Virus win32 : Trojan-gen {Other}

Résolu
macacheira -  
Bonjour,

Mon pc a attrapé le virus suivant : win32 : Trojan-gen {Other} depuis plusieurs jours et Avast! ne détecte plus rien. J'ai plus de 150 fichiers en quarantaine et je n'ai plus de connexion internet, il semblerait que j'ai supprimé un fichier par erreur.
Je n'y connais absolument rien et j'ai besoin d'aide svp, est-ce que quelqu'un peut quelque chose pour moi??
Merci d'avance.
Configuration: Windows XP
Internet Explorer 7.0

16 réponses

  1.  jorginho67 Contributeur sécurité
    Salut !

    Juste de passage ...

    Démarre en mode sans echec .

    Regarde dans C:\Program Files\Fichiers communs\Carlson <= supprime ceci

    Redemarre normalement et essaye de te connecter ici pour la suite .

    @+
    1
    1. jorginho67 Contributeur sécurité
      Essaye en mode normal.

      Regarde dans C:\Program Files\Fichiers communs\Carlson <= supprime ceci
      1
      1. ep44 Contributeur
        plus ça va plus ça devient n'importe quoi sur CCM !
        tout le monde poste et pourquoi ?

        je vous laisse !
        1
        1. jorginho67 Contributeur sécurité
          Bien,

          Ep44, je te laisse la suite ;-)
          1
          2. ep44 Contributeur
            Bonsoir

            Télécharge sur le Bureau HijackThis

            http://download.hijackthis.eu/HJTInstall.exe

            = Double-clique sur dessus pour l'installer
            = Clique sur Do a system scan and save the log
            = Colle le rapport
            si problème voir l'aide
            http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

            @+
            0
            1. tontom66
              HijackThis pour le win32 : Trojan-gen {Other} moi j'avais pas réussi a l'enlever avec ce logiciel
              0
            2. macacheira Auteur
              J'ai trouvé le virus, je crois : il y a le programme suivant "Carlson Dialer" et dans ma connexion réseau, j'ai trouvé Carlton.
              Ca vous parle?
              0
            3. jorginho67 Contributeur sécurité
              @macacheirasupprime çà Carlson Dialer et regarde le post n° 6
              0
          3. tontom66
            bonjour moi aussi j ai été infecté par ce virus win 32 trojan-gen et j ai avast comme antivirus pour le suprimer j ai suivi son emplacement dans l ordinateur et j ai suprimé le fichier mais attention avant de suprimer ce fichier ca peut être un fichier qui est utilisé pour le bon fonctionnement de ton ordinateur
            0
            1. macacheira Auteur
              Mais, je ne peux rien télécharger, ma connexion internet ne fonctionne plus sur le pc infecté, j'utilise un autre pc pour vous écrire.
              0
              1. tontom66
                donc le mieuxcest de formater a mon avis
                0
            2. jacques.gache Contributeur sécurité
              bonjour à tous, essais de passer l'outil antimalware de microsoft qui normalement est sur ton pc tu cliques sur démarrer et sur exécuter et tu tappes MRT , sinon pour télécharger utilises une clé usb " 1 mp3 fait l'affaire"
              0
              1. macacheira Auteur
                MRT, je l'ai fait, des fichiers malveillants ont été trouvés mais ne peuvent être supprimés par ce logiciel, il me demande de passer par mon antivirus.
                En ce qui concerne le mode échec, ça ne marche pas, la touche F8 ne répond pas.
                0
                1. macacheira Auteur
                  bon, j'ai suivi vos conseils et l'ai supprimé en mode normal, et j'ai retrouvé ma connexion internet.
                  Je vais télécharger rapidement hijackthis.
                  merci.
                  0
                  1. jacques.gache Contributeur sécurité
                    se serais sympa de poster le rapport de MRT tu le trouveras dans ton disque dur dans le dossier windows et dans le dossier debug avec le nom de mrt document texte
                    0
                    1. macacheira
                      Je vais procéder dans l'ordre, j'ai le rapport suivant sur hijackthis:
                      si une âme sympa peut le décrypter.

                      Logfile of Trend Micro HijackThis v2.0.2
                      Scan saved at 23:22:10, on 21/08/2008
                      Platform: Windows XP SP2 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                      Boot mode: Normal

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                      C:\Program Files\Alwil Software\Avast4\ashServ.exe
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\windows\system\hpsysdrv.exe
                      C:\WINDOWS\AGRSMMSG.exe
                      C:\WINDOWS\ALCXMNTR.EXE
                      C:\Program Files\Friendly Technologies\BroadbandAccess\fts.exe
                      C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
                      C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
                      C:\WINDOWS\system32\LVCOMSX.EXE
                      C:\WINDOWS\system32\rundll32.exe
                      C:\Program Files\Logitech\Video\LogiTray.exe
                      C:\Program Files\Winamp\winampa.exe
                      C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
                      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                      C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
                      C:\HP\KBD\KBD.EXE
                      C:\Program Files\iTunes\iTunesHelper.exe
                      C:\Program Files\MSN Messenger\MsnMsgr.Exe
                      C:\WINDOWS\system32\ctfmon.exe
                      C:\Program Files\Logitech\Video\FxSvr2.exe
                      C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                      C:\Program Files\TomTom HOME 2\HOMERunner.exe
                      C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
                      C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
                      C:\Program Files\WinZip\WZQKPICK.EXE
                      C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                      C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                      C:\WINDOWS\System32\nvsvc32.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                      C:\WINDOWS\system32\wuauclt.exe
                      C:\Program Files\iPod\bin\iPodService.exe
                      C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
                      C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
                      C:\Program Files\Mozilla Firefox\firefox.exe
                      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q304&bd=presario&pf=desktop
                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q304&bd=presario&pf=desktop
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.tiscali.it/
                      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                      O2 - BHO: (no name) - {267212FE-B77A-4C83-BB75-3F84B52A3BEE} - C:\WINDOWS\system32\wvUlljif.dll (file missing)
                      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                      O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                      O2 - BHO: (no name) - {B10D5A18-E7C7-4A74-9CCD-4FA6BE477BC2} - C:\WINDOWS\system32\ddcDtSjK.dll (file missing)
                      O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                      O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                      O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
                      O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                      O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
                      O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
                      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
                      O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
                      O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
                      O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe
                      O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\Friendly Technologies\BroadbandAccess\fts.exe"
                      O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
                      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
                      O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
                      O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
                      O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
                      O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
                      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
                      O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
                      O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
                      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
                      O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
                      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                      O4 - HKLM\..\Run: [advap32] C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\scksexde.exe/r
                      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
                      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                      O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
                      O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                      O4 - HKCU\..\Run: [WinAble] C:\Program Files\WinAble\winable.exe
                      O4 - HKCU\..\Run: [Insider] C:\Program Files\Insider\Insider.exe
                      O4 - HKCU\..\Run: [Words] C:\Program Files\Words\Words.exe
                      O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
                      O4 - HKCU\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
                      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                      O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
                      O4 - HKUS\.DEFAULT\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'Default user')
                      O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                      O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
                      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
                      O4 - Global Startup: Image Transfer.lnk = ?
                      O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                      O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
                      O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                      O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm
                      O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                      O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
                      O8 - Extra context menu item: Bloquer ce serveur... - C:\PROGRA~1\AVANTB~1\AddAllToADBlackList.htm
                      O8 - Extra context menu item: Bloquer cette publicité... - C:\PROGRA~1\AVANTB~1\AddToADBlackList.htm
                      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                      O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm
                      O8 - Extra context menu item: Open All Links in This Page... - C:\Program Files\Avant Browser\OpenAllLinks.htm
                      O8 - Extra context menu item: Ouvrir tous les liens de la page... - C:\PROGRA~1\AVANTB~1\OpenAllLinks.htm
                      O8 - Extra context menu item: Rechercher sur le Web... - C:\PROGRA~1\AVANTB~1\Search.htm
                      O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm
                      O8 - Extra context menu item: Surligner - C:\PROGRA~1\AVANTB~1\Highlight.htm
                      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
                      O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
                      O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://elmicaco.spaces.live.com/PhotoUpload/MsnPUpld.cab
                      O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
                      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                      O18 - Protocol: bw+0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw+0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw-0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw-0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw00 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw00s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw10 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw10s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw20 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw20s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw30 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw30s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw40 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw40s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw50 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw50s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw60 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw60s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw70 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw70s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw80 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw80s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw90 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw90s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwa0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwa0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwb0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwb0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwc0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwc0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwd0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwd0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwe0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwe0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwf0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwf0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                      O18 - Protocol: bwg0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwg0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwh0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwh0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwi0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwi0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwj0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwj0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwk0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwk0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwl0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwl0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwm0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwm0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwn0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwn0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwo0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwo0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwp0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwp0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwq0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwq0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwr0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwr0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bws0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bws0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwt0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwt0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwu0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwu0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwv0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwv0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bww0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bww0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwx0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwx0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwy0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwy0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwz0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwz0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: offline-8876480 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                      O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll
                      O20 - Winlogon Notify: wvUlljif - wvUlljif.dll (file missing)
                      O21 - SSODL: wnslvxtf - {1B21511D-0429-4E9D-A5ED-28CF6D1619B8} - C:\WINDOWS\wnslvxtf.dll (file missing)
                      O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                      O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
                      O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
                      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                      0
                      1. jorginho67 Contributeur sécurité
                        Sauvegarde ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

                        Clic droit sur le bureau => nouveau => document texte => double clique dessus et copi/colle ces instructions que tu pourras consulter pour faire la manip' correctement !

                        Ferme toutes les autres fenêtres, tous les autres programmes. Pas de connections Internet.

                        • Relance HijackThis, choisis "do a scan only"
                        coche la case devant les lignes ci-dessous et clic en bas sur "fix checked", puis clique sur OK.

                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/...
                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                        1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/...
                        R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                        R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                        O2 - BHO: (no name) - {267212FE-B77A-4C83-BB75-3F84B52A3BEE} - C:\WINDOWS\system32\wvUlljif.dll (file missing)
                        O2 - BHO: (no name) - {B10D5A18-E7C7-4A74-9CCD-4FA6BE477BC2} - C:\WINDOWS\system32\ddcDtSjK.dll (file missing)
                        O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
                        O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
                        O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
                        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
                        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                        O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
                        O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                        O18 - Protocol: bw+0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw+0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw-0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw-0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw00 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw00s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw10 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw10s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw20 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw20s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw30 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw30s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw40 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw40s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw50 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw50s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw60 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw60s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw70 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw70s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw80 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw80s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw90 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bw90s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwa0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwa0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwb0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwb0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwc0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwc0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwd0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwd0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwe0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwe0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwf0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwf0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                        O18 - Protocol: bwg0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwg0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwh0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwh0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwi0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwi0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwj0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwj0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwk0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwk0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwl0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwl0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwm0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwm0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwn0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwn0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwo0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwo0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwp0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwp0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwq0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwq0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwr0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwr0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bws0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bws0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwt0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwt0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwu0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwu0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwv0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwv0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bww0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bww0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwx0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwx0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwy0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwy0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwz0 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: bwz0s - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O18 - Protocol: offline-8876480 - {CB3FBDCC-B329-483C-8C32-F007EAD01894} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                        O20 - Winlogon Notify: wvUlljif - wvUlljif.dll (file missing)


                        Ferme HijackThis.

                        Si certaines lignes sont absentes, signale les en fin de procédure

                        Fais redémarrer ton PC et poste un nouveau rapport HijackThis

                        Comment fixer les lignes et Générer un rapport
                        0
                        1. macacheira Auteur
                          Je pensais que tout le monde était parti.
                          D'accord, je vais faire ce que tu me dis et reviens avec le nouveau rapport.

                          @+
                          0
                        2. macacheira Auteur
                          J'ai supprimé les lignes et redémarré mon pc, avast! m'a, à nouveau signalé un Trojan, et voici le nouveau rapport Hijackthis :

                          Logfile of Trend Micro HijackThis v2.0.2
                          Scan saved at 10:56:11, on 22/08/2008
                          Platform: Windows XP SP2 (WinNT 5.01.2600)
                          MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                          Boot mode: Normal

                          Running processes:
                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\Explorer.EXE
                          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                          C:\Program Files\Alwil Software\Avast4\ashServ.exe
                          C:\windows\system\hpsysdrv.exe
                          C:\WINDOWS\AGRSMMSG.exe
                          C:\Program Files\Friendly Technologies\BroadbandAccess\fts.exe
                          C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe
                          C:\WINDOWS\system32\LVCOMSX.EXE
                          C:\WINDOWS\system32\rundll32.exe
                          C:\Program Files\Winamp\winampa.exe
                          C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
                          C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                          C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
                          C:\HP\KBD\KBD.EXE
                          C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
                          C:\Program Files\TomTom HOME 2\HOMERunner.exe
                          C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
                          C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\Program Files\WinZip\WZQKPICK.EXE
                          C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe
                          C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                          C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                          C:\WINDOWS\System32\nvsvc32.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                          C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                          C:\WINDOWS\system32\wuauclt.exe
                          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                          C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
                          C:\WINDOWS\system32\HPZipm12.exe
                          C:\WINDOWS\system32\ctfmon.exe

                          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                          R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.tiscali.it/
                          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                          O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                          O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                          O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                          O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                          O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
                          O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                          O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
                          O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
                          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
                          O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
                          O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe
                          O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\Friendly Technologies\BroadbandAccess\fts.exe"
                          O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
                          O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
                          O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
                          O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
                          O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
                          O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
                          O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
                          O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
                          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                          O4 - HKLM\..\Run: [advap32] C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\scksexde.exe/r
                          O4 - HKCU\..\Run: [WinAble] C:\Program Files\WinAble\winable.exe
                          O4 - HKCU\..\Run: [Insider] C:\Program Files\Insider\Insider.exe
                          O4 - HKCU\..\Run: [Words] C:\Program Files\Words\Words.exe
                          O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
                          O4 - HKCU\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
                          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                          O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
                          O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'SYSTEM')
                          O4 - HKUS\.DEFAULT\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'Default user')
                          O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                          O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
                          O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
                          O4 - Global Startup: Image Transfer.lnk = ?
                          O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
                          O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                          O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm
                          O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                          O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
                          O8 - Extra context menu item: Bloquer ce serveur... - C:\PROGRA~1\AVANTB~1\AddAllToADBlackList.htm
                          O8 - Extra context menu item: Bloquer cette publicité... - C:\PROGRA~1\AVANTB~1\AddToADBlackList.htm
                          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                          O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm
                          O8 - Extra context menu item: Open All Links in This Page... - C:\Program Files\Avant Browser\OpenAllLinks.htm
                          O8 - Extra context menu item: Ouvrir tous les liens de la page... - C:\PROGRA~1\AVANTB~1\OpenAllLinks.htm
                          O8 - Extra context menu item: Rechercher sur le Web... - C:\PROGRA~1\AVANTB~1\Search.htm
                          O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm
                          O8 - Extra context menu item: Surligner - C:\PROGRA~1\AVANTB~1\Highlight.htm
                          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                          O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
                          O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
                          O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://elmicaco.spaces.live.com/PhotoUpload/MsnPUpld.cab
                          O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
                          O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                          O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                          O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll
                          O21 - SSODL: wnslvxtf - {1B21511D-0429-4E9D-A5ED-28CF6D1619B8} - C:\WINDOWS\wnslvxtf.dll (file missing)
                          O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                          O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                          O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                          O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                          O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                          O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
                          O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
                          O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                          0
                      2. jacques.gache Contributeur sécurité
                        bonjour, passes malwarebytes smitfraudfix et poste le rapport merci

                        Ouvre ce lien (merci a S!RI pour ce programme). http://siri.urz.free.fr/Fix/SmitfraudFix.php

                        et télécharge SmitfraudFix.exe.

                        Regarde le tuto

                        Exécute le en choisissant l’option 1
                        il va générer un rapport

                        Copie/colle le sur le poste stp.

                        Process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
                        0
                        1. macacheira Auteur
                          Voici le rapport émis :

                          SmitFraudFix v2.339

                          Rapport fait à 15:04:09,85, 23/08/2008
                          Executé à partir de C:\Program Files\Mozilla Firefox\SmitfraudFix
                          OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                          Le type du système de fichiers est NTFS
                          Fix executé en mode normal

                          »»»»»»»»»»»»»»»»»»»»»»»» Process

                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\Explorer.EXE
                          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                          C:\Program Files\Alwil Software\Avast4\ashServ.exe
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\windows\system\hpsysdrv.exe
                          C:\WINDOWS\AGRSMMSG.exe
                          C:\Program Files\Friendly Technologies\BroadbandAccess\fts.exe
                          C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
                          C:\WINDOWS\system32\LVCOMSX.EXE
                          C:\Program Files\Winamp\winampa.exe
                          C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
                          C:\WINDOWS\system32\rundll32.exe
                          C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                          C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
                          C:\HP\KBD\KBD.EXE
                          C:\Program Files\TomTom HOME 2\HOMERunner.exe
                          C:\WINDOWS\system32\ctfmon.exe
                          C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
                          C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
                          C:\Program Files\WinZip\WZQKPICK.EXE
                          C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                          C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                          C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe
                          C:\WINDOWS\System32\nvsvc32.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                          C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\system32\wuauclt.exe
                          C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
                          C:\Program Files\Mozilla Firefox\firefox.exe
                          C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
                          C:\WINDOWS\system32\cmd.exe

                          »»»»»»»»»»»»»»»»»»»»»»»» hosts

                          »»»»»»»»»»»»»»»»»»»»»»»» C:\

                          »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

                          »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

                          »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

                          »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

                          C:\WINDOWS\system32\WinCtrl32.dll détecté, utilisez un scanner de Rootkit

                          »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Propri‚taire

                          »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Propri‚taire\Application Data

                          »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

                          »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\PROPRI~1\Favoris

                          »»»»»»»»»»»»»»»»»»»»»»»» Bureau

                          »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

                          »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

                          »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

                          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
                          "Source"="About:Home"
                          "SubscribedURL"="About:Home"
                          "FriendlyName"="Ma page d'accueil"

                          »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
                          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                          IEDFix
                          Credits: Malware Analysis & Diagnostic
                          Code: S!Ri

                          »»»»»»»»»»»»»»»»»»»»»»»» VACFix
                          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                          VACFix
                          Credits: Malware Analysis & Diagnostic
                          Code: S!Ri

                          »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
                          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                          404Fix
                          Credits: Malware Analysis & Diagnostic
                          Code: S!Ri

                          »»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
                          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                          AntiXPVSTFix
                          Credits: Malware Analysis & Diagnostic
                          Code: S!Ri

                          »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
                          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                          SrchSTS.exe by S!Ri
                          Search SharedTaskScheduler's .dll

                          »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
                          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
                          "AppInit_DLLs"=""

                          »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
                          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
                          "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
                          "System"=""

                          »»»»»»»»»»»»»»»»»»»»»»»» RK

                          »»»»»»»»»»»»»»»»»»»»»»»» DNS

                          Description: VIA Rhine II Fast Ethernet Adapter - Miniport d'ordonnancement de paquets
                          DNS Server Search Order: 212.27.40.241
                          DNS Server Search Order: 212.27.40.240

                          HKLM\SYSTEM\CCS\Services\Tcpip\..\{36C78203-81F1-4499-919A-042B292D8F04}: DhcpNameServer=212.27.40.241 212.27.40.240
                          HKLM\SYSTEM\CS1\Services\Tcpip\..\{36C78203-81F1-4499-919A-042B292D8F04}: DhcpNameServer=212.27.40.241 212.27.40.240
                          HKLM\SYSTEM\CS2\Services\Tcpip\..\{36C78203-81F1-4499-919A-042B292D8F04}: DhcpNameServer=212.27.40.241 212.27.40.240
                          HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
                          HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
                          HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240

                          »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

                          »»»»»»»»»»»»»»»»»»»»»»»» Fin
                          0
                      3. macacheira Auteur
                        C'est encore moi, je suis désepérée, est-ce que quelqu'un peut m'aider, je n'ai toujours pas de connexion internet...

                        quelqu'un sait-il interpréter les rapports que émis plus haut?

                        Merci.
                        0
                        1. jacques.gache Contributeur sécurité
                          bonjour, si ton problème n'est pas résolu tu vas passer malwarebytes en mode sans echec

                          Télécharge Malwarebytes' Anti-Malware: https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

                          . sur la page cliques sur Télécharger Malwarebyte's Anti-Malware
                          . enregistres le sur le bureau
                          . Double cliques sur le fichier téléchargé pour lancer le processus d'installation.
                          . Dans l'onglet "mise à jour", cliques sur le bouton Recherche de mise à jour
                          . si le pare-feu demande l'autorisation de se connecter pour malwarebytes, acceptes
                          . Une fois la mise à jour terminée,fermes Malwarebytes
                          . redemarres en mode sans échec pour savoir comment au cas ou tu ne saurrais pas regarde plus bas
                          . une fois en mode sans echec tu double-cliques sur l'icône de malwarebytes
                          . une fois ouvert rend-toi dans l'onglet, Recherche
                          . Sélectionnes Exécuter un examen complet
                          . Cliques sur Rechercher
                          . Le scan démarre.
                          . A la fin de l'analyse, un message s'affiche : L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.
                          . Cliques sur Ok pour poursuivre.
                          . Si des malwares ont été détectés, cliques sur Afficher les résultats
                          . Sélectionnes tout (ou laisses cochés) et cliques sur Supprimer la sélection Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
                          . Malwarebytes va ouvrir le bloc-notes et y copier le rapport d'analyse.
                          . redemarre le pc
                          . une fois redémarré en mode normal double-cliques sur malwarebytes
                          . rends toi dans l'onglet rapport/log
                          . tu cliques dessus pour l'afficher une fois affiché
                          . tu cliques sur edition en haut du boc notes,et puis sur sélectionner tous
                          . tu recliques sur edition et puis sur copier et tu reviens sur le forum et dans ta réponse
                          . tu cliques droit dans le cadre de la reponse et coller

                          Si tu as besoin d'aide regarde ce tutoriel :
                          https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

                          (attention : pas de connexion possible en mode sans échec , donc copies ou imprimes bien la manipe pour éviter les erreurs ...)

                          pour redémarrer en mode sans échec : /!\ Ne jamais démarrer en mode sans échec via MSCONFIG /!\

                          . Cliques sur Démarrer
                          . Cliques sur Arrêter
                          . Sélectionnes Redémarrer et au redémarrage
                          . Appuis sur la touche F8 sans discontinuer "1 appuis seconde" dès qu'un écran de texte apparaît puis disparaît
                          . Utilises les touches de direction pour sélectionner mode sans échec
                          . puis appuis sur ENTRÉE
                          . Il faudra choisir ta session habituelle, pas le compte "Administrateur" ou une autre
                          une fois démarré ne t'inquiette pas si les couleurs et les icônes ne sont pas comme d'abitude

                          tuto:http://www.vista-xp.fr/forum/topic93.html
                          0

                          Discussions similaires

                          Problème avec "PUADIManager:Win32/OfferCore
                          Knaki

                          3 réponses
                          Softonic,est-ce un virus ?
                          techmel1

                          6 réponses
                          Chrome://newtab
                          Nova

                          14 réponses
                          Désinstaller Softonic
                          Diguimette

                          5 réponses
                          PUADlManager:Win32/OfferCore
                          tenmalade

                          2 réponses