Problème avec mon anti virus.... Résolu

Question

Bonjour a tous,

Voila j'ai un probleme qui est tres bizarre...

a chaque fois j'ai un virus qui viens se mettre dans mon dossier "WINDOWS/TEMP/(et la il crée un dossier lui meme qui se nome ~os2D.tmp) donc ce fameux dossier ~os2D.tmp se crée de lui meme sans que je le sache et dans se dossier il y a un fichier AppInit.dll j'ai beau faire "supprimé,mettre en quarantaine" sa le fais mais apres le virus reviens avec un autre nom de dossier commençant par ~os puis un chiffre et une lettre et le fichier AppInit.dll va s'installé dedans je sais plus quoi faire :(

et j'en ai un autre aussi lui c'est "ossproxy.exe" et sa me fais le meme dossier ~os.....

Avez vous une solution?

Cordialement Tetsuo_

jorginho67 · Answer

Salut !

Voyons ça...

• Télécharge Hijackthis
Hijackthis (HJT) est un outil de diagnostic pour voir si tout va bien avec ton pc....

Ø Enregistre HJTInstall.exe sur ton bureau
Ø Double-clique sur HJTInstall.exe pour lancer le programme
*. Par défaut, il s'installera là C:\Program Files\Trend Micro\HijackThis
*. Accepte la license en cliquant sur le bouton "I Accept"
Ø Choisis l'option "Do a system scan and save a log file"
*. Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
*. Clique sur "Edition -> Sélectionner tout", puis sur "Edition -> Copier" pour copier tout le contenu du rapport
Ø Clic droit  => coller ici dans la fenêtre de saisi le rapport que tu viens de copier sur ce forum

tetsuo_ · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:09:13, on 13/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\program fileselevantknowledgelvknlg.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DNA\btdna.exe
D:\program files\steam\steam.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdoed.exe] C:\WINDOWS\system32\kdoed.exe
O4 - HKLM\..\Run: [RelevantKnowledge] C:\program fileselevantknowledgelvknlg.exe -boot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Steam] "d:\program files\steam\steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe (User 'Default user')
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = D:\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\Administrateur\Application Data\Dealio\kb127es\DealioSearch.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll (file missing)
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.google.fr/
O17 - HKLM\System\CCS\Services\Tcpip\..\{480AF17B-F77A-4820-8B8B-AF4F77B227E4}: NameServer = 85.255.112.98
O18 - Protocol: bw+0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: mlJCSJya - mlJCSJya.dll (file missing)
O20 - Winlogon Notify: RelevantKnowledge - C:\program fileselevantknowledgells.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)

salamort · Answer

O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll (file missing) 

ça me semble un peu bizarre...toolbar infectée ?

je reste pour suivre...

jorginho67 · Answer

Tu es infecté a cause de certaines Toolbars que tu a installé lors de téléchargements de differentes applications.
Bien souvent, ces toolbars sont en fait des spywares.

Plusieurs barres d'outils peuvent ralentir l'ordinateur ou occasionner des plantages du navigateur.
Pour plus d'informations, voir l'article Les Toolbars, c'est pas obligatoire! ( Merci a Malekal )

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

Tutoriel d'install' et d'utilisation

Ø Lance l'installation du programme en exécutant le fichier téléchargé.
Ø Double-clique maintenant sur le raccourci de Toolbar-S&D.
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
Ø Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
* Poste le rapport généré qui se trouve ici =>  (C:\TB.txt)

tetsuo_ · Answer

J'en sais rien,je dois le supprimé peux etre??

Je vais allé le supprimé pour voir ce que sa fais

jorginho67 · Answer

fais ce que je viens de poster juste a l'instant stp

tetsuo_ · Answer

D'accord chef je fais sa ^^

tetsuo_ · Answer

-----------\ ToolBar S&D 1.2.6 XP/Vista Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2 X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3500+ ) BIOS : Phoenix - AwardBIOS v6.00PG USER : Administrateur ( Administrator ) BOOT : Normal boot Antivirus : avast! antivirus 4.8.1201 [VPS 081212-0] 4.8.1201 (Activated) A:\ (USB) C:\ (Local Disk) - NTFS - Total:9 Go (Free:1 Go) D:\ (Local Disk) - NTFS - Total:64 Go (Free:22 Go) E:\ (CD or DVD) "C:\ToolBar SD" ( MAJ : 04-12-2008|20:40 ) Option : [1] ( 13/12/2008|15:30 ) -----------\ Recherche de Fichiers / Dossiers ... C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 emp C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\alerts.gif C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\alerts_over.gif C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\alerts_rec.gif C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\alerts_rec_over.gif C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\chevron-small.gif C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\DealioSearch.html C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\deals-leftcap.gif C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\deal_report.jpg C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\ebay_login.jpg C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\err_mainwindow.html C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\err_toolbar.html C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\global_scripts.js C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\headerbgthin.jpg C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\highlight-bg.png C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\logo.gif C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\logo_over.gif C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\man_toolbar.css C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\man_toolbar.html C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\man_toolbar.js C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\man_toolbarl.js C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\post-this-deal.gif C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\post-this-deal_over.gif C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\scripts.js C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\scroller.js C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\search-chevron.gif C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\search-chevron_over.gif C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\search_bg_blink.gif C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\separator.gif C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\settings.gif C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\settings_over.gif C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 es\yahoo-search.png C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules\index.76.35 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.10.76 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.109.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.110.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.12.52 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.13.58 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.130.58 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.135.50 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.153.44 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.155.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.156.49 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.16.60 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.161.52 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.178.66 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.184.55 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.188.52 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.189.45 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.196.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.198.56 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.199.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.200.53 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.201.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.202.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.203.71 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.205.62 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.213.71 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.214.49 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.215.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.216.67 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.217.67 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.218.52 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.219.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.220.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.221.57 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.222.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.223.68 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.226.68 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.227.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.228.62 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.229.76 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.23.63 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.239.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.24.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.240.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.241.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.242.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.243.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.244.63 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.245.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.247.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.248.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.249.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.250.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.251.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.252.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.253.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.254.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.255.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.256.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.257.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.279.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.28.58 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.282.75 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.283.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.284.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.289.67 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.290.62 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.291.61 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.296.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.297.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.304.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.307.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.308.75 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.31.47 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.310.46 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.311.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.315.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.316.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.317.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.318.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.319.49 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.32.48 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.334.44 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.335.60 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.336.44 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.337.44 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.338.75 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.339.47 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.34.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.340.47 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.341.47 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.349.50 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.35.48 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.350.50 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.351.51 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.352.54 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.353.51 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.354.51 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.357.62 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.358.52 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.359.52 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.360.53 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.361.54 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.362.68 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.363.58 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.364.54 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.365.53 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.367.56 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.368.58 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.369.55 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.370.56 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.371.56 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.372.57 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.373.55 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.375.56 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.376.57 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.377.55 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.378.65 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.384.58 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.386.71 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.387.59 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.388.59 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.389.59 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.390.60 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.391.60 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.392.60 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.393.60 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.394.60 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.396.61 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.397.61 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.398.60 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.399.60 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.403.61 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.404.63 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.405.61 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.406.61 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.407.76 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.408.63 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.409.61 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.412.62 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.413.62 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.414.62 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.415.62 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.416.62 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.417.62 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.418.62 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.419.62 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.420.62 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.421.62 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.423.63 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.424.63 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.425.63 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.426.63 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.427.63 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.428.65 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.429.63 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.430.63 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.432.65 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.433.64 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.434.65 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.435.64 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.436.76 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.437.64 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.438.71 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.439.71 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.440.75 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.442.73 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.443.73 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.444.73 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.445.68 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.446.69 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.450.67 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.451.67 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.452.68 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.453.68 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.454.69 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.456.69 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.457.75 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.458.70 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.459.70 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.460.69 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.462.74 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.463.69 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.464.70 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.465.68 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.468.70 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.469.70 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.470.70 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.471.73 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.472.70 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.478.74 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.479.73 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.480.68 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.481.71 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.482.74 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.49.67 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.50.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.500.71 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.501.74 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.502.71 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.51.69 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.52.72 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.520.76 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.521.76 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.522.76 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.53.51 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.531.76 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.532.75 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.534.75 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.54.47 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.55.45 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.56.69 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.57.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.58.47 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.593.76 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.595.76 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.63.57 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.66.47 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.70.75 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 ules ules.1.71.43 C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 emp\dealio-14117.log C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 emp\dod_cache.xml C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 emp\_toolbar_tmp_1384_1292_3.html C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 emp\_toolbar_tmp_1836_1124_3.html C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 emp\_toolbar_tmp_2112_2188_3.html C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 emp\_toolbar_tmp_3944_3800_3.html C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 emp\_toolbar_tmp_4196_4308_3.html C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 emp\_toolbar_tmp_4720_4860_3.html C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 emp\_toolbar_tmp_5064_140_3.html C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 emp\_toolbar_tmp_5396_5084_10.html C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 emp\_toolbar_tmp_5396_5084_9.html C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 emp\_toolbar_tmp_5776_1136_3.html C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 emp\_toolbar_tmp_5776_4184_4.html C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 emp\_toolbar_tmp_5776_4184_6.html C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\Dealio C:\WINDOWS\Prefetch\SEARCHSETTINGS.EXE-253CB611.pf C:\DOCUME~1\ADMINI~1\APPLIC~1\Search Settings C:\DOCUME~1\ADMINI~1\APPLIC~1\Search Settings\kb127 C:\DOCUME~1\ADMINI~1\APPLIC~1\Search Settings\kb127 es C:\DOCUME~1\ADMINI~1\APPLIC~1\Search Settings\kb127 emp C:\DOCUME~1\ADMINI~1\APPLIC~1\Search Settings\kb127 emp\ws-14223.log C:\DOCUME~1\ADMINI~1\APPLIC~1\Search Settings\kb127 emp\ws-14224.log C:\DOCUME~1\ADMINI~1\APPLIC~1\Search Settings\kb127 emp\ws-14225.log C:\DOCUME~1\ADMINI~1\APPLIC~1\Search Settings\kb127 emp\ws-14226.log C:\Program Files\Search Settings C:\Program Files\Search Settings\kb127 C:\Program Files\Search Settings\SearchSettings.exe C:\Program Files\Search Settings\kb127 es C:\Program Files\Search Settings\kb127\SearchSettings.dll C:\Program Files\Search Settings\kb127\SearchSettingsRes409.dll C:\Program Files\Search Settings\kb127 emp C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp sf1AD.tmp C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp ss1ED.tmp C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp ssFD.tmp -----------\ [..\Internet Explorer\Main] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="https://www.google.com/?gws_rd=ssl" "Local Page"="C:\WINDOWS\system32\blank.htm" "Search Page"="https://www.google.com/?gws_rd=ssl" "Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html" "SearchMigratedDefaultURL"="https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src={referrer:source?}" [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp" "Default_Search_URL"="http://www.google.com/toolbar/ie8/sidebar.html" "Search Page"="https://www.google.com/?gws_rd=ssl" "Start Page"="https://www.google.com/?gws_rd=ssl" --------------------\ Recherche d'autres infections C:\WINDOWS\system32\cKUvEfii.ini C:\WINDOWS\system32\cKUvEfii.ini2 [b]==> VUNDO <==/b [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\..\{480AF17B-F77A-4820-8B8B-AF4F77B227E4}] NameServer REG_SZ 85.255.112.98 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\..\{480AF17B-F77A-4820-8B8B-AF4F77B227E4}] NameServer REG_SZ 85.255.112.98 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\..\{480AF17B-F77A-4820-8B8B-AF4F77B227E4}] NameServer REG_SZ 85.255.112.98 [b]==> WAREOUT <==/b --------------------\ ROOTKIT !! Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV.SYS] Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_TDSSSERV.SYS] Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV.SYS] Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv.sys] Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\TDSSserv.sys] Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys] --------------------\ Suspect .. C:\WINDOWS\system32\TDSSixgp.dll C:\WINDOWS\system32\TDSSmtpe.dat C:\WINDOWS\system32\TDSSnmxh.log C:\WINDOWS\system32\TDSSwubs.log --------------------\ Cracks & Keygens .. C:\DOCUME~1\ADMINI~1\Mes documents\Mes Historiques de Conversation\Mes fichiers re‡us\keygen.rar C:\DOCUME~1\ADMINI~1\Mes documents\Shareaza Downloads\LFS_S2\Y_KeyGen.exe C:\DOCUME~1\ADMINI~1\Mes documents\Shareaza Downloads\LFS_S2\data\spr\CrackCo_KY1_XRR.spr 1 - "C:\ToolBar SD\TB_1.txt" - 13/12/2008|15:31 - Option : [1] -----------\ Fin du rapport a 15:31:05,81 voila

salamort · Answer

--------------nettoyage----------------------------
ferme internet explorer
Relance Toolbar-S&D

Important! Désactive ton antivirus / antispyware résident / TeaTimer de Spybot (si présent et actif)

en double-cliquant sur le raccourci.
Tape sur "2" puis valide en appuyant sur "Entrée".
! Ne ferme pas la fenêtre lors de la suppression !
Un rapport sera généré, tu peux réouvrir internet explorer et poster le rapport ici.

NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."
Tape explorer puis valide.

jorginho67 · Answer

Suppression

Relance Toolbar-S&D en double-cliquant sur le raccourci. 
Ø Tape sur "2" puis valide en appuyant sur "Entrée".
! Ne ferme pas la fenêtre lors de la suppression !
Un rapport sera généré, poste son contenu ici.

NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."
Tape explorer puis valide.

tetsuo_ · Answer

-----------\ ToolBar S&D 1.2.6 XP/Vista Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2 X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3500+ ) BIOS : Phoenix - AwardBIOS v6.00PG USER : Administrateur ( Administrator ) BOOT : Normal boot Antivirus : avast! antivirus 4.8.1201 [VPS 081212-0] 4.8.1201 (Activated) A:\ (USB) C:\ (Local Disk) - NTFS - Total:9 Go (Free:1 Go) D:\ (Local Disk) - NTFS - Total:64 Go (Free:22 Go) E:\ (CD or DVD) "C:\ToolBar SD" ( MAJ : 04-12-2008|20:40 ) Option : [2] ( 13/12/2008|15:38 ) -----------\ SUPPRESSION Supprime! - C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio\kb127 Supprime! - C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\Dealio Supprime! - C:\WINDOWS\Prefetch\SEARCHSETTINGS.EXE-253CB611.pf Supprime! - C:\DOCUME~1\ADMINI~1\APPLIC~1\Search Settings\kb127 Supprime! - C:\Program Files\Search Settings\kb127 Supprime! - C:\Program Files\Search Settings\SearchSettings.exe Supprime! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp sf1AD.tmp Supprime! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp ss1ED.tmp Supprime! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp ssFD.tmp Supprime! - C:\DOCUME~1\ADMINI~1\APPLIC~1\Dealio Supprime! - C:\DOCUME~1\ADMINI~1\APPLIC~1\Search Settings Supprime! - C:\Program Files\Search Settings -----------\ Recherche de Fichiers / Dossiers ... -----------\ [..\Internet Explorer\Main] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="https://www.google.com/?gws_rd=ssl" "Local Page"="C:\WINDOWS\system32\blank.htm" "Search Page"="https://www.google.com/?gws_rd=ssl" "Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html" "SearchMigratedDefaultURL"="https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src={referrer:source?}" [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp" "Default_Search_URL"="http://www.google.com/toolbar/ie8/sidebar.html" "Search Page"="https://www.google.com/?gws_rd=ssl" "Start Page"="https://www.msn.com/fr-fr/" --------------------\ Recherche d'autres infections C:\WINDOWS\system32\cKUvEfii.ini C:\WINDOWS\system32\cKUvEfii.ini2 [b]==> VUNDO <==/b [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\..\{480AF17B-F77A-4820-8B8B-AF4F77B227E4}] NameServer REG_SZ 85.255.112.98 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\..\{480AF17B-F77A-4820-8B8B-AF4F77B227E4}] NameServer REG_SZ 85.255.112.98 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\..\{480AF17B-F77A-4820-8B8B-AF4F77B227E4}] NameServer REG_SZ 85.255.112.98 [b]==> WAREOUT <==/b --------------------\ ROOTKIT !! Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV.SYS] Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_TDSSSERV.SYS] Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV.SYS] Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv.sys] Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\TDSSserv.sys] Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys] --------------------\ Suspect .. C:\WINDOWS\system32\TDSSixgp.dll C:\WINDOWS\system32\TDSSmtpe.dat C:\WINDOWS\system32\TDSSnmxh.log C:\WINDOWS\system32\TDSSwubs.log --------------------\ Cracks & Keygens .. C:\DOCUME~1\ADMINI~1\Mes documents\Mes Historiques de Conversation\Mes fichiers re‡us\keygen.rar C:\DOCUME~1\ADMINI~1\Mes documents\Shareaza Downloads\LFS_S2\Y_KeyGen.exe C:\DOCUME~1\ADMINI~1\Mes documents\Shareaza Downloads\LFS_S2\data\spr\CrackCo_KY1_XRR.spr 1 - "C:\ToolBar SD\TB_1.txt" - 13/12/2008|15:31 - Option : [1] 2 - "C:\ToolBar SD\TB_2.txt" - 13/12/2008|15:39 - Option : [2] -----------\ Fin du rapport a 15:39:22,45 j'ai pas eu de probleme au niveau de la réaparition de mon bureau

jorginho67 · Answer

Je te prépare la suite...

tetsuo_ · Answer

D'accord merci encore ;)

jorginho67 · Answer

regarde en haut a droite, clique sur l'enveloppe

jorginho67 · Answer

Ø Relance Hijackthis en double cliquant sur son raccourci sur le Bureau.
Choisis l'option "Do a system scan and save a log file"
Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
Clique sur "Edition" ->> "Sélectionner tout", puis sur "Edition" ->> Copier" pour copier tout le contenu du rapport ici

tetsuo_ · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:30:50, on 13/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\System32\CTFMON.EXE
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\program fileselevantknowledgelvknlg.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdoed.exe] C:\WINDOWS\system32\kdoed.exe
O4 - HKLM\..\Run: [RelevantKnowledge] C:\program fileselevantknowledgelvknlg.exe -boot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe (User 'Default user')
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = D:\Kodak EasyShare software\bin\EasyShare.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
O17 - HKLM\System\CCS\Services\Tcpip\..\{480AF17B-F77A-4820-8B8B-AF4F77B227E4}: NameServer = 85.255.112.98
O18 - Protocol: bw+0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: mlJCSJya - mlJCSJya.dll (file missing)
O20 - Winlogon Notify: RelevantKnowledge - C:\program fileselevantknowledgells.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)

tetsuo_ · Answer

bon bah les virus sont toujours la....

en tout cas désolé de ma vulgarité mais celui qui a eu l'idée de crée les virus c'est vraiment un trou du cul !

jorginho67 · Answer

Sauvegarde  ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

Clic droit sur le bureau => nouveau document => document texte et copi/colle ces instructions que tu porras consulter  pour faire la manip' correctement !

* Télécharge Malwarebytes' Anti-Malware (MBAM) et enregistre le sur ton Bureau.
S'il manque le fichier COMCTL32.OCX, tu pourras le télécharger ici

C'est un bon scan passif que tu peux garder avec lequel tu pourras effectuer un nettoyage hebdomadaire, sans oublier de faire une mise à jour manuelle avant d'exécuter l’analyse .

A la fin du téléchargement, ferme toutes les fenêtres et programmes, y compris celle-ci.

* Double-clique sur l'icône Download_mbam-setup.exe sur ton bureau pour démarrer le programme d'installation.

Pendant l'installation, suis les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet). N'apporte aucune modification aux réglages par défaut et, en fin d'installation, vérifie que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware soient cochées.

MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse. Comme MBAM se met automatiquement à jour en fin d'installation, clique sur OK pour fermer la boîte de dialogue. La fenêtre principale de MBAM s'affiche :

 * Dans l'onglet analyse, vérifie que "Exécuter un examen RAPIDE" soit coché et clique sur le bouton Rechercher pour démarrer l'analyse.

MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.

A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.

* Si des malwares ont été détectés, leur liste s'affiche.

Coche tous les éléments détectés par Malwarebytes' Anti-Malware puis clique sur Supprimer la sélection afin d'éradiquer les malwares détectés.
 /!\ (a faire impérativement sous peine de recommencer le scan) /!\  , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.


MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)

Ferme MBAM en cliquant sur Quitter.

Poste le rapport dans ta réponse 

Tutoriel
Un autre  si tu as besoin d'aide.

tetsuo_ · Answer

voila je viens de faire tout ce que tu ma dis alors j'ai enregistré le log pour te montré tout ce que j'avais comme fichié infecté j'en ai 8




Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1531
Windows 5.1.2600 Service Pack 2

22/12/2008 14:41:58
mbam-log-2008-12-22 (14-41-46).txt

Type de recherche: Examen rapide
Eléments examinés: 57885
Temps écoulé: 4 minute(s), 44 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 13
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 9

Processus mémoire infecté(s):
C:\program fileselevantknowledgelvknlg.exe (Spyware.Marketscore) -> No action taken.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\Interface\{150119aa-a801-4ddf-be5c-14caf721a9fd} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{2e4a04a1-a24d-45ae-aca4-949778400813} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{829ba8a2-4515-4d62-9a4b-b89d4b55094f} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{24e9519b-3f70-429b-99bc-4b2b49b96f66} (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{ded2b61b-1a26-4566-bf2f-de539d4468dd} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{63334394-3da3-4b29-a041-03535909d361} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\AppID\{ff46f4ab-a85f-487e-b399-3f191ac0fe23} (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notifyelevantknowledge (Spyware.Marketscore) -> No action taken.
HKEY_CLASSES_ROOT\AppID	estCPV6.DLL (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\sexvid (Trojan.DNSChanger) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{24e9519b-3f70-429b-99bc-4b2b49b96f66} (Trojan.Vundo) -> No action taken.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{480af17b-f77a-4820-8b8b-af4f77b227e4}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.98 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{480af17b-f77a-4820-8b8b-af4f77b227e4}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.98 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{480af17b-f77a-4820-8b8b-af4f77b227e4}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.98 -> No action taken.

Dossier(s) infecté(s):
C:\Program Files\Inet_Get_2 (Trojan.Downloader) -> No action taken.
C:\Program Files\RelevantKnowledge (Spyware.Marketscore) -> No action taken.
C:\WINDOWS\system32\bharebio01 (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Administrateur\Application Data\speedrunner (Adware.SurfAccuracy) -> No action taken.

Fichier(s) infecté(s):
C:\Program Files\RelevantKnowledgells.dll (Spyware.Marketscore) -> No action taken.
C:\Program Files\RelevantKnowledgeloci.bin (Spyware.Marketscore) -> No action taken.
C:\Program Files\RelevantKnowledgelservice.exe (Spyware.Marketscore) -> No action taken.
C:\Program Files\RelevantKnowledgelvknlg.exe (Spyware.Marketscore) -> No action taken.
C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> No action taken.
C:\WINDOWS\cookies.ini (Malware.Trace) -> No action taken.
C:\WINDOWS\BMa35a8597.xml (Trojan.Vundo) -> No action taken.
C:\WINDOWS\BMa35a8597.txt (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\TDSSixgp.dll (Rootkit.Agent) -> No action taken.

jorginho67 · Answer

No action taken.   Il faut faire comme expliqué ...

Relance MBAM

* Dans l'onglet analyse, vérifie que "Exécuter un examen RAPIDE" soit coché et clique sur le bouton Rechercher pour démarrer l'analyse.

MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.

A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.

/!!\ IMPORTANT /!!\

* Si des malwares ont été détectés, leur liste s'affiche.

Coche tous les éléments détectés par Malwarebytes' Anti-Malware puis clique sur Supprimer la sélection afin d'éradiquer les malwares détectés.

 /!\ (a faire impérativement sous peine de recommencer le scan) /!\  , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.


MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)

Ferme MBAM en cliquant sur Quitter.

Poste le rapport dans ta réponse

tetsuo_ · Answer

Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1531
Windows 5.1.2600 Service Pack 2

22/12/2008 15:10:07
mbam-log-2008-12-22 (15-10-07).txt

Type de recherche: Examen rapide
Eléments examinés: 57856
Temps écoulé: 3 minute(s), 26 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 13
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 9

Processus mémoire infecté(s):
C:\program fileselevantknowledgelvknlg.exe (Spyware.Marketscore) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\Interface\{150119aa-a801-4ddf-be5c-14caf721a9fd} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e4a04a1-a24d-45ae-aca4-949778400813} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{829ba8a2-4515-4d62-9a4b-b89d4b55094f} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{24e9519b-3f70-429b-99bc-4b2b49b96f66} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ded2b61b-1a26-4566-bf2f-de539d4468dd} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{63334394-3da3-4b29-a041-03535909d361} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{ff46f4ab-a85f-487e-b399-3f191ac0fe23} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notifyelevantknowledge (Spyware.Marketscore) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID	estCPV6.DLL (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sexvid (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{24e9519b-3f70-429b-99bc-4b2b49b96f66} (Trojan.Vundo) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{480af17b-f77a-4820-8b8b-af4f77b227e4}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.98 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{480af17b-f77a-4820-8b8b-af4f77b227e4}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.98 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{480af17b-f77a-4820-8b8b-af4f77b227e4}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.98 -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Program Files\Inet_Get_2 (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Program Files\RelevantKnowledge (Spyware.Marketscore) -> Delete on reboot.
C:\WINDOWS\system32\bharebio01 (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Application Data\speedrunner (Adware.SurfAccuracy) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Program Files\RelevantKnowledgells.dll (Spyware.Marketscore) -> Delete on reboot.
C:\Program Files\RelevantKnowledgeloci.bin (Spyware.Marketscore) -> Quarantined and deleted successfully.
C:\Program Files\RelevantKnowledgeloci.txt.bin (Spyware.Marketscore) -> Quarantined and deleted successfully.
C:\Program Files\RelevantKnowledgelvknlg.exe (Spyware.Marketscore) -> Delete on reboot.
C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\BMa35a8597.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BMa35a8597.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TDSSixgp.dll (Rootkit.Agent) -> Quarantined and deleted successfully.





voila maintenant je vais redémarré mon pc parce que il y a 3 fichié donc 


C:\Program Files\RevelantKnowledgells.dll
C:\Program Files\RevelantKnowledgelvlknlg.exe
C:\Program Files\RevelantKnowledge

qui ne seront pas supprimé avant le redémarrage du pc je vous direz quoi d'ici la

tetsuo_ · Answer

Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1531
Windows 5.1.2600 Service Pack 2

22/12/2008 15:32:03
mbam-log-2008-12-22 (15-32-03).txt

Type de recherche: Examen rapide
Eléments examinés: 57675
Temps écoulé: 4 minute(s), 16 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)






Bah en tout cas chapeau !!!!! Merci alalla je serais pas comment vous remerciez !


Commentcamarche.net     Site n°1 no comment :)

jorginho67 · Answer

Pour vérifier :

Refais  un rapport de scan avec Hijackthis ( HJT ) et poste le aussi.

Ø Relance Hijackthis en double cliquant sur son raccourci sur le Bureau.
Choisis l'option "Do a system scan and save a log file"
Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
Clique sur "Edition" ->> "Sélectionner tout", puis sur "Edition" ->> Copier" pour copier tout le contenu du rapport ici

tetsuo_ · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:16:03, on 22/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdoed.exe] C:\WINDOWS\system32\kdoed.exe
O4 - HKLM\..\Run: [RelevantKnowledge] C:\program fileselevantknowledgelvknlg.exe -boot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe (User 'Default user')
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = D:\Kodak EasyShare software\bin\EasyShare.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
O18 - Protocol: bw+0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: mlJCSJya - mlJCSJya.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)

jorginho67 · Answer

Refais un log HJT en prenant soin de le renommer !

• Fais un clic droit sur l'icone HJT => renommer => nomme le noel.exe
*. Choisis l'option "Do a system scan and save a log file"


Poste le rapport ici.

tetsuo_ · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:27:18, on 22/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdoed.exe] C:\WINDOWS\system32\kdoed.exe
O4 - HKLM\..\Run: [RelevantKnowledge] C:\program fileselevantknowledgelvknlg.exe -boot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe (User 'Default user')
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = D:\Kodak EasyShare software\bin\EasyShare.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
O18 - Protocol: bw+0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: mlJCSJya - mlJCSJya.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)

jorginho67 · Answer

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe 

Tu ne l'as pas renommé...

clic droit sur l'icone HJT => renommer => nomme le noel.exe

tetsuo_ · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:04:29, on 22/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis
oel.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdoed.exe] C:\WINDOWS\system32\kdoed.exe
O4 - HKLM\..\Run: [RelevantKnowledge] C:\program fileselevantknowledgelvknlg.exe -boot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe (User 'Default user')
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = D:\Kodak EasyShare software\bin\EasyShare.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
O18 - Protocol: bw+0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {329DA725-BE00-421F-8A58-12D4B0DDB0B3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: mlJCSJya - mlJCSJya.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)

jorginho67 · Answer

Malheureusement, il en reste...

Il va falloir analyser un ou des fichier(s) suspect(s) !

Il se peut qu'il se trouvent dans les " dossiers cachés " du systeme. 
Il faut donc les rendre visibles pour le scan.

Pour afficher les dossiers et fichiers cachés:

Panneau de configuration > Options des dossiers > onglet Affichage.

Coche Afficher les fichiers et dossiers cachés,
Décoche Masquer les extensions de fichiers connus
Décoche Masquer les fichiers protégés du Système.
Un message de mise en garde va apparaitre. Clique sur OK pour confirmer ton choix.
Les fichiers et dossiers cachés du système apparaitront alors dans l'explorateur Windows en transparence.
Tutoriel

Lorsque tu aura fini d'intervenir dans les répertoires système, fait la manip inverse pour recacher les fichiers système.


Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur Parcourir et cherche ce fichier : (en gras ci dessous )

C:\WINDOWS\system32\kdoed.exe
C:\program files\relevantknowledge\rlvknlg.exe  ====> Fais le un dossier a la fois 


Clique sur Send File.

Tu devras surement patienter, il y a toujours une file d'attente.
Un rapport va s'élaborer ligne à ligne.

Attends la fin. Tu dois voir la mention Finished sur la droite.
Le rapport  doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie/colle le dans ta prochaine réponse.

Si VirusTotal indique que le fichier a déjà été analysé, cliquer sur le bouton Reanalyse le fichier maintenant.

tetsuo_ · Answer

bah écoute ces fichiers la ne sont plus la ...


rlvknlg.exe   je l'ai supprimé tantot il y a 5 heures et il n'est pas revenu.. et la je viens d'allé voir apres ces deux fichiers la et ils n'y etaient plus,mais bon sa va j'ai plus de probleme avec les virus rootkit merci encore ;)

Problème avec mon anti virus....

30 réponses

Votre réponse

Discussions similaires

Newsletters