Report hijack this

zeshler -  
Bonjour,
voici le rapport Hijack This de mon système. J'ai supprimé pas mal de merdes après analyse complète avec Avast mais mon PC réagit bizarrement. Mon fond d'écran a été changé (fond blanc avec une fausse fenêtre "Windows Warning Message") et mes recherches Google me renvoient sur des pages web improbables. J'ai du réparer quelques trucs grace à Avast car tout à l'heure je n'arrivais carrément pas à accéder au forum. Mais je sens qu'il reste de la vérole planquéé quelquepart. Si une âme charitable pouvait se pencher sur mon cas je lui en serais bien reconnaissant.

Logfile of HijackThis v1.99.1
Scan saved at 16:38:56, on 24/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\dllhost.exe
C:\Program Files\VeriSign\NAVI\naviagent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\PROGRA~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\TPPALDR.EXE
C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Lexmark 3400 Series\lxcymon.exe
C:\Program Files\Lexmark 3400 Series\ezprint.exe
C:\WINDOWS\system32\lphc1uwj0eccn.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\PikaOne Software\FlyCASE\PikaBackup.exe
C:\WINDOWS\System32\lxcycoms.exe
C:\Program Files\MIXVIBES\U46DJ\u46pan.exe
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: i-Nav IDN SearchHook - {CE000994-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
O2 - BHO: i-Nav IDN Resolver - {CE000992-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar5.dll
O3 - Toolbar: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [lxcymon.exe] "C:\Program Files\Lexmark 3400 Series\lxcymon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 3400 Series\ezprint.exe"
O4 - HKLM\..\Run: [LXCYCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [lphc1uwj0eccn] C:\WINDOWS\system32\lphc1uwj0eccn.exe
O4 - HKCU\..\Run: [LDM] \Program\
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [Orb] C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
O4 - HKCU\..\Run: [Steam] "e:\steam\steam.exe" -silent
O4 - Startup: Pika Backup.lnk = C:\Program Files\PikaOne Software\FlyCASE\PikaBackup.exe
O4 - Startup: U46MK2 Control Panel.lnk = C:\Program Files\MIXVIBES\U46DJ\u46pan.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - E:\Titan Poker\casino.exe
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - E:\Titan Poker\casino.exe
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: Aide i-Nav - {CE000992-A58C-4441-8938-744CD72AB27F} - http://idn.verisign-grs.com/plug-in/support/index.jsp (file missing)
O9 - Extra 'Tools' menuitem: Aide i-Nav - {CE000992-A58C-4441-8938-744CD72AB27F} - http://idn.verisign-grs.com/plug-in/support/index.jsp (file missing)
O9 - Extra button: (no name) - {CE000996-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
O9 - Extra 'Tools' menuitem: Options i-Nav - {CE000996-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1408.g.akamai.net/7/1408/9955/20040106/akamai.info.apple.com/iTunes4/WW/win/FU019-0123.20040106.Zxsw3/iTunesSetup.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{1793D50F-67B4-435E-B3D3-844BE80D409C}: NameServer = 213.36.80.1,213.36.80.2
O17 - HKLM\System\CS2\Services\Tcpip\..\{1793D50F-67B4-435E-B3D3-844BE80D409C}: NameServer = 213.36.80.1,213.36.80.2
O17 - HKLM\System\CS3\Services\Tcpip\..\{1793D50F-67B4-435E-B3D3-844BE80D409C}: NameServer = 213.36.80.1,213.36.80.2
O17 - HKLM\System\CS4\Services\Tcpip\..\{1793D50F-67B4-435E-B3D3-844BE80D409C}: NameServer = 213.36.80.1,213.36.80.2
O18 - Protocol: bw+0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: offline-8876480 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: lxcy_device - - C:\WINDOWS\System32\lxcycoms.exe
O23 - Service: VeriSign Updater (navi) - VeriSign, Inc. - C:\Program Files\VeriSign\NAVI\naviagent.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

En vous remerciant, ce satané bordel me gache ma dernière journée de vacances....grrrrrr
Configuration: P4 2.6Go
1Go RAM
Windows XP Pro
Firefox 3.0

27 réponses

Résumé de la discussion

Un utilisateur relate une infection sur Windows XP après une analyse HijackThis, avec un fond d'écran blanc affichant une fausse "Windows Warning Message" et des recherches Google redirigées vers des pages étrangères. Le rapport liste de nombreux processus et modules en démarrage, dont Avast, i-Nav VeriSign, Google Toolbar, ainsi que des services NVIDIA et Logitech, suggérant une contamination complexe. Des symptômes connus incluent des redirections, des composants LSP ou DLL suspects, signalant une contamination persistante nécessitant une désinfection approfondie et une vérification des paramètres IE et DNS. D'autres éléments indiquent des entrées de démarrage et des DLL suspects à vérifier pour prévenir toute réinfection.

Bobot (l’IA à votre service)
  1. ^^Marie^^
    Bon, je vous laisse...............

    Cela devient lourd de chez lourd

    1. zeshler Auteur
      Ok, ci-joint le log TCleaner:

      -->- Recherche:

      C:\TB.txt: trouvé !
      C:\MsnFix: trouvé !
      C:\Toolbar SD: trouvé !
      C:\Documents and Settings\Ze Shler\Bureau\ToolBarSD.exe: trouvé !
      C:\Program Files\HijackThis.exe: trouvé !
      C:\Program Files\hijackthis.log: trouvé !
      C:\WINDOWS\msnfix.txt: trouvé !

      ---------------------------------
      -->- Suppression:

      C:\Documents and Settings\Ze Shler\Bureau\ToolBarSD.exe: supprimé !
      C:\Program Files\HijackThis.exe: supprimé !
      C:\TB.txt: supprimé !
      C:\Program Files\hijackthis.log: supprimé !
      C:\WINDOWS\msnfix.txt: supprimé !
      C:\MsnFix: supprimé !
      C:\Toolbar SD: ERREUR DE SUPPRESSION !!

      Corbeille vidée!
      Fichiers temporaires nettoyés !

      Et le log Hijack:

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 18:03:21, on 24/08/2008
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Avast4\aswUpdSv.exe
      C:\Program Files\Avast4\ashServ.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Bonjour\mDNSResponder.exe
      C:\WINDOWS\System32\dllhost.exe
      C:\Program Files\VeriSign\NAVI\naviagent.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\MsPMSPSv.exe
      C:\PROGRA~1\Avast4\ashDisp.exe
      C:\WINDOWS\System32\LVCOMSX.EXE
      C:\Program Files\Logitech\MouseWare\system\em_exec.exe
      C:\WINDOWS\TPPALDR.EXE
      C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe
      C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
      C:\Program Files\Lexmark 3400 Series\lxcymon.exe
      C:\Program Files\Lexmark 3400 Series\ezprint.exe
      C:\WINDOWS\system32\lphc1uwj0eccn.exe
      C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      C:\WINDOWS\system32\rundll32.exe
      C:\Program Files\Avast4\ashWebSv.exe
      C:\Program Files\PikaOne Software\FlyCASE\PikaBackup.exe
      C:\WINDOWS\System32\lxcycoms.exe
      C:\Program Files\MIXVIBES\U46DJ\u46pan.exe
      C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
      C:\WINDOWS\explorer.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\WINDOWS\system32\NOTEPAD.EXE
      C:\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = https://www.google.fr/?gws_rd=ssl
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: i-Nav IDN SearchHook - {CE000994-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
      O2 - BHO: i-Nav IDN Resolver - {CE000992-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
      O3 - Toolbar: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
      O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
      O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
      O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
      O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
      O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
      O4 - HKLM\..\Run: [lxcymon.exe] "C:\Program Files\Lexmark 3400 Series\lxcymon.exe"
      O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 3400 Series\ezprint.exe"
      O4 - HKLM\..\Run: [LXCYCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll,_RunDLLEntry@16
      O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [lphc1uwj0eccn] C:\WINDOWS\system32\lphc1uwj0eccn.exe
      O4 - HKCU\..\Run: [LDM] \Program\
      O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
      O4 - HKCU\..\Run: [Orb] C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe
      O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
      O4 - HKCU\..\Run: [Steam] "e:\steam\steam.exe" -silent
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User 'SYSTEM')
      O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil9d.exe (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User 'Default user')
      O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil9d.exe (User 'Default user')
      O4 - Startup: Pika Backup.lnk = C:\Program Files\PikaOne Software\FlyCASE\PikaBackup.exe
      O4 - Startup: U46MK2 Control Panel.lnk = C:\Program Files\MIXVIBES\U46DJ\u46pan.exe
      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
      O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - E:\Titan Poker\casino.exe
      O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - E:\Titan Poker\casino.exe
      O9 - Extra button: (no name) - {CE000996-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
      O9 - Extra 'Tools' menuitem: Options i-Nav - {CE000996-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
      O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1408.g.akamai.net/7/1408/9955/20040106/akamai.info.apple.com/iTunes4/WW/win/FU019-0123.20040106.Zxsw3/iTunesSetup.exe
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
      O17 - HKLM\System\CCS\Services\Tcpip\..\{1793D50F-67B4-435E-B3D3-844BE80D409C}: NameServer = 213.36.80.1,213.36.80.2
      O17 - HKLM\System\CS2\Services\Tcpip\..\{1793D50F-67B4-435E-B3D3-844BE80D409C}: NameServer = 213.36.80.1,213.36.80.2
      O17 - HKLM\System\CS3\Services\Tcpip\..\{1793D50F-67B4-435E-B3D3-844BE80D409C}: NameServer = 213.36.80.1,213.36.80.2
      O17 - HKLM\System\CS4\Services\Tcpip\..\{1793D50F-67B4-435E-B3D3-844BE80D409C}: NameServer = 213.36.80.1,213.36.80.2
      O18 - Protocol: bw+0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw+0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw-0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw-0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw00 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw00s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw10 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw10s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw20 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw20s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw30 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw30s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw40 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw40s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw50 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw50s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw60 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw60s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw70 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw70s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw80 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw80s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw90 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw90s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwa0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwa0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwb0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwb0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwc0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwc0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwd0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwd0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwe0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwe0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwf0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwf0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
      O18 - Protocol: bwg0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwg0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwh0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwh0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwi0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwi0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwj0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwj0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwk0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwk0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwl0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwl0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwm0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwm0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwn0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwn0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwo0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwo0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwp0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwp0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwq0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwq0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwr0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwr0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bws0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bws0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwt0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwt0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwu0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwu0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwv0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwv0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bww0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bww0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwx0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwx0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwy0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwy0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwz0 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwz0s - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: offline-8876480 - {E2661AE7-C3E1-4FF2-B439-2BBE917F19BD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast4\ashMaiSv.exe
      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exe
      O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
      O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: lxcy_device - - C:\WINDOWS\System32\lxcycoms.exe
      O23 - Service: VeriSign Updater (navi) - VeriSign, Inc. - C:\Program Files\VeriSign\NAVI\naviagent.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
      1. ^^Marie^^
        · Télécharge ToolsCleaner de A.Roshtein sur ton Bureau.(sur un des 2 liens)
        http://pc-system.fr/

        · Clique sur Recherche et laisse le scan se terminer.
        · Clique, sur Suppression pour finaliser.
        · Tu peux, si tu le souhaites, te servir des Options facultatives.
        · Clique sur Quitter, pour que le rapport puisse se créer.
        · Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).

        F - Hijackthis - Outil de diagnostic et réparation
        télécharge HijackThis ici:
        http://telechargement.zebulon.fr/138-hijackthis-1991.html
        https://kerio.probb.fr/t62-comment-utiliser-et-comprendre-hijackthis
        Dézippe le dans un dossier prévu à cet effet.
        Par exemple C:\hijackthis < Enregistre le bien dans c : !
        Démo : (Merci a Balltrap34 pour cette réalisation)
        http://pageperso.aol.fr/balltrap34/Hijenr.gif
        Lance le puis:
        clique sur "do a system scan and save logfile" (cf démo)
        faire un copier coller du log entier sur le forum
        Démo : (Merci a Balltrap34 pour cette réalisation)
        http://pageperso.aol.fr/balltrap34/demohijack.htm
        http://www.tutoriaux-excalibur.com/hijackthis.htm
        https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

        +++++++++++
        1. zeshler Auteur
          Bon, alors voici le dernier rapport Toolbar S&D après suppression comme indiqué par Marie.

          -----------\\ ToolBar S&D 1.1.4 XP/Vista

          Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
          X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 2.60GHz )
          BIOS : BIOS Date: 08/20/03 12:57:55 Ver: 08.00.09
          USER : Ze Shler ( Administrator )
          BOOT : Normal boot

          "C:\ToolBar SD" ( MAJ : 24-08-2008|14:20 )
          Option : [2] ( 24/08/2008|17:37 )

          -----------\\ SUPPRESSION

          Supprime! - C:\DOCUME~1\ZESHLE~1\APPLIC~1\ShoppingReport\cs
          Supprime! - C:\Program Files\ShoppingReport\Bin
          Supprime! - C:\Program Files\ShoppingReport\Uninst.exe
          Supprime! - C:\WINDOWS\iun6002.exe
          Supprime! - C:\DOCUME~1\ZESHLE~1\APPLIC~1\ShoppingReport
          Supprime! - C:\Program Files\ShoppingReport

          -----------\\ Recherche de Fichiers / Dossiers ...

          -----------\\ [..\Internet Explorer\Main]

          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
          "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
          "Start Page"="about:blank"
          "Search Page"="https://www.google.com/?gws_rd=ssl"
          "Start Page_bak"="https://www.google.fr/?gws_rd=ssl"
          "Search Page_bak"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
          "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
          "Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"

          [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
          "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
          "Default_Search_URL"="http://www.google.com/toolbar/ie8/sidebar.html"
          "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
          "Local Page"="C:\\windows\\system32\\blank.htm"
          "Start Page"="https://www.msn.com/fr-fr/"
          "MSLastSearch2"="http://u.web-bus.net/update/"

          --------------------\\ Recherche d'autres infections

          --------------------\\ ROOTKIT !!

          [HKLM\..\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV] -- ROOTKIT Tibs !
          [HKLM\..\CurrentControlSet\Enum\Root\tdssserv] -- ROOTKIT Tibs !
          [HKLM\..\ControlSet002\Enum\Root\LEGACY_TDSSSERV] -- ROOTKIT Tibs !
          [HKLM\..\ControlSet002\Enum\Root\tdssserv] -- ROOTKIT Tibs !
          [HKLM\..\ControlSet003\Enum\Root\LEGACY_TDSSSERV] -- ROOTKIT Tibs !
          [HKLM\..\ControlSet003\Enum\Root\tdssserv] -- ROOTKIT Tibs !

          --------------------\\ Cracks & Keygens ..

          C:\DOCUME~1\ZESHLE~1\Mes documents\Ableton\Library\Presets\Vinyl Distortion\Crack.adv
          C:\DOCUME~1\ALLUSE~1\Menu D‚marrer\Programmes\Native Instruments\Intakt\Keygen.lnk

          -----------\\ Fin du rapport a 17:46:20,31

          Merci de ton aide
          2. InfernO.vir
            http://3psilon.info/Les-rootkits.html#sommaire_2 <-- go ici et lit
            1. zeshler Auteur
              Rootkits? Si tu pouvais m'expliquer ce que c'est plutot, ca serait cool.
            4. zeshler Auteur
              Voila:

              -----------\\ ToolBar S&D 1.1.4 XP/Vista

              Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
              X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 2.60GHz )
              BIOS : BIOS Date: 08/20/03 12:57:55 Ver: 08.00.09
              USER : Ze Shler ( Administrator )
              BOOT : Normal boot

              "C:\ToolBar SD" ( MAJ : 24-08-2008|14:20 )
              Option : [1] ( 24/08/2008|17:19 )

              -----------\\ Recherche de Fichiers / Dossiers ...

              C:\DOCUME~1\ZESHLE~1\APPLIC~1\ShoppingReport
              C:\DOCUME~1\ZESHLE~1\APPLIC~1\ShoppingReport\cs
              C:\Program Files\ShoppingReport
              C:\Program Files\ShoppingReport\Bin
              C:\Program Files\ShoppingReport\Uninst.exe
              C:\WINDOWS\iun6002.exe

              -----------\\ [..\Internet Explorer\Main]

              [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
              "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
              "Start Page"="about:blank"
              "Search Page"="https://www.google.com/?gws_rd=ssl"
              "Start Page_bak"="https://www.google.fr/?gws_rd=ssl"
              "Search Page_bak"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
              "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
              "Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"

              [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
              "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
              "Default_Search_URL"="http://www.google.com/toolbar/ie8/sidebar.html"
              "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
              "Local Page"="C:\\windows\\system32\\blank.htm"
              "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"
              "MSLastSearch2"="http://u.web-bus.net/update/"

              --------------------\\ Recherche d'autres infections

              --------------------\\ ROOTKIT !!

              [HKLM\..\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV] -- ROOTKIT Tibs !
              [HKLM\..\CurrentControlSet\Enum\Root\tdssserv] -- ROOTKIT Tibs !
              [HKLM\..\ControlSet002\Enum\Root\LEGACY_TDSSSERV] -- ROOTKIT Tibs !
              [HKLM\..\ControlSet002\Enum\Root\tdssserv] -- ROOTKIT Tibs !
              [HKLM\..\ControlSet003\Enum\Root\LEGACY_TDSSSERV] -- ROOTKIT Tibs !
              [HKLM\..\ControlSet003\Enum\Root\tdssserv] -- ROOTKIT Tibs !

              --------------------\\ Cracks & Keygens ..

              C:\DOCUME~1\ZESHLE~1\Mes documents\Ableton\Library\Presets\Vinyl Distortion\Crack.adv
              C:\DOCUME~1\ALLUSE~1\Menu D‚marrer\Programmes\Native Instruments\Intakt\Keygen.lnk

              -----------\\ Fin du rapport a 17:28:58,79

              J'ai l'impressionqu'il a rien trouvé de spécial...
              1. ^^Marie^^
                Relance Toolbar-S&D en double-cliquant sur le raccourci. Tape sur "2"
                puis valide en appuyant sur "Entrée".
                ! Ne ferme pas la fenêtre lors de la suppression !
                Un rapport sera généré, poste son contenu ici.

                NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
                Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."
                Tape explorer puis valide.
            5. ^^Marie^^
              Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
              https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

              * Lance l'installation du programme en exécutant le fichier téléchargé.
              * Double-clique maintenant sur le raccourci de Toolbar-S&D.
              * Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
              * Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
              * Poste le rapport généré. (C:\TB.txt)

              1. toptitbal Contributeur sécurité
                Tu devrais refaire un Hijackthis en utilisant une version à jour :

                http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

                et suivre les indications de ceux qui savent ce qu'il te demandent de faire...
                1. zeshler Auteur
                  J'ai bien compris que c'était un adware, ma question est comment faire pour le virer définitivement?
                  1. InfernO.vir
                    C'est un adware !

                    Son role est d'envahir de pubs l'internaute !!

                    I-nav n'avaient pas a etre supprimé
                    1. zeshler Auteur
                      Ouais sauf que j'ai pas de GPS, je vois ce que ça fout là. Et pour les deux autres "ShopperReports" m'ouvre des pop up comparateur de prix sur le coté de mon navigateur alors que je lui ai rien demandé.
                      1. ^^Marie^^
                        Logfile of HijackThis v1.99.1

                        Logitech\Desktop Messenger

                        ShopperReports
                        1. toptitbal Contributeur sécurité
                          "J'ai supprimé les lignes suivantes:"

                          certaines étaient légitimes...
                          1. InfernO.vir
                            O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
                            O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll

                            C'est un spyware tu ne vas pas les eliminer en les fixants simplement avec hijackthis!!!
                            1. InfernO.vir
                              Sais-tu au moins ce que tu as supprimé??

                              I-nav <---en rapport avec les GPS rien d'infectieux
                              1. ^^Marie^^
                                mick3927,

                                Après nouvelle analyse ces quatre lignes sont de nouveau là....

                                Votre avis?

                                Be voilà .....................

                                Ensuite !! Que faire ???

                                1. mick3927
                                  je n'est pas dit qu' il faut se basé uniquement la dessus mais tu peu deja trouver les connus pour le reste il est vrais qu'il ne les detectera pas
                                  1.  ^^Marie^^
                                    Il faut savoir que parfois les rouge sont bonnes, et parfois des vertes sont mauvaises...

                                    Tu fais comment ???

                                    En attendant, l'internaute est dans la panade

                                • 1
                                • 2

                                Discussions similaires

                                Orange message Successful Mail Delivery Repor
                                ACT

                                16 réponses
                                [!! SPAM] Successful Mail Delivery Report
                                aurititi

                                3 réponses
                                503 Service Unavailable
                                TIT0M87

                                1 réponse
                                Mon navigateur ouvre des pages internet tout seul
                                Adelyss

                                3 réponses