7E} - C:\WINDOWS\system32\ljJBUkJA.dll
                                    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                                    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                                    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
                                    O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
                                    O4 - HKLM\..\Run: [WOOKIT] C:\Program Files\Wanadoo\EspaceWanadoo.exe
                                    O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
                                    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                                    O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
                                    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                                    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                                    O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
                                    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                                    O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
                                    O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
                                    O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
                                    O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
                                    O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
                                    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                                    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
                                    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                                    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                                    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                                    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
                                    O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
                                    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                                    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                                    O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
                                    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                                    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                                    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                                    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                                    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                                    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                                    O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
                                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                                    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                                    O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
                                    O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                                    O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                                    O9 - Extra button: CDPoker - {A68FC757-51CF-4f3c-B13A-BFB8CA69BB99} - C:\Poker\CDPoker\casino.exe
                                    O9 - Extra 'Tools' menuitem: CDPoker - {A68FC757-51CF-4f3c-B13A-BFB8CA69BB99} - C:\Poker\CDPoker\casino.exe
                                    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
                                    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
                                    O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe
                                    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
                                    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                    O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
                                    O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
                                    O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
                                    O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
                                    O16 - DPF: {0835BC90-6ABC-4F52-A103-4FC3A61F2C33} (A18X Control) - http://www6.albatross18.com/?tdfs=1&kw=games
                                    O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - https://www.linkedin.com/cab/LinkedInContactFinderControl.cab
                                    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by124w.bay124.mail.live.com/mail/resources/MsnPUpld.cab
                                    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
                                    O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://express.foto.com/NewUploader/ImageUploader4.cab
                                    O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
                                    O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} (Sinstaller Class) - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
                                    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game06.zylom.com/activex/zylomgamesplayer.cab
                                    O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - https://www.photobox.fr/?channel=1005
                                    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                                    O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} (CamfrogWEB Advanced Unicode Control) - https://www.bobtv.fr/download/cfweb_www.bobtv.fr-download_instmodule.exe
                                    O17 - HKLM\System\CCS\Services\Tcpip\..\{5B7E0AC0-DF13-4DAA-9267-A63BEBAA1BEE}: NameServer = 80.10.246.130 81.253.149.10
                                    O18 - Protocol: bw+0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw+0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw-0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw-0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw00 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw00s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw10 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw10s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw20 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw20s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw30 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw30s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw40 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw40s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw50 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw50s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw60 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw60s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw70 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw70s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw80 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw80s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw90 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw90s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwa0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwa0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwb0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwb0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwc0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwc0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwd0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwd0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwe0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwe0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwf0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwf0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                                    O18 - Protocol: bwg0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwg0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwh0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwh0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwi0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwi0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwj0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwj0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwk0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwk0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwl0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwl0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwm0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwm0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwn0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwn0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwo0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwo0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwp0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwp0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwq0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwq0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwr0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwr0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bws0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bws0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwt0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwt0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwu0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwu0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwv0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwv0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bww0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bww0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwx0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwx0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwy0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwy0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwz0 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwz0s - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: offline-8876480 - {9C9F43EF-C95E-40C1-A856-EF0E7FDB3748} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                                    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                                    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                                    O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
                                    O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                                    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                    O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                                    O23 - Service: Process Monitor (LVPrcSrv) - Unknown owner - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe (file missing)
                                    O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logishrd\SrvLnch\SrvLnch.exe
                                    O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
                                    O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
                                    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
                                    0
                                    1. sKe69 Contributeur sécurité
                                      la suite :

                                      1-Crée un doc texte sur ton bureau :
                                      pointes ta souris sur ton bureau , click droit : vas dans "nouveau" et choisis "document texte" .

                                      Ensuite copie/colle le texte ci-dessous ( et rien d'autre!) dans le fichier texte que tu viens de crée :

                                      Registry::
                                      [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{831124a2-1c60-49b5-85ab-97fd491cba8d}]

                                      [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{93E7BA20-E8F9-414C-8B43-762BC7A8DE0F}]

                                      File::
                                      C:\WINDOWS\system32\apnnjxkh.dll
                                      C:\WINDOWS\system32\ahslun.dll
                                      C:\WINDOWS\system32\wweukw.dll
                                      C:\WINDOWS\system32\olgatgrm.dll
                                      C:\WINDOWS\system32\ruohfw.dll
                                      C:\WINDOWS\system32\kbwffejo.dll
                                      C:\WINDOWS\system32\vgrxka.dll
                                      C:\WINDOWS\system32\ugclkobk.dll
                                      C:\WINDOWS\system32\ljJBUkJA.dll
                                      C:\WINDOWS\system32\geBrOIaw.dll.vir

                                      Puis vas dans "fichier" et choisis "enregistrer sous ..." et tu le nommes exactement ainsi :
                                      CFScript puis valides ...

                                      2-Nettoyage :
                                      !! Déconnectes toi, fermes toute tes application et désactives TOUTES TES DEFENCES ( tu les réactiveras après ) !!

                                      --->Sur ton bureau, fais un glisser avec ta souris le fichier CFScript sur l'icone de ComboFix.exe .

                                      (Regarde ici : http://i261.photobucket.com/albums/ii49/Malekal_morte/CFScript.gif )

                                      Cette manipulation va relancer combofix .
                                      --> Une fenêtre bleue va apparaître: au message qui apparaît "Type 1 to continue, or 2 to abort" : tape 1 puis valide.

                                      Puis patientes le temps du scan.( Le Bureau va disparaître à plusieurs reprises : c'est normal!)

                                      !! Ne touche à rien tant que le scan n'est pas terminé !!

                                      Note : en fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisses-le faire.

                                      Une fois le scan achevé, un rapport va s'afficher : Postes le accompagné d' un nouveau rapport HijackThis pour analyse et attends la suite ...

                                      ( Attention : cette manipe a été fait pour ce PC . Toute réutilisation peut endommager sévèrement le système d'exploitation )
                                      0
                                      • 1
                                      • 2
                                      • 3

                                      Discussions similaires

                                      Ou trouver le pilote pour epson xp-2205
                                      lutttinette

                                      19 réponses
                                      probleme configuration wifi epson xp-225
                                      sam099

                                      35 réponses
                                      Google Chrome "  Échec de l'analyse antivirus "
                                      jmpower

                                      18 réponses