Win32.Small.gen2 [trj]

Résolu
nad43 -  
bonjour,
je viens vous demander de l'aide car je suis novice en informatique et je suis infectée par un cheval de troie appelé win32.Small.gen2 . à chaque demarrage avast me signale ce virus malgré qu'à chaque fois je le mette en quarantaine ou le supprime. j'ai fait une analyse hijackthis mais je ne peux pas envoyer le rapport dans aucun message; celà bloque systematiquement le message!!je suis donc desolée mais je ne peux meme pas vous aider à m'aider en vous donnant ce rapport...pouvez vous quand meme me donner un coup de main!!!je ne sais plus quoi faire!!!merci de vos conseils.
Configuration: Windows XP
Internet Explorer 6.0

26 réponses

Résumé de la discussion

Le fil décrit une infection par le cheval de Troie Win32.Small.gen2 et des alertes Avast persistantes au démarrage, malgré la mise en quarantaine et la suppression, l’impossibilité d’envoyer le rapport HijackThis. Des réponses mentionnent un rapport HijackThis détaillé et une liste longue de processus et de modules actifs, avec des outils antivirus multiples et des composants système affectant potentiellement le démarrage et la sécurité. Une autre intervention relate l’impossibilité d’obtenir le rapport, puis une tentative de relancement du programme de désinfection sans effet, suggérant que le malware pourrait ne pas être lancé ou que l’outil échoue. D’autres éléments soulignent le ralentissement au démarrage et le souci de l’utilisateur quant à la libération du système, sans verdict clair sur l’état final du nettoyage.

Bobot (l’IA à votre service)
  2. nad43 Auteur
    ça y est!!! tout est parfait maintenant!!je suis ravie; c'etait la premiere fois que je venais sur un forum et je ne m'attendais vraiment pas à trouver des personnes pretes à me consacrer autant de temps pour resoudre mon probleme!!!merci à tous pour votre gentillesse et bravo pour vos competences qui sont tres impressionnantes pour une novice comme moi!!!desormais je n'hesiterai pas à venir vous voir en cas de nouveau soucis...mais j'espere quand meme que ce sera le moins possible!!merci encore et peut etre à bientot...
    2. nad43 Auteur
      merci de repondre aussi vite!! je viens donc de faire ccleaner et cleanup; puis j'ai redemarré mon ordi et ça à l'air de bien aller mais il est vrai que je le trouve toujours un peu long pour demarrer ( il lui faut 3 minutes avant que je puisse commencer à faire quoi que ce soit dessus...) en tout cas c'est nettement mieux que ce que c'etait avant avec tout ces viruss!!!tu m'as vraiment beaucoup aidé et celà t'as pris beaucoup de temps, je te suis vraiment reconnaissante!!!
      2. green day Modérateur
        voici pour cleanup : ( je te l'avais mis precedement )

        * CleanUp40 (qui élimine les fichiers temporaires + cookies : gratuit )
        http://pageperso.aol.fr/Balltrap34/CleanUp40.exe

        tuto : (merci à Balltrap) http://pageperso.aol.fr/balltrap34/democleanup.htm


        j'ai regcleaner est ce que c'est pareil?

        regcleaner, c'est comme ccleaner : un nettoyeur de base de registre, il faut à peut près le même travail que ccleaner, ccleaner est plus axcés sur les fichiers temp etc ...

        @+
        1. nad43 Auteur
          salut!!
          je viens de faire ce que tu m'as dit sur hijackthis; par contre je ne trouve nul part les 2 fichiers en gras...je vais quand meme passer un coup de ccleaner. je n'ai pas cleanup, mais j'ai regcleaner est ce que c'est pareil? je te remercie beaucoup de ton aide.
          1. green day Modérateur
            Salut :-)

            Relance HijackThis : choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked" :

            O2 - BHO: (no name) - {36645342-9475-2663-166A-466739207346} - C:\WINDOWS\system32\ipv6mote.dll (file missing)
            O2 - BHO: Starware - {F7C7AA47-BCA6-451D-8DBC-C10A8F75C8C7} - C:\Program Files\Starware\bin\Starware.dll (file missing)

            O3 - Toolbar: Starware - {9839B3B7-3F99-4498-884D-6CFCCD251AB1} - C:\Program Files\Starware\bin\Starware.dll (file missing)

            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
            O4 - HKLM\..\Run: [dmtuw.exe] C:\WINDOWS\system32\dmtuw.exe
            O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
            O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
            O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
            O4 - HKLM\..\Run: [Nwiz] nwiz.exe /installquiet
            O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
            O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

            O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
            O4 - HKCU\..\Run: [UpdateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
            O4 - HKCU\..\Run: [Ldm] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
            O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
            O4 - Startup: Aide mémoire.lnk = ?
            O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
            O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
            O4 - Global Startup: hp psc 1000 series.lnk = ?
            O4 - Global Startup: hpoddt01.exe.lnk = ?
            O4 - Global Startup: lancement rapide d'adobe reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
            O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

            O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll/search.htm
            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
            O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/229?ef0ae8d6565046acaad4cc231c9bb2de
            O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/230?ef0ae8d6565046acaad4cc231c9bb2de

            O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
            O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
            O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
            O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/default.aspx
            O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} - http://www2.incredimail.com/contents/setup/downloader/imloader.cab

            cherche et supprime les fichiers en gras :

            C:\Program Files\Starware\bin\Starware.dll

            C:\WINDOWS\system32\dmtuw.exe

            repasse un coup de cleanup + ccleaner

            et ça sera tout bon !

            @+

            La sagesse, c'est d'avoir des rêves suffisamment grands pour ne pas les
            perdre de vue lorsqu'on les poursuit. (Oscar Wilde)
            1. Utilisateur anonyme
              Ok, merci, apparement c'est un "nouveau" rapport vu la date et l'heure :P

              Dommage pour "moi" ça sera pour une prochaine fois ;-)

              Green Day va continuer avec toi

              A plus tard ++
              1. nad43 Auteur
                rebonjour!!
                excuse moi car je viens de me rendre compte que finalement ça m'a bien donné un rapport, le voici:
                (2/19/07 09:43:41) SPSeHjFix started v1.1.2
                (2/19/07 09:43:41) OS: WinXP Service Pack 2 (5.1.2600)
                (2/19/07 09:43:41) Language: français
                (2/19/07 09:43:41) Win-Path: C:\WINDOWS
                (2/19/07 09:43:41) System-Path: C:\WINDOWS\system32
                (2/19/07 09:43:41) Temp-Path: C:\DOCUME~1\Nadege\LOCALS~1\Temp\
                (2/19/07 09:43:43) Disinfection started
                (2/19/07 09:43:43) Bad-Dll(IEP): (not found)
                (2/19/07 09:43:43) Bad-Dll(IEP) in BHO: (not found)
                (2/19/07 09:43:43) UBF: 8 - UBB: 8 - UBR: 24
                (2/19/07 09:43:43) UBF: 8 - UBB: 8 - UBR: 24
                (2/19/07 09:43:43) Bad IE-pages: (none)
                (2/19/07 09:43:43) Stealth-String not found
                (2/19/07 09:43:43) Not infected->END
                voilà j'espere que ça va t'etre utile...merci
                1. nad43 Auteur
                  bonjour,
                  je viens de faire une recherche pour ce rapport mais rien n'a ete trouve. j'ai donc essayé de relancer ce programme mais comme la derniere fois lorsque je clique sur start desinfection, la touche reste bien clickée mais rien ne se passe comme si je n'avais rien fait...je pense en fait que ça ne lance rien du tout...y'à surement un truc que je ne fais pas comme il faut...désolé.
                  1. Utilisateur anonyme
                    Tu devrais y avoir un rapport : SPSeHjFix.log
                    Utilise : clic démarrer, rechercher, tous les fichiers et dossiers, puis ance la recherche.

                    Si tu ne trouves pas tant pis ! Continue avec Green Day

                    ++
                    1. green day Modérateur
                      Salut

                      Je pense qui devait y avoir un rapport ?! attendons l'avis de Boule ;-P

                      ++
                      1. nad43 Auteur
                        salut tout le monde!!
                        je viens de faire ce que tu m'as dis avec trojaner-info mais ça ne m'a donné aucun rapport... c'est grave docteur?!!!merci.
                        1. Utilisateur anonyme
                          Quelle grande langue :O))

                          J'incruste ton post c'est "pour moi" n'hésite pas à continuer normalement ;-)
                          1. Utilisateur anonyme
                            Salut toutes les deux

                            Peux-tu faire ceci pour vérifier stp

                            Télécharge
                            http://www.trojaner-info.de/files/SpSeHjfix112.exe

                            Clic sur "start désinfection"
                            Si l'ordi redémarre c'est normal.
                            Il va peut-être te générer un rapport colle le ici stp
                            1. green day Modérateur
                              Salut ;-P
                          2. nad43 Auteur
                            dans le rapport hijackthis je ne retrouve pas les memes lignes que celles que dont me dit de cocher...voici le rapport que j'ai:
                            Logfile of HijackThis v1.99.1
                            Scan saved at 23:19:03, on 17/02/2007
                            Platform: Windows XP SP2 (WinNT 5.01.2600)
                            MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                            Running processes:
                            C:\WINDOWS\System32\smss.exe
                            C:\WINDOWS\system32\winlogon.exe
                            C:\WINDOWS\system32\services.exe
                            C:\WINDOWS\system32\lsass.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\system32\spoolsv.exe
                            C:\WINDOWS\Explorer.EXE
                            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                            C:\Program Files\Alwil Software\Avast4\ashServ.exe
                            C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                            C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
                            C:\WINDOWS\System32\nvsvc32.exe
                            c:\fotowin\RTETPISv.exe
                            C:\WINDOWS\system32\slserv.exe
                            C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
                            C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                            C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                            C:\Program Files\MessengerPlus! 3\MsgPlus.exe
                            C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                            C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
                            C:\Program Files\Logitech\Video\LogiTray.exe
                            C:\Program Files\QuickTime\qttask.exe
                            C:\WINDOWS\system32\LVCOMSX.EXE
                            C:\WINDOWS\SOUNDMAN.EXE
                            C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                            C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
                            C:\Program Files\Logitech\Video\FxSvr2.exe
                            C:\Program Files\Messenger\msmsgs.exe
                            C:\Program Files\MSN Messenger\msnmsgr.exe
                            C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                            C:\PROGRA~1\INCRED~1\bin\IMApp.exe
                            C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
                            C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
                            C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
                            C:\Program Files\Aide mémoire\TrayIcon.exe
                            C:\WINDOWS\System32\HPZipm12.exe
                            C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
                            C:\Program Files\Internet Explorer\iexplore.exe
                            C:\WINDOWS\system32\wuauclt.exe
                            C:\Documents and Settings\Nadege\Bureau\hijackthis\HijackThis.exe

                            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://portail.free.fr/
                            R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://portail.free.fr/
                            R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
                            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
                            R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;127.0.0.1;chazot
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                            R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
                            O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
                            O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                            O2 - BHO: (no name) - {36645342-9475-2663-166A-466739207346} - C:\WINDOWS\system32\ipv6mote.dll (file missing)
                            O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
                            O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
                            O2 - BHO: Barre d'outils MSN Search Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
                            O2 - BHO: Starware - {F7C7AA47-BCA6-451D-8DBC-C10A8F75C8C7} - C:\Program Files\Starware\bin\Starware.dll (file missing)
                            O3 - Toolbar: Barre d'outils MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
                            O3 - Toolbar: Starware - {9839B3B7-3F99-4498-884D-6CFCCD251AB1} - C:\Program Files\Starware\bin\Starware.dll (file missing)
                            O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
                            O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
                            O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
                            O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                            O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
                            O4 - HKLM\..\Run: [dmtuw.exe] C:\WINDOWS\system32\dmtuw.exe
                            O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
                            O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
                            O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
                            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                            O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
                            O4 - HKLM\..\Run: [Lvcomsx] C:\WINDOWS\system32\LVCOMSX.EXE
                            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
                            O4 - HKLM\..\Run: [Nwiz] nwiz.exe /installquiet
                            O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                            O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                            O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
                            O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
                            O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
                            O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                            O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c
                            O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
                            O4 - HKCU\..\Run: [UpdateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
                            O4 - HKCU\..\Run: [Ldm] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                            O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                            O4 - Startup: Aide mémoire.lnk = ?
                            O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
                            O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
                            O4 - Global Startup: hp psc 1000 series.lnk = ?
                            O4 - Global Startup: hpoddt01.exe.lnk = ?
                            O4 - Global Startup: lancement rapide d'adobe reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                            O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                            O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll/search.htm
                            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                            O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/229?ef0ae8d6565046acaad4cc231c9bb2de
                            O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/230?ef0ae8d6565046acaad4cc231c9bb2de
                            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
                            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
                            O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                            O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                            O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                            O9 - Extra button: Alice ADSL - {F6DBA347-A2A6-4455-9C32-21978E2D18D4} - https://portail.free.fr/ (file missing) (HKCU)
                            O14 - IERESET.INF: START_PAGE_URL=https://portail.free.fr/
                            O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
                            O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
                            O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
                            O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
                            O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
                            O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                            O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                            O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                            O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                            O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                            O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
                            O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
                            O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                            O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
                            O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
                            O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
                            O23 - Service: RTE : Partage TAPI (RTETAPIService) - RTE Software - c:\fotowin\RTETPISv.exe
                            O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

                            mais maintenant tout a bien l'air de fonctionner dans mon ordi.penses tu qu'il faut vraiment continuer à faire des manips? merci et à +
                            1. green day Modérateur
                              re

                              ok,

                              # Désactiver la Restauration du système

                              * Cliquez sur le bouton Démarrer.
                              * Cliquez avec le bouton droit de la souris sur Poste de travail puis cliquez sur Propriétés.
                              * Dans l'onglet Restauration du système, sélectionnez l'option Désactiver la Restauration du système ou Désactiver la Restauration du système sur tous les lecteurs

                              ( tu pourras la réactivé à la fin de la manip )

                              # Relance HijackThis : choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked" :

                              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC

                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aliceadsl.fr
                              R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://portail.free.fr/
                              R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/ (obfuscated)
                              R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

                              O2 - BHO: (no name) - {36645342-9475-2663-166A-466739207346} - (no file)
                              O2 - BHO: (no name) - {F7C7AA47-BCA6-451D-8DBC-C10A8F75C8C7} - (no file)

                              O3 - Toolbar: (no name) - {9839B3B7-3F99-4498-884D-6CFCCD251AB1} - (no file)

                              O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

                              O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                              O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
                              O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
                              O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
                              O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

                              O4 - HKCU\..\Run: [Ldm] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                              O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                              O4 - Startup: Aide mémoire.lnk = ?
                              O4 - Global Startup: hp psc 1000 series.lnk = ?
                              O4 - Global Startup: hpoddt01.exe.lnk = ?
                              O4 - Global Startup: lancement rapide d'adobe reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

                              O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll/search.htm
                              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                              O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/229?ef0ae8d6565046acaad4cc231c9bb2de
                              O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\MSN Toolbar
                              Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/230?ef0ae8d6565046acaad4cc231c9bb2de

                              O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
                              O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
                              O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab

                              O18 - Protocol: bw+0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw+0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw-0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw-0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw00 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw00s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw10 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw10s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw20 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw20s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw30 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw30s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw40 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw40s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw50 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw50s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw60 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw60s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw70 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw70s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw80 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw80s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw90 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw90s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwa0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwa0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwb0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwb0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwc0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwc0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwd0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwd0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwe0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwe0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwf0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwf0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                              O18 - Protocol: bwg0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwg0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwh0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwh0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwi0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwi0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwj0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwj0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwk0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwk0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwl0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwl0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwm0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwm0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwn0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwn0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwo0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwo0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwp0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwp0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwq0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwq0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwr0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwr0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bws0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bws0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwt0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwt0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwu0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwu0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwv0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwv0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bww0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bww0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwx0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwx0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwy0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwy0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwz0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwz0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

                              O18 - Protocol: offline-8876480 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

                              ensuite, télécharge et execute ceci :

                              * CleanUp40 (qui élimine les fichiers temporaires + cookies : gratuit )
                              http://pageperso.aol.fr/Balltrap34/CleanUp40.exe

                              tuto : (merci à Balltrap) http://pageperso.aol.fr/balltrap34/democleanup.htm

                              * Ccleaner : Telecharge et installe ceci, dans la colonne de gauche clique sur "erreurs" coche toute les cases, puis clique en bas sur "chercher des erreurs" une fois finit, clique sur "reparer les erreurs" et tu aura un message pour sauvegarder ta base de registre tu dis "oui" puis tu recommences jusqu'a ce qu'il te trouve plus d'erreurs .

                              *Relance Ccleaner ,vas dans l'onglet "nettoyeur" present sur la gauche, decoche la derniere case (Avancé si elle
                              est cochée) puis clique sur "lancer le nettoyage"

                              ccleaner

                              tuto: https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php

                              ensuite, reposte un nouveau hijackthis, et precise tes soucis s'il en reste

                              @+

                              La sagesse, c'est d'avoir des rêves suffisamment grands pour ne pas les
                              perdre de vue lorsqu'on les poursuit. (Oscar Wilde)
                              1. nad43 Auteur
                                salut!
                                voici le rapport smitfraudfix:
                                SmitFraudFix v2.142

                                Rapport fait à 21:02:47,50, 17/02/2007
                                Executé à partir de C:\Documents and Settings\Nadege\Bureau\SmitfraudFix
                                OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                                Le type du système de fichiers est NTFS
                                Fix executé en mode normal

                                »»»»»»»»»»»»»»»»»»»»»»»» hosts

                                »»»»»»»»»»»»»»»»»»»»»»»» C:\

                                »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

                                »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

                                »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

                                »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

                                »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

                                »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Nadege

                                »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Nadege\Application Data

                                »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

                                »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Nadege\Favoris

                                »»»»»»»»»»»»»»»»»»»»»»»» Bureau

                                »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

                                »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

                                »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

                                [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
                                "Source"="About:Home"
                                "SubscribedURL"="About:Home"
                                "FriendlyName"="Ma page d'accueil"

                                »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
                                !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                SrchSTS.exe by S!Ri
                                Search SharedTaskScheduler's .dll

                                »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
                                !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
                                "AppInit_DLLs"=""

                                »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
                                !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
                                "System"="lsass.exe"

                                »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32

                                »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

                                »»»»»»»»»»»»»»»»»»»»»»»» Fin

                                par contre pour blacklight ça ne m'a pas donné de rapport sur le bureau, mais à la fin du scan il y avait ecrit:
                                summary
                                hidden items found 0
                                items queued for renaming 0
                                voilà, à toi de jouer!!! et merci encore...
                                1. green day Modérateur
                                  Salut

                                  # Télécharge ceci: (merci a S!RI pour ce petit programme).

                                  http://siri.urz.free.fr/Fix/SmitfraudFix.zip

                                  Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1,
                                  voila a quoi cela ressemble : http://siri.urz.free.fr/Fix/SmitfraudFix.php
                                  il va générer un rapport : copie/colle le sur le poste stp.

                                  Télécharge Blacklight (de F-Secure) :

                                  https://europe.f-secure.com/exclude/blacklight/index.shtml

                                  et sauvegarde le sur ton Bureau.

                                  Double-clique blbeta.exe et accepte la licence ;clique Scan puis Next

                                  Tu verras une liste de fichiers détectés apparaître. Tu verras également un rapport, sur ton Bureau, nommé fsbl.xxxxxxx.log (les xxxxxxx sont des chiffres).

                                  Copie et colle le contenu de ce rapport dans ta prochaine réponse

                                  ++
                                  1. nad43 Auteur
                                    voilà le rapport:
                                    Logfile of HijackThis v1.99.1
                                    Scan saved at 05:04:00, on 16/02/2007
                                    Platform: Windows XP SP2 (WinNT 5.01.2600)
                                    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                                    Running processes:
                                    C:\WINDOWS\System32\smss.exe
                                    C:\WINDOWS\system32\winlogon.exe
                                    C:\WINDOWS\system32\services.exe
                                    C:\WINDOWS\system32\lsass.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\WINDOWS\System32\svchost.exe
                                    C:\WINDOWS\system32\spoolsv.exe
                                    C:\WINDOWS\Explorer.EXE
                                    C:\Program Files\MessengerPlus! 3\MsgPlus.exe
                                    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                                    C:\WINDOWS\SOUNDMAN.EXE
                                    C:\Program Files\QuickTime\qttask.exe
                                    C:\WINDOWS\system32\LVCOMSX.EXE
                                    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                                    C:\Program Files\Messenger\msmsgs.exe
                                    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                                    C:\Program Files\MSN Messenger\msnmsgr.exe
                                    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
                                    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
                                    C:\Program Files\Aide mémoire\TrayIcon.exe
                                    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                    C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
                                    C:\PROGRA~1\INCRED~1\bin\IMApp.exe
                                    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                                    C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
                                    C:\WINDOWS\System32\nvsvc32.exe
                                    c:\fotowin\RTETPISv.exe
                                    C:\WINDOWS\system32\slserv.exe
                                    C:\WINDOWS\System32\svchost.exe
                                    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
                                    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
                                    C:\WINDOWS\system32\wuauclt.exe
                                    C:\WINDOWS\System32\HPZipm12.exe
                                    C:\WINDOWS\system32\wscntfy.exe
                                    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                    C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
                                    C:\Program Files\Internet Explorer\iexplore.exe
                                    C:\Documents and Settings\Nadege\Bureau\hijackthis\HijackThis.exe

                                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://portail.free.fr/
                                    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://portail.free.fr/
                                    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?product=ssearch&src_id=354&client_id=689E0F1001C6979801AA406C&version=4.2.0.0&it=1151158396&loc=&qry=&url=http://www.google.com (obfuscated)
                                    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
                                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
                                    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;127.0.0.1;chazot
                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
                                    O2 - BHO: (no name) - {36645342-9475-2663-166A-466739207346} - (no file)
                                    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                                    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                    O2 - BHO: Barre d'outils MSN Search Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
                                    O2 - BHO: (no name) - {F7C7AA47-BCA6-451D-8DBC-C10A8F75C8C7} - (no file)
                                    O3 - Toolbar: Barre d'outils MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
                                    O3 - Toolbar: (no name) - {9839B3B7-3F99-4498-884D-6CFCCD251AB1} - (no file)
                                    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
                                    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
                                    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                                    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                                    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                                    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
                                    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
                                    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
                                    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                                    O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
                                    O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
                                    O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
                                    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                                    O4 - HKCU\..\Run: [UpdateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
                                    O4 - HKCU\..\Run: [Ldm] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                                    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                                    O4 - Startup: Aide mémoire.lnk = ?
                                    O4 - Global Startup: hp psc 1000 series.lnk = ?
                                    O4 - Global Startup: hpoddt01.exe.lnk = ?
                                    O4 - Global Startup: lancement rapide d'adobe reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                                    O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll/search.htm
                                    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                                    O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/229?ef0ae8d6565046acaad4cc231c9bb2de
                                    O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/230?ef0ae8d6565046acaad4cc231c9bb2de
                                    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                                    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                                    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                    O9 - Extra button: Alice ADSL - {F6DBA347-A2A6-4455-9C32-21978E2D18D4} - https://portail.free.fr/ (file missing) (HKCU)
                                    O14 - IERESET.INF: START_PAGE_URL=https://portail.free.fr/
                                    O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
                                    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
                                    O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
                                    O18 - Protocol: bw+0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw+0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw-0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw-0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw00 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw00s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw10 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw10s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw20 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw20s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw30 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw30s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw40 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw40s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw50 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw50s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw60 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw60s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw70 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw70s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw80 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw80s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw90 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw90s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwa0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwa0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwb0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwb0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwc0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwc0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwd0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwd0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwe0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwe0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwf0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwf0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                                    O18 - Protocol: bwg0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwg0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwh0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwh0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwi0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwi0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwj0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwj0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwk0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwk0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwl0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwl0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwm0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwm0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwn0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwn0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwo0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwo0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwp0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwp0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwq0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwq0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwr0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwr0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bws0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bws0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwt0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwt0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwu0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwu0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwv0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwv0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bww0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bww0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwx0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwx0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwy0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwy0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwz0 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwz0s - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                                    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                                    O18 - Protocol: offline-8876480 - {5C4AF1DE-F646-41D3-B061-0DB53D4C4B6B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
                                    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
                                    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                                    O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
                                    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
                                    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
                                    O23 - Service: RTE : Partage TAPI (RTETAPIService) - RTE Software - c:\fotowin\RTETPISv.exe
                                    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

                                    j'espere que celà va te servir...en tout cas maintenent au demarrage je n'ai plus le message d'alerte d'avast me disant qu'il y à un virus sur mon ordi!!...peut etre que mon probleme à ete resolu? par contre il mets beaucoup plus de tems à redemarer,peut etre est ce du au fait qu'avec toutes les manipulations que j'ai faites afin de me debarrasser de ce virus je me trouve avec un ordi rempli de logiciels anti virus ( voici la liste: avast, kerio personnal firewall, regcleaner, ccleaner, hijackthis, diaghelp et spybot search & destroy) que penses tu de ma situation? suis je bien liberer de ce virus? que me conseilles tu afin de resoudre ce probleme de temps au demarrage? en tous cas merci beaucoup de ton aide.
                                    • 1
                                    • 2

                                    Discussions similaires

                                    Problème avec "PUADIManager:Win32/OfferCore
                                    Knaki

                                    3 réponses
                                    PUADlManager:Win32/OfferCore
                                    tenmalade

                                    2 réponses
                                    PUADlManager:Win32/OfferCore
                                    bernardarrad

                                    3 réponses
                                    Pb Windows 7, .EXE n'est pas app win32 valide
                                    Witeric

                                    15 réponses
                                    PUA:Win32/InstallCore detecté par windows sécurité
                                    thetib

                                    11 réponses