Win32/Rustock.gen!C ......HELP ME

Matt -  
Bonjour à tous,

Petit problème avec mon pc. Lorsque je démarre en mode normal, Windows m'indique que je suis infecté par Win32/Rustock.gen!C . Le pc reboot ensuite. J'ai essayé de supprimer le virus en mode sans echec mais impossible. J'utilise spysweeper et bitdefender mais il ne détecte rien du tout.......
PLEASE HELP ME ............................Que puis je faire????????
PS : je suis pas un pro de l'informatique.....Lol
Configuration: Windows XP
Internet Explorer 7.0

15 réponses

  1. papyber Contributeur sécurité
    si tout va bien supprime tout ce qu'on a utilisé car ce ne sera plus utile désormais
    conserve néanmoins ccleaner et effectue le nettoyage tous les jours avant de couper le PC

    installe ce logiciel très utile et scanne ton PC avec une fois par semaine au moins...
    AVG Antispyware
    https://www.avg.com/en-ww/free-antivirus-download

    mode d'utilisation :
    Lance AVG Anti-Spyware, mets le à jour,
    Clique sur le bouton « Analyse »
    Puis « Comment réagir », clique sur Actions recommandées. Sélectionne Quarantaine.
    Retour à l'onglet Analyse.
    Clique sur Analyse complète du système.
    A la fin du scan, choisis " Appliquer toutes les actions "
    Clique sur "Enregistrer le rapport". Le fichier texte se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware.
    ne laisse pas le résident car à la fin de la période d'essai, tu ne pourras plus t'en servir mais tu pourras toujours faire les mises à jour avant de scanner

    tu peux le coupler avec celui-ci
    spybot search and destroy
    https://www.safer-networking.org/?page=download

    défragmente

    pense à bien te protéger
    j'ai découvert ce lien qui est plutôt pas mal à ce sujet
    https://forum.pcastuces.com/default.asp

    et bon surf
    1. Matt
      BitDefender Online Scanner

      Rapport d'analyse généré à: Sun, Apr 15, 2007 - 00:23:41

      Voie d'analyse: A:\;C:\;D:\;

      Statistiques

      Temps
      01:38:45

      Fichiers
      268088

      Directoires
      5054

      Secteurs de boot
      2

      Archives
      1607

      Paquets programmes
      29352

      Résultats

      Virus identifiés
      0

      Fichiers infectés
      0

      Fichiers suspects
      0

      Avertissements
      0

      Désinfectés
      0

      Fichiers effacés
      0

      Info sur les moteurs

      Définition virus
      485970

      Version des moteurs
      AVCORE v1.0 (build 2397) (i386) (Feb 8 2007 14:24:08)

      Analyse des plugins
      14

      Archive des plugins
      38

      Unpack des plugins
      6

      E-mail plugins
      6

      Système plugins
      1

      Paramètres d'analyse

      Première action
      Désinfecté

      Seconde Action
      Supprimé

      Heuristique
      Oui

      Acceptez les avertissements
      Oui

      Extensions analysées
      *;

      Excludez les extensions

      Analyse d'emails
      Oui

      Analyse des Archives
      Oui

      Analyser paquets programmes
      Oui

      Analyse des fichiers
      Oui

      Analyse de boot
      Oui

      Fichier analysé
      Statut

      Aucun virus trouvé.
      1. papyber Contributeur sécurité
        faire un scan antivirus en ligne avec internet explorer et accepter l'activex
        poster le rapport ici ensuite
        https://www.bitdefender.fr/

        En bas, à gauche de la fenêtre, clique sur BitDefender SCAN ONLINE
        Dans la nouvelle fenêtre, clique sur I agree
        La fenêtre change encore, clique sur Click here to scan
        Les signatures se chargent, etc.

        tuto en image
        http://pageperso.aol.fr/rginformatique/mapage/defender.htm
        à demain
        1. Matt
          Voici le rapport genproc :

          Rapport GenProc 0.40 effectué le ven. 13/04/2007 à 21:34:17,40 - SystemRoot = C:\WINDOWS

          Dans CCleaner, clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Par la suite, laisse-le avec ses réglages par défaut. C'est tout.

          # Etape 1/ Télécharge :

          - Purity.zip http://www.alt-shift-return.org/Info/Fichiers/Purity.zip et décompresse-le sur le bureau.

          ***** Copie ce qui suit dans un fichier texte et redémarre en mode sans échec comme indiqué ici https://docs.microsoft.com/en-us/?mfr=true (choisis ta session courante "Administrateur.PC") *****

          # Etape 2/

          Double-clique sur le fichier Purity.bat qui se trouve dans le dossier Purity, sur ton bureau, et patiente.

          # Etape 3/

          Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout.

          # Etape 4/

          Redémarre normalement et poste :
          - Un nouveau rapport HijackThis, toutes fenêtres et applications fermées si tu ne l'as pas tu trouveras HijackThis ici http://www.trendsecure.com/portal/en-US/threat_analytics/HiJackThis_v2.exe ;
          - Le contenu du rapport Purity.txt situé dans le dossier Purity, sur ton Bureau ;

          Précise les difficultés que tu as eu (ce que tu n'as pas pu faire...) ainsi que l'évolution de la situation.

          Le rapport purity :

          fix lancé en mode sans echec
          Rapport Purity 0.01 effectué le ven. 13/04/2007 à 21:45:03,34
          Liste des éléments rencontrés au cours de la Recherche...

          "C:\Documents and Settings\Administrateur.PC\Application Data\CROSOF~1.NET"
          "C:\Documents and Settings\Administrateur.PC\Application Data\FNTS~1"
          "C:\Documents and Settings\Administrateur.PC\Application Data\PPATCH~1"
          "C:\Documents and Settings\Administrateur.PC\Application Data\SMBOLS~1"
          "C:\Documents and Settings\Administrateur.PC\Application Data\YMBOLS~1"
          "C:\Documents and Settings\Administrateur.PC\Application Data\RACLE~1"
          "C:\Documents and Settings\Administrateur.PC\Application Data\DOBE~1"
          "C:\Documents and Settings\Administrateur.PC\Application Data\MCROSO~1"
          "C:\Documents and Settings\Administrateur.PC\Application Data\SSTEM3~1"
          "C:\Documents and Settings\Administrateur.PC\Application Data\ASEMBL~1"
          "C:\Documents and Settings\Administrateur.PC\Application Data\SCURIT~1"
          "C:\Documents and Settings\Administrateur.PC\Application Data\SKS~1"
          "C:\Documents and Settings\Administrateur.PC\Application Data\STEM32~1"
          "C:\Documents and Settings\Administrateur.PC\Application Data\PPPATC~1"
          "C:\Documents and Settings\Administrateur.PC\Application Data\TSKS~1"
          "C:\Program Files\APPATC~1"
          "C:\Program Files\ASEMBL~1"
          C:\Program Files\DOBE~1
          C:\Program Files\FNTS~1
          C:\Program Files\MCROSO~1.NET
          C:\Program Files\SMBOLS~1
          C:\Program Files\stem32~1
          C:\Program Files\YSTEM~1
          C:\Program Files\RACLE~1
          C:\Program Files\ASKS~1
          C:\Program Files\WNSXS~1
          C:\Program Files\CROSOF~1
          C:\Program Files\YSTEM3~1
          C:\Program Files\SEMBLY~1
          C:\Program Files\SSEMBL~1
          C:\Program Files\SKS~1
          C:\Program Files\MBOLS~1
          C:\Program Files\MANTEC~1
          C:\WINDOWS\CROSOF~1.NET
          C:\WINDOWS\MANTEC~1
          C:\WINDOWS\MBOLS~1
          C:\WINDOWS\YMBOLS~1
          C:\WINDOWS\RACLE~1
          C:\WINDOWS\SSTEM3~1
          C:\WINDOWS\STEM~1
          C:\WINDOWS\DOBE~1
          C:\WINDOWS\ICROSO~1
          C:\WINDOWS\SEMBLY~1
          C:\WINDOWS\PPATCH~1
          C:\WINDOWS\FNTS~1
          C:\WINDOWS\WNSXS~1
          C:\WINDOWS\SMBOLS~1
          C:\WINDOWS\SSEMBL~1
          C:\WINDOWS\ASEMBL~1
          C:\WINDOWS\system32\CROSOF~1.NET
          C:\WINDOWS\system32\FNTS~1
          C:\WINDOWS\system32\PPATCH~1
          C:\WINDOWS\system32\SSTEM3~1
          C:\WINDOWS\system32\WNSXS~1
          C:\WINDOWS\system32\YSTEM3~1
          C:\WINDOWS\system32\YSTEM~1
          C:\WINDOWS\system32\MANTEC~1
          C:\WINDOWS\system32\SMBOLS~1
          C:\WINDOWS\system32\ASKS~1
          C:\WINDOWS\system32\SCURIT~1
          C:\WINDOWS\system32\DOBE~1
          C:\WINDOWS\system32\SMANTE~1
          C:\WINDOWS\system32\CROSOF~1
          C:\WINDOWS\system32\YMANTE~1
          C:\WINDOWS\system32\SSEMBL~1
          C:\WINDOWS\system32\STEM~1
          C:\WINDOWS\system32\RACLE~1
          C:\WINDOWS\system32\YMBOLS~1
          C:\WINDOWS\system32\STEM32~1

          Fin du rapport

          Logfile of HijackThis v1.99.1
          Scan saved at 21:50:56, on 13/04/2007
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\system32\spoolsv.exe
          c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
          C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
          C:\Program Files\Softwin\BitDefender10\bdagent.exe
          C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
          C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
          C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
          C:\Program Files\Messenger\Msmsgs.exe
          C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
          C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
          C:\Program Files\Sitecom\Logiciel Bluetooth\bin\btwdins.exe
          C:\WINDOWS\system32\drivers\CDAC11BA.EXE
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
          C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
          C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
          C:\Program Files\Softwin\BitDefender10\vsserv.exe
          C:\Program Files\Hijackthis Version Française\hijackthis vf.exe
          C:\WINDOWS\system32\WgaTray.exe
          C:\WINDOWS\system32\wuauclt.exe

          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.fr.msn.be/0SEFRBE/SAOS01?FORM=TOOLBR
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.fr.msn.be/0SEFRBE/SAOS01?FORM=TOOLBR
          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
          R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.fr.msn.be/0SEFRBE/SAOS01?FORM=TOOLBR
          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
          O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
          O4 - HKLM\..\Run: [OM_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe"
          O4 - HKLM\..\Run: [LVCOMS] "C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE"
          O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
          O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
          O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
          O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
          O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
          O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
          O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\Msmsgs.exe" /background
          O4 - HKCU\..\Run: [OM_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" -NoStart
          O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
          O4 - Global Startup: GoBack.lnk = C:\Program Files\Roxio\GoBack\GBTray.exe
          O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
          O4 - Global Startup: Reset.lnk = C:\WINDOWS\repair\reset.bat
          O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
          O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie_ctx.htm
          O9 - Extra button: Popup Blocker - {0D555BC6-E331-48b3-A60E-AAC0DF79438A} - C:\WINDOWS\System32\shdocvw.dll
          O9 - Extra 'Tools' menuitem: Popup Blocker - {0D555BC6-E331-48b3-A60E-AAC0DF79438A} - C:\WINDOWS\System32\shdocvw.dll
          O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
          O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
          O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
          O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
          O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
          O18 - Protocol: offline-8876480 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll
          O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
          O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
          O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
          O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\Sitecom\Logiciel Bluetooth\bin\btwdins.exe
          O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
          O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe (file missing)
          O23 - Service: Symantec Password Validation (ccPwdSvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe (file missing)
          O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe (file missing)
          O23 - Service: GBPoll - Roxio, Inc. - C:\Program Files\Roxio\GoBack\GBPoll.exe
          O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
          O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
          O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
          O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Unknown owner - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe (file missing)
          O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)
          O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe (file missing)
          O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe (file missing)
          O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
          O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

          et le rapport Hijack :
          2. papyber Contributeur sécurité
            télécharge GenProc de Jean-Chretien1 et Narco4 sur ton bureau
            http://www.alt-shift-return.org/Info/Fichiers/GenProc.zip

            dézippe le dossier, double-clique sur GenProc.bat et poste le contenu du rapport qui s'ouvre

            Aide en images : http://www.alt-shift-return.org/Info/GenProc-HowTo.html
            1. Matt
              LOL.....Ca c'est un autre probleme.....Plus moyen d'ouvrir la fonction rechercher dans le menu démarrer. L'icone est bien là mais quand je clique dessus....rien.....
              1. papyber Contributeur sécurité
                fais une recherche windows avec
                norton
                symantec
                et supprime tout ce que tu trouves puis réessaie de fixer les lignes
                1. Matt
                  Salut,

                  Impossible de supprimer les résidus de Norton. Tous les fichiers Norton sont bien désactivés mais impossible de les supprimer avec Hijack. Je les coches pour les fixer ensuite mais ils reviennent au log suivant...................
                  1. papyber Contributeur sécurité
                    Démarrer "Exécuter…" puis Tape "services.msc" et valide par OK
                    la fenêtre des Services s'ouvre => vérifier dans la partie inférieure que l'onglet "Etendu" est bien sélectionné, sinon faites le.

                    - Dans la colonne "Nom", DOUBLE CLIQUE sur le service noté en GRAS ci dessus, pour faire apparaître "Propriétés".

                    cherche tout ce qui se rapporte à symantec ou norton
                    tu as les noms dans les 023

                    - Vérifie dans "Chemin d'accès des fichiers exécutables" qu'il s'agit bien de l'emplacement souligné.
                    - Puis clique sur Arrêter
                    - Dans le menu déroulant "Type de démarrage", sélectionne "Désactivé".
                    - valide la modification par OK
                    - Ferme la fenêtre des Services.

                    lance hijack pour un scan et coche les lignes suivantes

                    O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe (file missing)
                    O23 - Service: Symantec Password Validation (ccPwdSvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe (file missing)
                    O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe (file missing)
                    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Unknown owner - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe (file missing)
                    O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)
                    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe (file missing)
                    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe (file missing)

                    ferme toutes tes fenêtres y compris internet et clic sur fixer l'objet

                    si tout va bien supprime tout ce qu'on a utilisé car ce ne sera plus utile désormais
                    conserve néanmoins ccleaner et effectue le nettoyage tous les jours avant de couper le PC

                    installe toi un pare feu valable car tu n'en as pas

                    faire un scan antivirus en ligne avec internet explorer et accepter l'activex
                    poster le rapport ici ensuite
                    https://www.bitdefender.fr/

                    En bas, à gauche de la fenêtre, clique sur BitDefender SCAN ONLINE
                    Dans la nouvelle fenêtre, clique sur I agree
                    La fenêtre change encore, clique sur Click here to scan
                    Les signatures se chargent, etc.

                    tuto en image
                    http://pageperso.aol.fr/rginformatique/mapage/defender.htm
                    1. Matt
                      Voila le rapport hijack.....Pour Norton je pense pas que la manip ai réussie. Pour info, cela fait longtemps que je l'ai désinstallé mais il reste quelque trace..J'ai quand même pu installer un autre anti-virus. En ce moment le pc tourne beaucoup mieux mais un peu lent par moment..

                      Logfile of HijackThis v1.99.1
                      Scan saved at 21:43:35, on 11/04/2007
                      Platform: Windows XP SP2 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\WINDOWS\system32\spoolsv.exe
                      c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
                      C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
                      C:\Program Files\Softwin\BitDefender10\bdagent.exe
                      C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
                      C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                      C:\Program Files\Messenger\Msmsgs.exe
                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                      C:\Program Files\Sitecom\Logiciel Bluetooth\bin\btwdins.exe
                      C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
                      C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
                      C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
                      C:\Program Files\Internet Explorer\IEXPLORE.EXE
                      C:\Program Files\Softwin\BitDefender10\vsserv.exe
                      C:\WINDOWS\system32\WgaTray.exe
                      C:\WINDOWS\system32\wuauclt.exe
                      C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.fr.msn.be/0SEFRBE/SAOS01?FORM=TOOLBR
                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.fr.msn.be/0SEFRBE/SAOS01?FORM=TOOLBR
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
                      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.fr.msn.be/0SEFRBE/SAOS01?FORM=TOOLBR
                      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                      O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                      O4 - HKLM\..\Run: [OM_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe"
                      O4 - HKLM\..\Run: [LVCOMS] "C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE"
                      O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
                      O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
                      O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
                      O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
                      O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
                      O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\Msmsgs.exe" /background
                      O4 - HKCU\..\Run: [OM_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" -NoStart
                      O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                      O4 - Global Startup: GoBack.lnk = C:\Program Files\Roxio\GoBack\GBTray.exe
                      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                      O4 - Global Startup: Reset.lnk = C:\WINDOWS\repair\reset.bat
                      O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                      O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie_ctx.htm
                      O9 - Extra button: Popup Blocker - {0D555BC6-E331-48b3-A60E-AAC0DF79438A} - C:\WINDOWS\System32\shdocvw.dll
                      O9 - Extra 'Tools' menuitem: Popup Blocker - {0D555BC6-E331-48b3-A60E-AAC0DF79438A} - C:\WINDOWS\System32\shdocvw.dll
                      O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
                      O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
                      O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                      O18 - Protocol: offline-8876480 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll
                      O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                      O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                      O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
                      O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\Sitecom\Logiciel Bluetooth\bin\btwdins.exe
                      O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                      O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe (file missing)
                      O23 - Service: Symantec Password Validation (ccPwdSvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe (file missing)
                      O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe (file missing)
                      O23 - Service: GBPoll - Roxio, Inc. - C:\Program Files\Roxio\GoBack\GBPoll.exe
                      O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
                      O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
                      O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
                      O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Unknown owner - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe (file missing)
                      O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)
                      O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe (file missing)
                      O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe (file missing)
                      O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
                      O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
                      1. papyber Contributeur sécurité
                        kaspersky et symantec-norton, il te faut les désinstaller proprement
                        voici des liens pour t'aider

                        https://antivirus-france.com/telechargements/

                        Pour désinstaller votre logiciel anti-virus ou vérifier qu'il est bien désinstallé, contactez l'assistance technique de l'éditeur.Pour les produits Kaspersky :

                        *

                        Désinstaller Kaspersky Anti-Virus 4.x :
                        http://support.kaspersky.fr/index.php?ShowID=9
                        *

                        Désinstaller Kaspersky Anti-Virus 5.0.x :
                        http://support.kaspersky.fr/index.php?ShowID=257
                        *

                        Installation et désinstallation de Kaspersky Anti-Virus Personal Pro 5.0.x :
                        http://support.kaspersky.fr/index.php?ShowID=443

                        En cas de souci (Usage d'un cleaner) :

                        *

                        Désinstallation de Kaspersky Anti-Virus Personal Pro 5.0.x :
                        http://support.kaspersky.fr/index.php?ShowID=543
                        *

                        Désinstallation de Kaspersky Anti-Virus 3.x :
                        Télécharger le cleaner (désinstalleur) à cette adresse :
                        http://support.kaspersky.fr/download/KavPersonal/RemoveKAV3.zip
                        *

                        Désinstallation de Kaspersky Anti-Virus 4.x :
                        Télécharger le cleaner à cette adresse :
                        http://support.kaspersky.fr/download/Tools/RegClean4x.exe

                        pour norton
                        https://www.pcastuces.com/newsletter/adj/1630.htm

                        http://speedweb1.free.fr/frames2.php?page=divers3

                        quand cela sera fait tu me reposte un hijack afin de finir la désinfection
                        comment va le PC?
                        1. Matt@
                          Bonjour,

                          Je n'utilise pas symantec comme pare-feu.J'ai effectivement installé un programme symantec dans le passé mais je n'ai jamais pu le désinstaller completement. Idem pour Kaspersky (version demo de l'antivirus).

                          Voici le nouveau rapport Hijack :

                          Logfile of HijackThis v1.99.1
                          Scan saved at 12:18:29, on 11/04/2007
                          Platform: Windows XP SP2 (WinNT 5.01.2600)
                          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                          Running processes:
                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\system32\spoolsv.exe
                          c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
                          C:\WINDOWS\Explorer.EXE
                          C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                          C:\Program Files\Sitecom\Logiciel Bluetooth\bin\btwdins.exe
                          C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                          C:\Program Files\Unlocker\UnlockerAssistant.exe
                          C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
                          C:\Program Files\Softwin\BitDefender10\bdagent.exe
                          C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
                          C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
                          C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                          C:\Program Files\Messenger\Msmsgs.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
                          C:\Program Files\Logitech\SetPoint\KEM.exe
                          C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
                          C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
                          C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
                          C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
                          C:\Program Files\Softwin\BitDefender10\vsserv.exe
                          C:\WINDOWS\system32\wscntfy.exe
                          C:\WINDOWS\system32\WgaTray.exe
                          C:\WINDOWS\system32\wuauclt.exe
                          C:\Program Files\Internet Explorer\IEXPLORE.EXE
                          C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

                          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.fr.msn.be/0SEFRBE/SAOS01?FORM=TOOLBR
                          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.fr.msn.be/0SEFRBE/SAOS01?FORM=TOOLBR
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
                          R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.fr.msn.be/0SEFRBE/SAOS01?FORM=TOOLBR
                          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                          O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                          O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                          O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
                          O4 - HKLM\..\Run: [OM_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe"
                          O4 - HKLM\..\Run: [LVCOMS] "C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE"
                          O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
                          O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
                          O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
                          O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
                          O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
                          O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                          O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\Msmsgs.exe" /background
                          O4 - HKCU\..\Run: [OM_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" -NoStart
                          O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                          O4 - Global Startup: GoBack.lnk = C:\Program Files\Roxio\GoBack\GBTray.exe
                          O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                          O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
                          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                          O4 - Global Startup: Reset.lnk = C:\WINDOWS\repair\reset.bat
                          O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                          O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie_ctx.htm
                          O9 - Extra button: Popup Blocker - {0D555BC6-E331-48b3-A60E-AAC0DF79438A} - C:\WINDOWS\System32\shdocvw.dll
                          O9 - Extra 'Tools' menuitem: Popup Blocker - {0D555BC6-E331-48b3-A60E-AAC0DF79438A} - C:\WINDOWS\System32\shdocvw.dll
                          O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
                          O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
                          O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                          O18 - Protocol: offline-8876480 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                          O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll
                          O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                          O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
                          O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                          O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
                          O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\Sitecom\Logiciel Bluetooth\bin\btwdins.exe
                          O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                          O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe (file missing)
                          O23 - Service: Symantec Password Validation (ccPwdSvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe (file missing)
                          O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe (file missing)
                          O23 - Service: GBPoll - Roxio, Inc. - C:\Program Files\Roxio\GoBack\GBPoll.exe
                          O23 - Service: Kaspersky Anti-Virus Service (KLBLMain) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\kavmm.exe" -run bl -n PersonalPro -v 5.0.0.0 -ttsr 10000000 (file missing)
                          O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
                          O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
                          O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
                          O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Unknown owner - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe (file missing)
                          O23 - Service: SAVScan - Unknown owner - C:\Program Files\Norton AntiVirus\SAVScan.exe (file missing)
                          O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)
                          O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe (file missing)
                          O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe (file missing)
                          O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
                          O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
                          O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
                          O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

                          Le rapport avenger :

                          Logfile of The Avenger version 1, by Swandog46
                          Running from registry key:
                          \Registry\Machine\System\CurrentControlSet\Services\srghrnnf

                          *******************

                          Script file located at: \??\C:\Documents and Settings\emjvmtkl.txt
                          Script file opened successfully.

                          Script file read successfully

                          Backups directory opened successfully at C:\Avenger

                          *******************

                          Beginning to process script file:

                          Driver PE386 unloaded successfully.
                          Program C:\Rustbfix\2run.bat successfully set up to run once on reboot.

                          Completed script processing.

                          *******************

                          Finished! Terminate.

                          et pour finir le rapport pelog :

                          ************************* Rustock.b-fix -- By ejvindh *************************
                          mer. 11/04/2007 12:06:02,00

                          ******************* Pre-run Status of system *******************

                          Rootkit driver PE386 is found. Starting the unload-procedure....

                          Rustock.b-ADS attached to the System32-folder:
                          :lzx32.sys 79514
                          Total size: 79514 bytes.
                          Attempting to remove ADS...
                          system32: deleted 79514 bytes in 1 streams.

                          Looking for Rustock.b-files in the System32-folder:
                          No Rustock.b-files found in system32

                          ******************* Post-run Status of system *******************

                          Rustock.b-driver on the system: NONE!

                          Rustock.b-ADS attached to the System32-folder:
                          No System32-ADS found.

                          Looking for Rustock.b-files in the System32-folder:
                          No Rustock.b-files found in system32

                          ******************************* End of Logfile ********************************
                          1. papyber Contributeur sécurité
                            as tu un pare feu? est-ce symantec?
                            je vois que tu as SDfix, tu l'as passé? quand? supprime le il n'est surement plus à jour
                            lance hijack pour un scan et coche les lignes suivantes

                            R3 - URLSearchHook: (no name) - {CB2B701A-CFDA-D855-FFED-96FBFE6524B0} - (no file)

                            O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                            O2 - BHO: OsbornTech Popup Blocker - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - C:\Program Files\Omniquad Total Security\PopupBlocker\PopupBlocker.dll (file missing)
                            O4 - HKLM\..\Run: [SDFix] C:\Documents and Settings\Administrateur.PC\Mes documents\Mes images\audi a4 break\SDFix\RunThis.bat /second
                            O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
                            O18 - Protocol: bw+0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw+0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw-0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw-0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw00 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw00s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw10 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw10s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw20 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw20s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw30 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw30s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw40 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw40s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw50 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw50s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw60 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw60s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw70 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw70s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw80 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw80s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw90 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw90s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwa0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwa0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwb0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwb0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwc0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwc0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwd0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwd0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwe0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwe0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwf0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwf0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                            O18 - Protocol: bwg0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwg0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwh0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwh0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwi0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwi0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwj0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwj0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwk0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwk0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwl0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwl0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwm0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwm0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwn0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwn0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwo0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwo0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwp0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwp0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwq0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwq0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwr0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwr0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bws0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bws0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwt0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwt0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwu0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwu0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwv0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwv0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bww0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bww0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwx0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwx0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwy0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwy0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwz0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwz0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

                            O20 - Winlogon Notify: winayt32 - winayt32.dll (file missing)

                            ferme toutes tes fenêtres y compris internet et clic sur fixer l'objet

                            télécharge GenProc de Jean-Chretien1 et Narco4 sur ton bureau
                            http://www.alt-shift-return.org/Info/Fichiers/GenProc.zip

                            dézippe le dossier, double-clique sur GenProc.bat et poste le contenu du rapport qui s'ouvre

                            Aide en images : http://www.alt-shift-return.org/Info/GenProc-HowTo.html
                            1. matt@
                              Bonsoir,

                              Voila pour le rapport hijack :

                              Logfile of HijackThis v1.99.1
                              Scan saved at 23:29:16, on 10/04/2007
                              Platform: Windows XP SP2 (WinNT 5.01.2600)
                              MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                              Running processes:
                              C:\WINDOWS\System32\smss.exe
                              C:\WINDOWS\system32\winlogon.exe
                              C:\WINDOWS\system32\services.exe
                              C:\WINDOWS\system32\lsass.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\System32\svchost.exe
                              C:\WINDOWS\system32\spoolsv.exe
                              c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
                              C:\WINDOWS\Explorer.EXE
                              C:\Program Files\Sitecom\Logiciel Bluetooth\bin\btwdins.exe
                              C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                              C:\WINDOWS\System32\svchost.exe
                              C:\Program Files\Unlocker\UnlockerAssistant.exe
                              C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
                              C:\Program Files\Softwin\BitDefender10\bdagent.exe
                              C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
                              C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
                              C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
                              C:\Program Files\Messenger\Msmsgs.exe
                              C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
                              C:\Program Files\Internet Explorer\IEXPLORE.EXE
                              C:\WINDOWS\system32\dwwin.exe
                              C:\WINDOWS\system32\wscntfy.exe
                              C:\WINDOWS\system32\wuauclt.exe
                              C:\WINDOWS\system32\WgaTray.exe
                              C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                              C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
                              C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
                              C:\Program Files\Softwin\BitDefender10\vsserv.exe
                              C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

                              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.fr.msn.be/0SEFRBE/SAOS01?FORM=TOOLBR
                              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.fr.msn.be/0SEFRBE/SAOS01?FORM=TOOLBR
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
                              R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.fr.msn.be/0SEFRBE/SAOS01?FORM=TOOLBR
                              R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                              R3 - URLSearchHook: (no name) - {CB2B701A-CFDA-D855-FFED-96FBFE6524B0} - (no file)
                              O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                              O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                              O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                              O2 - BHO: OsbornTech Popup Blocker - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - C:\Program Files\Omniquad Total Security\PopupBlocker\PopupBlocker.dll (file missing)
                              O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                              O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
                              O4 - HKLM\..\Run: [OM_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe"
                              O4 - HKLM\..\Run: [LVCOMS] "C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE"
                              O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
                              O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
                              O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
                              O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
                              O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
                              O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
                              O4 - HKLM\..\Run: [SDFix] C:\Documents and Settings\Administrateur.PC\Mes documents\Mes images\audi a4 break\SDFix\RunThis.bat /second
                              O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                              O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\Msmsgs.exe" /background
                              O4 - HKCU\..\Run: [OM_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" -NoStart
                              O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                              O4 - Global Startup: GoBack.lnk = C:\Program Files\Roxio\GoBack\GBTray.exe
                              O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                              O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
                              O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                              O4 - Global Startup: Reset.lnk = C:\WINDOWS\repair\reset.bat
                              O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                              O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie_ctx.htm
                              O9 - Extra button: Popup Blocker - {0D555BC6-E331-48b3-A60E-AAC0DF79438A} - C:\WINDOWS\System32\shdocvw.dll
                              O9 - Extra 'Tools' menuitem: Popup Blocker - {0D555BC6-E331-48b3-A60E-AAC0DF79438A} - C:\WINDOWS\System32\shdocvw.dll
                              O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
                              O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
                              O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
                              O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                              O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                              O18 - Protocol: bw+0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw+0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw-0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw-0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw00 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw00s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw10 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw10s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw20 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw20s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw30 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw30s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw40 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw40s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw50 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw50s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw60 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw60s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw70 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw70s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw80 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw80s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw90 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bw90s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwa0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwa0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwb0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwb0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwc0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwc0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwd0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwd0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwe0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwe0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwf0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwf0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                              O18 - Protocol: bwg0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwg0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwh0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwh0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwi0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwi0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwj0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwj0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwk0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwk0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwl0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwl0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwm0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwm0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwn0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwn0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwo0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwo0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwp0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwp0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwq0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwq0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwr0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwr0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bws0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bws0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwt0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwt0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwu0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwu0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwv0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwv0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bww0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bww0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwx0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwx0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwy0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwy0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwz0 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: bwz0s - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                              O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                              O18 - Protocol: offline-8876480 - {46B75B4E-39C5-4FF1-90E6-D835449EDCD9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                              O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll
                              O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                              O20 - Winlogon Notify: winayt32 - winayt32.dll (file missing)
                              O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
                              O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                              O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
                              O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\Sitecom\Logiciel Bluetooth\bin\btwdins.exe
                              O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                              O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe (file missing)
                              O23 - Service: Symantec Password Validation (ccPwdSvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe (file missing)
                              O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe (file missing)
                              O23 - Service: GBPoll - Roxio, Inc. - C:\Program Files\Roxio\GoBack\GBPoll.exe
                              O23 - Service: Kaspersky Anti-Virus Service (KLBLMain) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\kavmm.exe" -run bl -n PersonalPro -v 5.0.0.0 -ttsr 10000000 (file missing)
                              O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
                              O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
                              O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
                              O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Unknown owner - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe (file missing)
                              O23 - Service: SAVScan - Unknown owner - C:\Program Files\Norton AntiVirus\SAVScan.exe (file missing)
                              O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)
                              O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe (file missing)
                              O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe (file missing)
                              O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
                              O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
                              O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
                              O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

                              Et voici le rapport AVG :

                              AVG Anti-Spyware - Rapport d'analyse
                              ---------------------------------------------------------

                              + Créé à: 23:09:08 10/04/2007

                              + Résultat de l'analyse:

                              HKLM\SOFTWARE\Classes\CLSID\{F62A47A7-4CA3-9D00-95A3-6724d43a9E8C} -> Adware.Generic : Nettoyé et sauvegardé (mise en quarantaine).
                              HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F62A47A7-4CA3-9D00-95A3-6724d43a9E8C} -> Adware.Generic : Nettoyé et sauvegardé (mise en quarantaine).
                              HKU\S-1-5-21-1417001333-152049171-1343024091-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F62A47A7-4CA3-9D00-95A3-6724D43A9E8C} -> Adware.Generic : Nettoyé et sauvegardé (mise en quarantaine).
                              C:\WINDOWS\system32\vkgstb.dll -> Adware.PurityScan : Erreur lors du nettoyage.
                              C:\Documents and Settings\Administrateur.PC\Cookies\administrateur@247realmedia[1].txt -> TrackingCookie.247realmedia : Nettoyé.
                              C:\Documents and Settings\Administrateur.PC\Cookies\administrateur@advertising[1].txt -> TrackingCookie.Advertising : Nettoyé.
                              C:\Documents and Settings\Administrateur.PC\Cookies\administrateur@adviva[1].txt -> TrackingCookie.Adviva : Nettoyé.
                              C:\Documents and Settings\Administrateur.PC\Cookies\administrateur@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
                              C:\Documents and Settings\Administrateur.PC\Cookies\administrateur@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
                              C:\Documents and Settings\Administrateur.PC\Cookies\administrateur@statcounter[1].txt -> TrackingCookie.Statcounter : Nettoyé.

                              Fin du rapport
                              1. papyber Contributeur sécurité
                                1/télécharge et installe le logiciel HijackThis v1.99.1
                                http://pchelpbordeaux.free.fr/logiciels.html
                                Tutorial
                                http://pchelpbordeaux.free.fr/tuto.html

                                2/télécharge AVG Antispyware
                                https://www.avg.com/en-ww/free-antivirus-download

                                mode d'utilisation :
                                Lance AVG Anti-Spyware, mets le à jour,
                                Clique sur le bouton « Analyse »
                                Puis « Comment réagir », clique sur Actions recommandées. Sélectionne Quarantaine.
                                Retour à l'onglet Analyse.
                                Clique sur Analyse complète du système.
                                A la fin du scan, choisis " Appliquer toutes les actions "
                                Clique sur "Enregistrer le rapport". Le fichier texte se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware.

                                3/ Télécharge : - CCleaner
                                https://www.pcastuces.com/logitheque/ccleaner.htm
                                ("Download Latest Version", sur la droite).
                                Ce logiciel va permettre de supprimer tous les fichiers temporaires. Avant de cliquer sur le bouton "installer", décoche toutes les "options supplémentaires". Ensuite, Clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Par la suite, laisse-le avec ses réglages par défaut. C'est tout.

                                4/ lance ccleaner , nettoyeur, et supprime tout ce qu'il trouve

                                5/ lance avg antyspyware et supprime tout ce qu'il trouve et poste son rapport

                                6/ lance hijack this et poste le rapport

                                Discussions similaires

                                Problème avec "PUADIManager:Win32/OfferCore
                                Knaki

                                3 réponses
                                PUADlManager:Win32/OfferCore
                                tenmalade

                                2 réponses
                                PUADlManager:Win32/OfferCore
                                bernardarrad

                                3 réponses
                                Pb Windows 7, .EXE n'est pas app win32 valide
                                Witeric

                                15 réponses
                                PUA:Win32/InstallCore detecté par windows sécurité
                                thetib

                                11 réponses