Virus besoin daide

Bonjour,
depuis quelque jour mon pc va mal et est lent je crois avoir virus ou quelque truc qui val mal allors si quelqun pourrais maider svp merci voici le log de hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:10:15, on 14/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Logitech\QuickCam10\COCIManager.exe
C:\WINDOWS\system32\spider.exe
C:\WINDOWS\system32\spider.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe
C:\Program Files\TeamViewer\Version5\TeamViewer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe -H
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\VistaCodecPack\QT\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2EDF75C0-5ABD-49f9-BAB6-220476A32034} (System Requirements Lab) - http://intel-drv-cdn.systemrequirementslab.com/multi/bin/sysreqlab_srlx.cab
O16 - DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} - http://messenger.zone.msn.com/...
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/...
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://funnychat.org/controls/msnchat45.cab
O18 - Protocol: bw+0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {1998360F-38CE-4244-953F-0616900EC3FC} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Google Update (gupdate1c9962ba8de13ba) (gupdate1c9962ba8de13ba) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: TeamViewer 5 (TeamViewer5) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe

--
End of file - 24298 bytes
Configuration: Windows XP Internet Explorer 7.0

16 réponses

Résumé de la discussion

Un utilisateur signale un ralentissement du PC et suspecte une infection virale après l'analyse d'un log HijackThis sur Windows XP SP3, indiquant plusieurs processus et services potentiellement indésirables. Des éléments de réponse recommandent d'effectuer une désinfection, de vérifier les éléments de démarrage et les services susceptibles d'être malveillants, puis de recourir à des outils dédiés pour nettoyer les traces et sécuriser le système. D'autres conseils préconisent d'analyser les démarrages et les services suspects comme UnlockerAssistant, TeaTimer, ou composants Logitech, puis d'effectuer scans croisés avec des antivirus et antispyware pour confirmer l'état du système. En cas d'infection persistante ou d'échec des outils, une réinstallation propre du système peut s'avérer nécessaire pour assurer une remise en sécurité durable et éviter une réinfection.

Bobot (l’IA à votre service)
  1. ▶ Télécharge FindyKill de Chiquitine29 sur ton bureau :

    http://pagesperso-orange.fr/NosTools/Chiquitine29/Setup.exe

    ! Déconnecte toi et ferme toutes applications en cours !

    ▶ Double clique (clic droit "en tant qu'administrateur" pour Vista) sur "FindyKill.exe" pour lancer l'installation et laisse les paramètres d'instalation par défaut .

    ▶ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

    ▶ Double-clique (clic droit "en tant qu'administrateur" pour Vista)sur le raccourci FindyKill qui est sur ton bureau pour lancer l'outil .

    ▶ Au menu principal choisis l'option " F " pour français et tape sur [entrée] .

    ▶ Au second menu Choisis l'option " 1 " (recherche) et tape sur [entrée]

    ▶ Laisse travailler l'outil et ne touche à rien ...

    ▶ Poste le rapport qui apparait à la fin , sur le forum ...

    ( le rapport est sauvegardé aussi sous C:\FindyKill.txt )
    ( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

    ensuite :

    ########### [ Option 2 ( Suppression ) ]

    ▶ Déconnecte toi et ferme toutes application en cours ( navigateur compris ) .

    ▶ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

    ▶ Relance "FindyKill" (clic droit "en tant qu'administrateur" pour Vista): au menu principal choisis l'option " F " pour français et tape sur [entrée] .

    ▶ Au second menu choisis l'option 2 (suppression) et tape sur [entrée]

    ▶ Le pc va redémarrer automatiquement ...

    ▶ le programme va travailler , ne touche à rien ... , ton bureau ne sera pas accessible c est normal !

    ▶ Poste le rapport qui apparait à la fin ( le rapport est sauvegardé aussi sous C:\FindyKill.txt )

    ▶ Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tape explorer.exe et valide
    1. ▶ Relance List&Kill'em comme tu as fait pour l'option 1 (soit en clic droit pour vista),

      mais cette fois-ci :

      ▶ choisis l'option 2 = Mode Destruction

      laisse travailler l'outil.

      en fin de scan un rapport s'ouvre

      ▶ colle le contenu dans ta reponse

      ensuite :

      ▶ Double clic sur OTL.exe pour le lancer.

      ▶Copie la liste qui se trouve en gras ci-dessous,

      ▶ colle-la dans la zone sous Customs Scans/Fixes :


      :processes
      explorer.exe
      iexplore.exe
      firefox.exe
      msnmsgr.exe
      Teatimer.exe

      :reg
      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
      "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"=-
      "C:\Program Files\ooVoo\ooVoo.exe"=-
      "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\IXP000.TMP\ikoge.exe"=-
      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
      "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"=-
      [-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

      :commands
      [emptytemp]
      [start explorer]
      [reboot]


      ▶ Clique sur RunFix pour lancer la suppression.

      ▶ Poste le rapport.
      1. Kill'em by g3n-h@ckm@n 1.1.5.2

        User : Administrateur (Administrateurs) # INDY_PC
        Update on 14/12/2009 by g3n-h@ckm@n ::::: 00:00
        Start at: 17:45:43 | 16/12/2009
        Contact : g3n-h@ckm@n sur CCM

        Intel(R) Pentium(R) 4 CPU 2.80GHz
        Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
        Internet Explorer 8.0.6001.18702
        Windows Firewall Status : Enabled
        AV : avast! antivirus 4.8.1296 [VPS 091216-0] 4.8.1296 [ Enabled | Updated ]

        A:\ -> Lecteur de disquettes 3 ½ pouces
        C:\ -> Disque fixe local | 37,24 Go (14,27 Go free) | NTFS
        D:\ -> Disque CD-ROM

        ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

        C:\WINDOWS\System32\smss.exe 596
        C:\WINDOWS\system32\csrss.exe 644
        C:\WINDOWS\system32\winlogon.exe 668
        C:\WINDOWS\system32\services.exe 712
        C:\WINDOWS\system32\lsass.exe 724
        C:\WINDOWS\system32\svchost.exe 888
        C:\WINDOWS\system32\svchost.exe 952
        C:\Program Files\Windows Defender\MsMpEng.exe 1048
        C:\WINDOWS\System32\svchost.exe 1104
        C:\WINDOWS\system32\svchost.exe 1172
        C:\WINDOWS\system32\svchost.exe 1360
        C:\WINDOWS\Explorer.EXE 1560
        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 1600
        C:\Program Files\Alwil Software\Avast4\ashServ.exe 1648
        C:\WINDOWS\system32\spoolsv.exe 1948
        C:\WINDOWS\system32\svchost.exe 412
        C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 444
        C:\Program Files\Java\jre6\bin\jqs.exe 584
        C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe 1012
        C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 1548
        C:\WINDOWS\system32\svchost.exe 1748
        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 1004
        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe 1308
        C:\WINDOWS\System32\alg.exe 2260
        C:\WINDOWS\system32\wbem\wmiapsrv.exe 2460
        C:\Program Files\Analog Devices\Core\smax4pnp.exe 2820
        C:\Program Files\Unlocker\UnlockerAssistant.exe 2868
        C:\Program Files\Windows Defender\MSASCui.exe 2884
        C:\Program Files\iTunes\iTunesHelper.exe 3180
        C:\WINDOWS\system32\igfxtray.exe 3252
        C:\Program Files\iPod\bin\iPodService.exe 3400
        C:\WINDOWS\system32\hkcmd.exe 3416
        C:\WINDOWS\system32\igfxpers.exe 3428
        C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 3444
        C:\WINDOWS\system32\ctfmon.exe 3588
        C:\Program Files\Messenger\msmsgs.exe 3616
        c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe 332
        C:\Program Files\Windows Live\Contacts\wlcomm.exe 8920
        C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 11732
        C:\Program Files\Windows Live\Toolbar\wltuser.exe 19320
        C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe 20284
        C:\WINDOWS\system32\msiexec.exe 19900
        C:\Documents and Settings\Administrateur\Bureau\List_Kill'em.exe 20436
        C:\WINDOWS\system32\cmd.exe 3768
        C:\WINDOWS\system32\wbem\wmiprvse.exe 17132
        C:\Documents and Settings\Administrateur\Local Settings\Temp\62.tmp\pv.exe 16916

        Detections :
        ==========

        ¤¤¤¤¤¤¤¤¤¤ Files/folders :

        "C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}"
        "C:\Program Files\Adverts"
        "C:\WINDOWS\System32\drivers\etc\hosts.msn"
        "C:\WINDOWS\system32\drivers\Sonyhcp.dll"

        ¤¤¤¤¤¤¤¤¤¤ Files/folders deleted :

        Quarantine :

        Adverts.Kill'em
        hosts.msn.Kill'em
        Sonyhcp.dll.Kill'em
        {3276BE95_AF08_429F_A64F_CA64CB79BCF6}.Kill'em

        ==============
        host file OK !
        ==============

        ========
        Registry
        ========
        Deleted : HKCU\software\microsoft\internet explorer\searchscopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
        Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe
        Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe
        Deleted : HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}

        ============
        Disk Cleaned
        ============

        ================
        Prefetch cleaned
        ================

        ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
      2. All processes killed
        ========== PROCESSES ==========
        No active process named explorer.exe was found!
        Process iexplore.exe killed successfully!
        No active process named firefox.exe was found!
        Process msnmsgr.exe killed successfully!
        No active process named Teatimer.exe was found!
        ========== REGISTRY ==========
        Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe deleted successfully.
        Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\Program Files\ooVoo\ooVoo.exe deleted successfully.
        Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\IXP000.TMP\ikoge.exe deleted successfully.
        Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list\\C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe deleted successfully.
        Registry key HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
        Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
        ========== COMMANDS ==========

        [EMPTYTEMP]

        User: Administrateur
        ->Temp folder emptied: 1868864 bytes
        ->Temporary Internet Files folder emptied: 7024276 bytes
        ->Java cache emptied: 0 bytes
        ->FireFox cache emptied: 0 bytes
        ->Google Chrome cache emptied: 0 bytes

        User: All Users

        User: Default User
        ->Temp folder emptied: 0 bytes
        ->Temporary Internet Files folder emptied: 0 bytes

        User: LocalService
        ->Temp folder emptied: 66016 bytes
        ->Temporary Internet Files folder emptied: 33170 bytes

        User: NetworkService
        ->Temp folder emptied: 920 bytes
        ->Temporary Internet Files folder emptied: 0 bytes

        %systemdrive% .tmp files removed: 0 bytes
        %systemroot% .tmp files removed: 0 bytes
        %systemroot%\System32 .tmp files removed: 0 bytes
        Windows Temp folder emptied: 0 bytes
        Session Manager Temp folder emptied: 0 bytes
        Session Manager Tmp folder emptied: 0 bytes
        %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 17698 bytes
        %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
        RecycleBin emptied: 0 bytes

        Total Files Cleaned = 8,59 mb

        OTL by OldTimer - Version 3.1.17.0 log created on 12162009_175426

        Files\Folders moved on Reboot...
        File move failed. C:\WINDOWS\System32\config\systemprofile\Local Settings\Temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
        File\Folder C:\WINDOWS\System32\config\systemprofile\Local Settings\Temp\Perflib_Perfdata_670.dat not found!

        Registry entries deleted on Reboot...
    2. autant pour moi , je tedonnerai le signal pour malwarebytes

      desole je suis en train de bosser une application ^^
      1. Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

        ▶ Télécharge :

        Malwarebytes

        ou :

        Malwarebytes

        ▶ Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

        (NB : Si tu as un message d'erreur t'indiquant qu'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : COMCTL32.OCX

        ▶ Potasses le Tuto pour te familiariser avec le prg :

        ( cela dit, il est très simple d'utilisation ).

        relance malwarebytes en suivant scrupuleusement ces consignes :

        ! Déconnecte toi et ferme toutes applications en cours !

        ▶ Lance Malwarebyte's .

        Fais un examen dit "Complet" .

        ▶ Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
        ▶ à la fin tu cliques sur "résultat" .
        ▶ Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

        ▶ Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !

        ▶ Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

        1. mais la jsuis entrain de fire ton auter affaire de scan la List&Kill'em et appres je ferais lautre affaire de Malwarebytes et jai un prob avek logiteck que tu ma fais desinstaller o debut la yarrete pas de revenir mais je le ferme en fessan gestionaire de tache !
        2. @vgabondList'em by g3n-h@ckm@n 1.1.5.2

          Thx to Chiquitine29.....& CCM team

          User : Administrateur (Administrateurs) # INDY_PC
          Update on 14/12/2009 by g3n-h@ckm@n ::::: 00:00
          Start at: 17:18:15 | 16/12/2009
          Contact : g3n-h@ckm@n sur CCM

          Intel(R) Pentium(R) 4 CPU 2.80GHz
          Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
          Internet Explorer 8.0.6001.18702
          Windows Firewall Status : Enabled
          AV : avast! antivirus 4.8.1296 [VPS 091216-0] 4.8.1296 [ Enabled | Updated ]

          A:\ -> Lecteur de disquettes 3 ½ pouces
          C:\ -> Disque fixe local | 37,24 Go (14,32 Go free) | NTFS
          D:\ -> Disque CD-ROM

          ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

          C:\WINDOWS\System32\smss.exe 596
          C:\WINDOWS\system32\csrss.exe 644
          C:\WINDOWS\system32\winlogon.exe 668
          C:\WINDOWS\system32\services.exe 712
          C:\WINDOWS\system32\lsass.exe 724
          C:\WINDOWS\system32\svchost.exe 888
          C:\WINDOWS\system32\svchost.exe 952
          C:\Program Files\Windows Defender\MsMpEng.exe 1048
          C:\WINDOWS\System32\svchost.exe 1104
          C:\WINDOWS\system32\svchost.exe 1172
          C:\WINDOWS\system32\svchost.exe 1360
          C:\WINDOWS\Explorer.EXE 1560
          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 1600
          C:\Program Files\Alwil Software\Avast4\ashServ.exe 1648
          C:\WINDOWS\system32\spoolsv.exe 1948
          C:\WINDOWS\system32\svchost.exe 412
          C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 444
          C:\Program Files\Java\jre6\bin\jqs.exe 584
          C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe 1012
          C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 1548
          C:\WINDOWS\system32\svchost.exe 1748
          C:\WINDOWS\system32\wuauclt.exe 208
          C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 1004
          C:\Program Files\Alwil Software\Avast4\ashWebSv.exe 1308
          C:\WINDOWS\System32\alg.exe 2260
          C:\WINDOWS\system32\wbem\wmiapsrv.exe 2460
          C:\WINDOWS\system32\wbem\wmiprvse.exe 2504
          C:\Program Files\Analog Devices\Core\smax4pnp.exe 2820
          C:\Program Files\Unlocker\UnlockerAssistant.exe 2868
          C:\Program Files\Windows Defender\MSASCui.exe 2884
          C:\WINDOWS\system32\msiexec.exe 3156
          C:\Program Files\iTunes\iTunesHelper.exe 3180
          C:\WINDOWS\system32\igfxtray.exe 3252
          C:\Program Files\iPod\bin\iPodService.exe 3400
          C:\WINDOWS\system32\hkcmd.exe 3416
          C:\WINDOWS\system32\igfxpers.exe 3428
          C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 3444
          C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe 3472
          C:\WINDOWS\system32\ctfmon.exe 3588
          C:\Program Files\Messenger\msmsgs.exe 3616
          C:\Program Files\Internet Explorer\iexplore.exe 3192
          C:\Program Files\Internet Explorer\iexplore.exe 1916
          C:\Program Files\Windows Live\Toolbar\wltuser.exe 3860
          c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe 332
          C:\Program Files\Internet Explorer\iexplore.exe 2808
          C:\Documents and Settings\Administrateur\Bureau\List_Kill'em.exe 3368
          C:\WINDOWS\system32\cmd.exe 3348
          C:\WINDOWS\system32\wbem\wmiprvse.exe 2168
          C:\Documents and Settings\Administrateur\Local Settings\Temp\19.tmp\pv.exe 2784

          ======================
          Keys "Run"
          ======================
          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          MsnMsgr REG_SZ "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
          SpybotSD TeaTimer REG_SZ C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
          ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
          LDM REG_SZ C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
          MSMSGS REG_SZ "C:\Program Files\Messenger\msmsgs.exe" /background
          swg REG_SZ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          SoundMAXPnP REG_SZ C:\Program Files\Analog Devices\Core\smax4pnp.exe
          Logitech Hardware Abstraction Layer REG_SZ KHALMNPR.EXE
          UnlockerAssistant REG_SZ C:\Program Files\Unlocker\UnlockerAssistant.exe -H
          Windows Defender REG_SZ "C:\Program Files\Windows Defender\MSASCui.exe" -hide
          QuickTime Task REG_SZ "C:\Program Files\VistaCodecPack\QT\qttask.exe" -atboottime
          UniMessenger REG_SZ
          LogitechCommunicationsManager REG_SZ "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
          LogitechQuickCamRibbon REG_SZ "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
          iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
          igfxtray REG_SZ C:\WINDOWS\system32\igfxtray.exe
          igfxhkcmd REG_SZ C:\WINDOWS\system32\hkcmd.exe
          igfxpers REG_SZ C:\WINDOWS\system32\igfxpers.exe
          avast! REG_SZ C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

          =====================
          Other Keys
          =====================
          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
          dontdisplaylastusername REG_DWORD 0 (0x0)
          legalnoticecaption REG_SZ
          legalnoticetext REG_SZ
          shutdownwithoutlogon REG_DWORD 1 (0x1)
          undockwithoutlogon REG_DWORD 1 (0x1)

          ===============
          [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
          NoDriveTypeAutoRun REG_DWORD 145 (0x91)

          ===============
          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
          HonorAutoRunSetting REG_DWORD 1 (0x1)

          ===============
          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
          AppInit_DLLS REG_SZ

          ===============
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igfxcui]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

          ===============
          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
          {AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ
          {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} REG_SZ Microsoft AntiMalware ShellExecuteHook

          ===============
          [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
          %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
          %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
          C:\WINDOWS\system32\dpvsetup.exe REG_SZ C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test
          C:\WINDOWS\system32\rundll32.exe REG_SZ C:\WINDOWS\system32\rundll32.exe:*:Enabled:Exécuter une DLL en tant qu'application
          C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe REG_SZ C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger
          C:\Program Files\ooVoo\ooVoo.exe REG_SZ C:\Program Files\ooVoo\ooVoo.exe:*:Enabled:ooVoo
          C:\Program Files\Messenger\msmsgs.exe REG_SZ C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
          C:\Program Files\iTunes\iTunes.exe REG_SZ C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
          C:\Program Files\LimeWire\LimeWire.exe REG_SZ C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire
          C:\Program Files\uTorrent\uTorrent.exe REG_SZ C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent
          C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
          C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\IXP000.TMP\ikoge.exe REG_SZ C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\IXP000.TMP\ikoge.exe:*:Enabled:Firevall Administrating
          C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
          C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger

          [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
          %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
          %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
          C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe REG_SZ C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger
          C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
          C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
          C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger

          ===============
          BHO :
          ======
          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{53707962-6F74-2D53-2644-206D7942484F}]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

          ================
          Internet Explorer :
          ================
          [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
          Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp

          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
          Start Page REG_SZ http://www.gllob.com

          ========
          Services
          ========
          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

          Ndisuio : 0x3
          EapHost : 0x3
          SharedAccess : 0x2
          windefend : 0x2
          wuauserv : 0x2

          =========

          =======
          Drive :
          =======

          D‚fragmenteur de disque Windows
          Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

          Rapport d'analyse
          37,24 Go total, 14,32 Go libre (38%), 15% fragment‚ (fragmentation du fichier 29%)

          Vous devriez d‚fragmenter ce volume.

          ¤¤¤¤¤¤¤¤¤¤ Files/folders :

          C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
          C:\Program Files\Adverts
          C:\WINDOWS\System32\drivers\etc\hosts.msn
          C:\WINDOWS\System32\drivers\Sonyhcp.dll
          C:\Documents and Settings\Administrateur\Application Data\mindhabits.dat

          ¤¤¤¤¤¤¤¤¤¤ Keys :

          "HKCU\software\microsoft\internet explorer\searchscopes\{CF739809-1C6C-47C0-85B9-569DBB141420}"
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
          HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}
          HKLM\Software\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}

          =========
          Rootkits
          =========

          catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
          Rootkit scan 2009-12-16 17:22:25
          Windows 5.1.2600 Service Pack 3 NTFS

          scanning hidden processes ...

          scanning hidden services & system hive ...

          scanning hidden registry entries ...

          scanning hidden files ...

          scan completed successfully
          hidden processes: 0
          hidden services: 0
          hidden files: 0

          Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

          device: opened successfully
          user: MBR read successfully
          kernel: MBR read successfully
          user & kernel MBR OK

          ==========
          Programs
          ==========

          Ad-Remover
          Adverts
          Alwil Software
          Analog Devices
          Apple Software Update
          ComPlus Applications
          Dome Messenger
          Fichiers communs
          Foxit Software
          Google
          HashTab Shell Extension
          InstallShield Installation Information
          Internet Explorer
          iPod
          iTunes
          Java
          LG Electronics
          LG PC Suite 2
          LimeWire
          Logitech
          Malwarebytes' Anti-Malware
          Messenger
          Messenger Plus! Live
          Microsoft
          Microsoft CAPICOM 2.1.0.2
          microsoft frontpage
          Microsoft Office
          Microsoft Office Outlook Connector
          Microsoft PowerToys
          Microsoft Silverlight
          Microsoft SQL Server Compact Edition
          Microsoft Sync Framework
          Microsoft Visual Studio
          Microsoft Visual Studio 8
          Microsoft Works
          Microsoft.NET
          MindHabits
          Movie Maker
          Mozilla Firefox
          MSBuild
          MSECache
          MSN
          MSN Gaming Zone
          MSN Messenger
          MSXML 4.0
          MSXML 6.0
          MySpace
          NetMeeting
          Online Services
          Outlook Express
          PDF Editeur 2
          PokerStars
          Real
          RealArcade
          Reference Assemblies
          Registry Easy
          RngInterstitial.dll
          Services en ligne
          Spybot - Search & Destroy
          Sun
          SystemRequirementsLab
          Trend Micro
          UNI2
          Uninstall Information
          Unlocker
          Utilities
          uTorrent
          VistaCodecPack
          Windows Defender
          Windows Live
          Windows Live SkyDrive
          Windows Live Toolbar
          Windows Media Connect 2
          Windows Media Player
          Windows NT
          WindowsUpdate
          WinRAR
          xerox
          Z-Ball Free Trial
          Zuma's Revenge!

          ============
          Lecteur C:
          ============

          Ad-Report-CLEAN[1].log
          Ad-Report-CLEAN[2].log
          Ad-Report-SCAN[1].log
          AUTOEXEC.BAT
          boot.ini
          Bootfont.bin
          Config.Msi
          CONFIG.SYS
          Documents and Settings
          DPsFnshr.log
          Drivers
          fcc5c7c14dd1dfd38f73ae2000
          games
          hiberfil.sys
          IDE
          Install_Log.txt
          IO.SYS
          Kill'em
          List'em.txt
          lvcoinst.log
          MSDOS.SYS
          MSOCache
          My Games
          NTDETECT.COM
          ntldr
          pagefile.sys
          Program Files
          Programe telecharger
          RECYCLER
          sqmdata00.sqm
          sqmdata01.sqm
          sqmdata02.sqm
          sqmnoopt00.sqm
          sqmnoopt01.sqm
          sqmnoopt02.sqm
          System Volume Information
          TEMP
          USB_DRV
          users
          WINDOWS
          _OTL

          ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
        3. voila ton log de lautre affaire !
      2. ▶ Double clic sur OTL.exe pour le lancer.

        ▶Copie la liste qui se trouve en gras ci-dessous,

        ▶ colle-la dans la zone sous Customs Scans/Fixes :

        :processes
        explorer.exe
        iexplore.exe
        firefox.exe
        msnmsgr.exe
        Teatimer.exe

        :OTL
        @Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8F7DC5D9
        @Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:ADF211B1

        :commands
        [Purity]
        [emptytemp]
        [start explorer]

        ▶ Clique sur RunFix pour lancer la suppression.

        ▶ Poste le rapport.

        ensuite :

        Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent

        ▶ TéléchargeList&Kill'emet enregistre le sur ton bureau (car il est detecté a tort comme infection)

        Il ne necessite pas d'installation

        choisis la langue puis choisis l'option 1 = Mode Recherche

        ▶ laisse travailler l'outil

        à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

        un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , mais ne le supprime pas pour l instant, le scan n'est pas fini.

        ▶ Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

        tu peux supprimer le rapport catchme.log de ton bureau maintenant.

        1. voila le lof de otl

          All processes killed
          ========== PROCESSES ==========
          No active process named explorer.exe was found!
          Process iexplore.exe killed successfully!
          No active process named firefox.exe was found!
          No active process named msnmsgr.exe was found!
          No active process named Teatimer.exe was found!
          ========== OTL ==========
          ADS C:\Documents and Settings\All Users\Application Data\TEMP:8F7DC5D9 deleted successfully.
          ADS C:\Documents and Settings\All Users\Application Data\TEMP:ADF211B1 deleted successfully.
          ========== COMMANDS ==========

          [EMPTYTEMP]

          User: Administrateur
          ->Temp folder emptied: 262632 bytes
          ->Temporary Internet Files folder emptied: 10744178 bytes
          ->Java cache emptied: 7610880 bytes
          ->FireFox cache emptied: 37612960 bytes
          ->Google Chrome cache emptied: 0 bytes

          User: All Users

          User: Default User
          ->Temp folder emptied: 0 bytes
          ->Temporary Internet Files folder emptied: 0 bytes

          User: LocalService
          ->Temp folder emptied: 66016 bytes
          ->Temporary Internet Files folder emptied: 33170 bytes

          User: NetworkService
          ->Temp folder emptied: 8816 bytes
          ->Temporary Internet Files folder emptied: 33170 bytes

          %systemdrive% .tmp files removed: 0 bytes
          %systemroot% .tmp files removed: 0 bytes
          %systemroot%\System32 .tmp files removed: 4706 bytes
          Windows Temp folder emptied: 23681 bytes
          Session Manager Temp folder emptied: 0 bytes
          Session Manager Tmp folder emptied: 0 bytes
          %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 145474 bytes
          %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
          RecycleBin emptied: 1687783 bytes

          Total Files Cleaned = 55,54 mb

          OTL by OldTimer - Version 3.1.17.0 log created on 12162009_171156

          Files\Folders moved on Reboot...
          File move failed. C:\WINDOWS\System32\config\systemprofile\Local Settings\Temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
          File\Folder C:\WINDOWS\System32\config\systemprofile\Local Settings\Temp\Perflib_Perfdata_5c0.dat not found!

          Registry entries deleted on Reboot...
      3. bien refais un scan OTL comme demandé precedemment
        1. bon voila desoer pour lattente jai des truc a faire en meme temps mais merci beaucoup pour ton aide cest tres tres apprecier donc voila jai suivi les etape comme celle davant et voila le log !

          http://www.cijoint.fr/cjlink.php?file=cj200912/cijLq5EQsj.txt
        2. et voila lextra joubliais desoller !

          http://www.cijoint.fr/cjlink.php?file=cj200912/cijMJIwV78.txt
      4. ▶ Télécharge Zeb-Restoreet enregistre ce fichier sur le bureau.

        ▶-Clic droit Zeb-Restore.zip ==> Extraire tout choisis comme lieu d'enregistrement le bureau.

        ▶-Ouvre le dossier ZR_1.0.0.37 ==> double clic sur Zeb-Restore.exe

        ▶- Coche la case devant : sites de confiance et fichiers host

        ▶- Ne coche aucune autre case

        ▶-Clique sur Restaurer

        ▶-Redémarre ton PC

        ensuite :


        ▶ Double clic sur OTL.exe pour le lancer.

        ▶Copie la liste qui se trouve en gras ci-dessous,

        ▶ colle-la dans la zone sous Customs Scans/Fixes :


        :processes
        explorer.exe
        iexplore.exe
        firefox.exe
        msnmsgr.exe
        Teatimer.exe

        :OTL
        FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07
        FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}:6.0.12
        FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15
        [2008/08/11 13:08:02 | 00,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
        [2009/02/15 21:16:09 | 00,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
        [2009/11/22 13:49:11 | 00,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
        O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
        O4 - HKLM..\Run: [UniMessenger] File not found
        O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

        :reg
        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
        "iTunesHelper"=-
        "QuickTime Task"=-
        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
        "C:\Program Files\ooVoo\ooVoo.exe"=-
        "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\IXP000.TMP\ikoge.exe"=-
        :files
        C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

        :commands
        [emptytemp]
        [start explorer]
        [reboot]


        ▶ Clique sur RunFix pour lancer la suppression.

        ▶ Poste le rapport.
        1. bon voila le log demander et maitenant que dois je faire !

          All processes killed
          ========== PROCESSES ==========
          No active process named explorer.exe was found!
          Process iexplore.exe killed successfully!
          No active process named firefox.exe was found!
          Process msnmsgr.exe killed successfully!
          No active process named Teatimer.exe was found!
          ========== OTL ==========
          Prefs.js: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07 removed from extensions.enabledItems
          Prefs.js: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}:6.0.12 removed from extensions.enabledItems
          Prefs.js: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15 removed from extensions.enabledItems
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\content folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\content folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\content folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome folder moved successfully.
          C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} folder moved successfully.
          Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
          Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
          Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\UniMessenger deleted successfully.
          Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
          C:\WINDOWS\Downloaded Program Files\CONFLICT.1\gp.inf not found.
          Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
          Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
          Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
          Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
          ========== REGISTRY ==========
          Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\iTunesHelper deleted successfully.
          Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task deleted successfully.
          Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\ooVoo\ooVoo.exe deleted successfully.
          Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\IXP000.TMP\ikoge.exe deleted successfully.
          ========== FILES ==========
          C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\x86 folder moved successfully.
          C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86 folder moved successfully.
          C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} folder moved successfully.
          ========== COMMANDS ==========

          [EMPTYTEMP]

          User: Administrateur
          ->Temp folder emptied: 101817 bytes
          ->Temporary Internet Files folder emptied: 21620708 bytes
          ->Java cache emptied: 54391036 bytes
          ->FireFox cache emptied: 96729366 bytes
          ->Google Chrome cache emptied: 6013616 bytes

          User: All Users

          User: Default User
          ->Temp folder emptied: 48300 bytes
          ->Temporary Internet Files folder emptied: 33170 bytes

          User: LocalService
          ->Temp folder emptied: 99119 bytes
          ->Temporary Internet Files folder emptied: 33170 bytes

          User: NetworkService
          ->Temp folder emptied: 1122972 bytes
          ->Temporary Internet Files folder emptied: 2433007 bytes

          %systemdrive% .tmp files removed: 0 bytes
          %systemroot% .tmp files removed: 2133582 bytes
          %systemroot%\System32 .tmp files removed: 3072 bytes
          Windows Temp folder emptied: 0 bytes
          Session Manager Temp folder emptied: 0 bytes
          Session Manager Tmp folder emptied: 0 bytes
          %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 121857072 bytes
          %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
          RecycleBin emptied: 1330184 bytes

          Total Files Cleaned = 293,72 mb

          OTL by OldTimer - Version 3.1.17.0 log created on 12142009_172651

          Files\Folders moved on Reboot...
          File move failed. C:\WINDOWS\System32\config\systemprofile\Local Settings\Temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
          File\Folder C:\WINDOWS\System32\config\systemprofile\Local Settings\Temp\Perflib_Perfdata_674.dat not found!

          Registry entries deleted on Reboot...
      5. Télécharge OTL de OLDTimer

        ▶ enregistre le sur ton Bureau.

        ▶ Double clic ( pour vista => clic droit "executer en tant qu'administrateur") sur OTL.exe pour le lancer.

        ▶ Coche les 2 cases Lop et Purity

        ▶ Coche la case devant scan all users

        ▶ règle-le sur "60 Days"

        ▶ dans la colonne de gauche , mets tout sur all

        ne modifie pas ceci :

        "files created whithin" et "files modified whithin"


        ▶Clic sur Run Scan.

        A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

        Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

        ▶▶▶ NE LE POSTE PAS SUR LE FORUM

        Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

        ▶ Clique sur Parcourir et cherche le fichier ci-dessus.

        ▶ Clique sur Ouvrir.

        ▶ Clique sur "Cliquez ici pour déposer le fichier".

        Un lien de cette forme :

        http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

        est ajouté dans la page.

        ▶ Copie ce lien dans ta réponse.

        ▶▶ Tu feras la meme chose avec le "Extra.txt".
        1. voila

          http://www.cijoint.fr/cjlink.php?file=cj200912/cij5J53zNe.txt

          http://www.cijoint.fr/cjlink.php?file=cj200912/cij9QmL6FG.txt
      6. d'accord mentir....regle lui son probleme dans ce cas...bonne soirée

        MDR !
        1. bon voila le leg de ton prg

          ======= RAPPORT D'AD-REMOVER 1.1.4.6_E | UNIQUEMENT XP/VISTA/7 =======
          .
          Mit à jour par C_XX le 13.12.2009 à 20:08
          Contact: AdRemover.contact@gmail.com
          Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
          .
          Lancé à: 13:11:58, 14/12/2009 | Mode sans echec | Option: CLEAN
          Exécuté de: C:\Program Files\Ad-Remover\
          Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
          Nom du PC: INDY_PC | Utilisateur actuel: Administrateur
          .
          ============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
          .

          C:\Program Files\Mozilla FireFox\Components\AskSearch.js

          (!) -- Fichiers temporaires supprimés.

          .
          HKCU\software\microsoft\internet explorer\searchscopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
          .
          ============== Scan additionnel ==============
          .
          .
          * Mozilla FireFox Version 3.5.5 [fr] *
          .
          Nom du profil: nyksljdq.default (Administrateur)
          .
          (ADMINI~1, prefs.js) Browser.download.lastDir, C:\Documents and Settings\Administrateur\Bureau
          (ADMINI~1, prefs.js) Browser.search.defaultenginename, Bing
          (ADMINI~1, prefs.js) Browser.search.defaulturl, hxxp://www.bing.com/search?FORM=IEFM1&q=
          (ADMINI~1, prefs.js) Browser.search.selectedEngine, Google
          (ADMINI~1, prefs.js) Browser.startup.homepage, hxxp://fr.msn.com/
          .
          .
          * Internet Explorer Version 8.0.6001.18702 *
          .
          [HKEY_CURRENT_USER\..\Internet Explorer\Main]
          .
          Do404Search: 01000000
          Local Page: C:\WINDOWS\system32\blank.htm
          Show_ToolBar: yes
          Start Page: hxxp://fr.msn.com/
          Enable Browser Extensions: yes
          Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
          Start Page Redirect Cache: hxxp://fr.msn.com/?ocid=iehp
          Start Page Redirect Cache_TIMESTAMP: 7a14278bb772ca01
          Start Page Redirect Cache AcceptLangs: fr
          Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
          Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
          .
          [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
          .
          Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
          Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
          Delete_Temp_Files_On_Exit: yes
          Local Page: C:\WINDOWS\system32\blank.htm
          Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
          Start Page: hxxp://fr.msn.com/
          Search bar: hxxp://search.msn.com/spbasic.htm
          .
          [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
          .
          Tabs: res://ieframe.dll/tabswelcome.htm
          .
          ============== Suspect (Cracks, Serials, ...) ==============
          .
          C:\Documents and Settings\Administrateur\Mes documents\Downloads\Avast 4.8.1296 Professional [h33t] - XPLOSiON\Keygen.exe
          .
          ===================================
          .
          524 Octet(s) - C:\Ad-Report-CLEAN[1].log
          2716 Octet(s) - C:\Ad-Report-CLEAN[2].log
          3036 Octet(s) - C:\Ad-Report-SCAN[1].log
          .
          0 Fichier(s) - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
          0 Fichier(s) - C:\WINDOWS\Temp
          0 Fichier(s) - C:\WINDOWS\Prefetch
          .
          20 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
          1 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE
          .
          Fin à: 13:15:48 | 14/12/2009 - CLEAN[2]
          .
          ============== E.O.F ==============
          .
        2. bon mets la c pas grave je lais deja supprimer logiteck donc jmen oquperis a la fin mais ec ce que tu peut maider pour terminer moi je suivais tes demarche la allors la jattends de tes nouvelle merci de ton aide !
      7. Non on doit pas suprimée le programme logitech car sa mets du temps pour le telecharger et sa va bloquer plus!!!!
        1. Salut,

          Windows non activé, allégé, modifié, voire ... cracké !

          "Les problèmes se posent lorsqu’une personne vient se faire dépanner sur un forum d’aide.
          En désinfection les tools utilisés peuvent être incompatibles, certaines fonctions utiles à la résolution de problèmes ne sont pas installées, problème pour la mise en réseau, etc
          …"
          1. et bien !! salut !! drolement construit ce windows !!

            ^^

            desinstalle le programme logitech

            ensuite :

            ▶ Télécharge Ad-remover ( de C_XX ) sur ton bureau :

            ▶ Déconnecte toi et ferme toutes applications en cours !

            ▶ Double clique sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installation par défaut .

            ▶ Double-clique sur le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil .

            ▶ Au menu principal choisis l'option "L" et tape sur [entrée] .

            ▶ Laisse travailler l'outil et ne touche à rien ...

            ▶ Poste le rapport qui apparait à la fin , sur le forum ...

            ( Le rapport est sauvegardé aussi sous C:\Ad-report.log )
            ( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )

            ▶ Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
            Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
            Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
            1. tu peut me dire pkoi tu dit de desinstaler le prg ed logiteck et ke mon win est drolement monter mais jvais suivre tes conseil mais jaimerais que tu mexplik svp
            2. .
              ======= RAPPORT D'AD-REMOVER 1.1.4.6_E | UNIQUEMENT XP/VISTA/7 =======
              .
              Mit à jour par C_XX le 13.12.2009 à 20:08
              Contact: AdRemover.contact@gmail.com
              Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
              .
              Lancé à: 13:11:58, 14/12/2009 | Mode sans echec | Option: CLEAN
              Exécuté de: C:\Program Files\Ad-Remover\
              Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
              Nom du PC: INDY_PC | Utilisateur actuel: Administrateur
              .
              ============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
              .

              C:\Program Files\Mozilla FireFox\Components\AskSearch.js

              (!) -- Fichiers temporaires supprimés.

              .
              HKCU\software\microsoft\internet explorer\searchscopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
              .
              ============== Scan additionnel ==============
              .
              .
              * Mozilla FireFox Version 3.5.5 [fr] *
              .
              Nom du profil: nyksljdq.default (Administrateur)
              .
              (ADMINI~1, prefs.js) Browser.download.lastDir, C:\Documents and Settings\Administrateur\Bureau
              (ADMINI~1, prefs.js) Browser.search.defaultenginename, Bing
              (ADMINI~1, prefs.js) Browser.search.defaulturl, hxxp://www.bing.com/search?FORM=IEFM1&q=
              (ADMINI~1, prefs.js) Browser.search.selectedEngine, Google
              (ADMINI~1, prefs.js) Browser.startup.homepage, hxxp://fr.msn.com/
              .
              .
              * Internet Explorer Version 8.0.6001.18702 *
              .
              [HKEY_CURRENT_USER\..\Internet Explorer\Main]
              .
              Do404Search: 01000000
              Local Page: C:\WINDOWS\system32\blank.htm
              Show_ToolBar: yes
              Start Page: hxxp://fr.msn.com/
              Enable Browser Extensions: yes
              Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
              Start Page Redirect Cache: hxxp://fr.msn.com/?ocid=iehp
              Start Page Redirect Cache_TIMESTAMP: 7a14278bb772ca01
              Start Page Redirect Cache AcceptLangs: fr
              Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
              Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
              .
              [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
              .
              Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
              Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
              Delete_Temp_Files_On_Exit: yes
              Local Page: C:\WINDOWS\system32\blank.htm
              Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
              Start Page: hxxp://fr.msn.com/
              Search bar: hxxp://search.msn.com/spbasic.htm
              .
              [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
              .
              Tabs: res://ieframe.dll/tabswelcome.htm
              .
              ============== Suspect (Cracks, Serials, ...) ==============
              .
              C:\Documents and Settings\Administrateur\Mes documents\Downloads\Avast 4.8.1296 Professional [h33t] - XPLOSiON\Keygen.exe
              .
              ===================================
              .
              524 Octet(s) - C:\Ad-Report-CLEAN[1].log
              2716 Octet(s) - C:\Ad-Report-CLEAN[2].log
              3036 Octet(s) - C:\Ad-Report-SCAN[1].log
              .
              0 Fichier(s) - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
              0 Fichier(s) - C:\WINDOWS\Temp
              0 Fichier(s) - C:\WINDOWS\Prefetch
              .
              20 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
              1 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE
              .
              Fin à: 13:15:48 | 14/12/2009 - CLEAN[2]
              .
              ============== E.O.F ==============
              .
          2. Bonjour, je crois qu' il faudra suprimé quelques programmes ou sinon je verrai.
            Je pourrais te repondre juste le mercredi, samedi, dimanche.
            Bone journée!!!