C:\windows\fonts\wmsncs.exe

Résolu
marsupio94 -  
Bonjour,
j ai ce message a chaque demarage de windows,et meme une 10 de foix dans la journee.
j ai vue que c etait un virus exe,comment s en debarrasser
merci a+
Configuration: Windows XP
Firefox 3.0.7

50 réponses

Résumé de la discussion

Un message d’alerte lié à un fichier exécutable malveillant apparaît au démarrage et plusieurs fois par jour sous Windows XP, indiquant une infection potentielle et nécessitant une intervention. Plusieurs solutions préconisées incluent l’utilisation de Dr Web CureIt en lancement sur le bureau puis un balayage rapide et complet, avec désinfection ou quarantaine selon les résultats. Des analyses complémentaires via des outils comme Kaspersky Online Scanner ont détecté des objets infectés, notamment des Trojans et des éléments verrouillés ou suspects, avec des rapports détaillés à l’appui. En cas d’infection persistante, il peut être nécessaire de sauvegarder les données sur un support externe, de réinitialiser certains composants, puis d’envisager une réinstallation du système si les symptômes réapparaissent.

Bobot (l’IA à votre service)
  1. verni29 Contributeur sécurité
    Bonjour,

    commence par ceci.

    Télécharge et installe HijackThis .
    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

    Choisir « Download Hijackthis Installer »
    Après l'installation, un raccourci sera crée sur le bureau. Double-clique dessus pour le lancer ( si sous Vista --> Click droit et executer en tant qu’administrateur )

    Choisir l'option Do a system scan and save a logfile.
    Le rapport va s'ouvrir. Tu copies/colles le contenu de ce rapport dans ton prochain message

    A+
    0
    1. marsupio94 Auteur
      bonjour et merci
      voici le rapport

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 18:20:17, on 23/03/2009
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v8.00 (8.00.6001.18702)
      Boot mode: Normal

      Running processes:
      C:\windows\System32\smss.exe
      C:\windows\system32\winlogon.exe
      C:\windows\system32\services.exe
      C:\windows\system32\lsass.exe
      C:\windows\system32\Ati2evxx.exe
      C:\windows\system32\svchost.exe
      C:\windows\System32\svchost.exe
      C:\windows\system32\Ati2evxx.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\windows\system32\spoolsv.exe
      C:\Program Files\Sitecom\Logiciel Bluetooth\bin\btwdins.exe
      C:\windows\system32\cisvc.exe
      C:\Program Files\Java\jre6\bin\jqs.exe
      C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
      C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
      C:\windows\System32\svchost.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\WINDOWS\System32\wbem\wmiapsrv.exe
      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE
      C:\windows\RTHDCPL.EXE
      C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe
      C:\windows\system32\rundll32.exe
      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      C:\Program Files\Java\jre6\bin\jusched.exe
      C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
      C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
      C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
      C:\windows\system32\ctfmon.exe
      C:\PROGRA~1\MI3AA1~1\rapimgr.exe
      C:\documents and settings\famillial\local settings\application data\woecgee.exe
      C:\Program Files\eMule\emule.exe
      C:\Program Files\Sitecom\Logiciel Bluetooth\BTTray.exe
      C:\Program Files\Logitech\SetPoint\SetPoint.exe
      C:\Program Files\Azureus\Azureus.exe
      C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
      C:\windows\system32\cidaemon.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\windows\system32\ping.exe
      C:\windows\explorer.exe
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.fr/spbasic.htm
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.numericable.fr/offre/pack_client.php?v=1&cmpid=elgoogmarq
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=10611&gct=&gc=1&q=
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=10611&gct=&gc=1&q=%s
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      F2 - REG:system.ini: Shell=explorer.exe "C:\WINDOWS\Fonts\wmsncs.exe"
      O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
      O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
      O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips\tbBest.dll
      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
      O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
      O3 - Toolbar: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips\tbBest.dll
      O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
      O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [EPSON Stylus Photo R240 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE /P30 "EPSON Stylus Photo R240 Series" /O6 "USB001" /M "Stylus Photo R240"
      O4 - HKLM\..\Run: [trioService] "C:\PROGRA~1\Freeze.com\Living 3D Dolphins\trioService.exe "
      O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
      O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
      O4 - HKLM\..\Run: [HydraVisionDesktopManager] "C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe"
      O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
      O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
      O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
      O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
      O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
      O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
      O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
      O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\system32\ctfmon.exe
      O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
      O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
      O4 - HKCU\..\Run: [woecgee] "c:\documents and settings\famillial\local settings\application data\woecgee.exe" woecgee
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
      O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
      O4 - Startup: Azureus Ultra Accelerator.lnk = F:\Program Files\Azureus\Azureus Ultra Accelerator\Azureus Ultra Accelerator.exe
      O4 - Startup: Azureus.lnk = C:\Program Files\Azureus\Azureus.exe
      O4 - Global Startup: BTTray.lnk = ?
      O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
      O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
      O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
      O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie_ctx.htm
      O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2dcdf256432d479088fb1c19fbe7849d
      O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2dcdf256432d479088fb1c19fbe7849d
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
      O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
      O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
      O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
      O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
      O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
      O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
      O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
      O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/...
      O18 - Protocol: bw+0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw+0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw-0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw-0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw00 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw00s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw10 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw10s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw20 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw20s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw30 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw30s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw40 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw40s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw50 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw50s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw60 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw60s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw70 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw70s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw80 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw80s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw90 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bw90s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwa0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwa0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwb0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwb0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwc0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwc0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwd0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwd0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwe0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwe0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwf0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwf0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
      O18 - Protocol: bwg0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwg0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwh0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwh0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwi0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwi0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwj0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwj0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwk0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwk0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwl0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwl0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwm0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwm0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwn0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwn0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwo0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwo0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwp0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwp0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwq0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwq0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwr0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwr0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bws0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bws0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwt0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwt0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwu0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwu0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwv0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwv0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bww0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bww0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwx0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwx0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwy0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwy0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwz0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: bwz0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O18 - Protocol: offline-8876480 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\Sitecom\Logiciel Bluetooth\bin\btwdins.exe
      O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
      O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
      O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logitech\Bluetooth\LBTServ.exe
      O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
      O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
      O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
      0
      1. verni29 Contributeur sécurité
        Tu vas utiliser SDFix téléchargeable à :
        http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

        Tu installes le logiciel.
        Tu peux t’aider du tuto suivant :
        https://www.malekal.com/slenfbot-still-an-other-irc-bot/

        Il faut que tu redémarres en mode sans échec.
        Pour cela, tu redémarres ton ordinateur et tu appuies sur la touche F8.

        A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
        Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
        Choisis ton compte.

        Tu lances SDFix en double-cliquant sur RunThis.bat dans le dossier où tu as installé le logiciel.

        Ton ordinateur va redémarrer. il te sera peut-être demander d'appuyer sur une touche pour redémarrer.
        L'outil va continuer à travailler, c'est normal.

        Une fois affiché Finished, appuie sur une touche pour finir l'exécution du logiciel.
        Ton bureau devrait réapparaitre.

        Ouvre le dossier de SDFix sur ton Bureau.
        Copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum.

        Avec un nouveau log HijackThis !

        A+
        0
        1. marsupio94 Auteur
          ok
          je fait ca et te tiend au courant
          merci a+
          0
          2. marsupio94 Auteur
            bonjour
            le rapportsdfix

            [b]Checking Files [/b]:

            No Trojan Files Found

            Removing Temp Files

            [b]ADS Check [/b]:

            [b]Final Check [/b]:

            catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
            Rootkit scan 2009-03-24 18:03:35
            Windows 5.1.2600 Service Pack 3 NTFS

            scanning hidden processes ...

            scanning hidden services & system hive ...

            [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001060b4bda6]
            "001783fb9d0f"=hex:01,1f,71,af,05,a8,14,20,9c,26,22,e5,8c,42,65,83
            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001060b4bda6]
            "001783fb9d0f"=hex:01,1f,71,af,05,a8,14,20,9c,26,22,e5,8c,42,65,83

            scanning hidden registry entries ...

            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
            "TracesProcessed"=dword:0000005f
            "TracesSuccessful"=dword:00000058

            scanning hidden files ...

            scan completed successfully
            hidden processes: 0
            hidden services: 0
            hidden files: 0

            [b]Remaining Services [/b]:

            Authorized Application Key Export:

            [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
            "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
            "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
            "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
            "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
            "C:\\Program Files\\ma-config.com\\maconfservice.exe"="C:\\Program Files\\ma-config.com\\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
            "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Disabled:Logitech Desktop Messenger"
            "C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
            "C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
            "C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
            "C:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"="C:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7"
            "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
            "C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"="C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
            "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
            "C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
            "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

            [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
            "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
            "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
            "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
            "C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
            "C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
            "C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
            "C:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"="C:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7"
            "C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"="C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
            "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
            "C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
            "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

            [b]Remaining Files [/b]:

            [b]Files with Hidden Attributes [/b]:

            Fri 8 Aug 2008 56 ..SHR --- "C:\WINDOWS\system32\702E53F13D.sys"
            Tue 22 Jul 2008 65,460 A..H. --- "C:\WINDOWS\system32\bibpy.exe"
            Fri 8 Aug 2008 2,098 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
            Wed 21 Feb 2007 31,744 ..SHR --- "C:\WINDOWS\system32\msfDX.dll"
            Sun 24 Aug 2008 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
            Wed 23 Jul 2008 400 ..SH. --- "C:\Documents and Settings\All Users\DRM\v2ks.bla.bak"
            Wed 23 Jul 2008 48 ..SH. --- "C:\Documents and Settings\All Users\DRM\v2ks.sec.bak"
            Sun 26 Jun 2005 616,448 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygwin1.dll"
            Tue 21 Jun 2005 45,568 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygz.dll"
            Sun 27 Jul 2008 72,704 ..SHR --- "C:\Program Files\eRightSoft\SUPER\Setup.exe"
            Fri 27 Oct 2006 15,872 A.SHR --- "C:\Program Files\eRightSoft\SUPER\_Setup.dll"
            Tue 4 Jun 2002 84,992 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\14_43260.dll"
            Tue 4 Jun 2002 44,032 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\28_83260.dll"
            Tue 10 Dec 2002 73,766 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\atrc3260.dll"
            Tue 10 Dec 2002 65,575 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\cook3260.dll"
            Sun 9 Jun 2002 36,864 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ddnt3260.dll"
            Tue 4 Jun 2002 20,480 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dnet3260.dll"
            Tue 10 Dec 2002 102,437 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv13260.dll"
            Tue 10 Dec 2002 176,165 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv23260.dll"
            Tue 10 Dec 2002 208,935 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv33260.dll"
            Tue 10 Dec 2002 217,127 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv43260.dll"
            Sun 9 Jun 2002 40,448 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dspr3260.dll"
            Sun 4 Nov 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ivvideo.dll"
            Tue 10 Apr 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\qtmlClient.dll"
            Fri 20 Feb 2004 232,960 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\raac.dll"
            Sun 9 Jun 2002 525,824 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnco3260.dll"
            Tue 10 Dec 2002 245,805 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnlt3260.dll"
            Tue 10 Dec 2002 45,093 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv103260.dll"
            Tue 10 Dec 2002 98,341 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv203260.dll"
            Tue 10 Dec 2002 94,247 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv303260.dll"
            Tue 10 Dec 2002 90,151 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv403260.dll"
            Tue 10 Dec 2002 102,439 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\sipr3260.dll"
            Sun 9 Jun 2002 49,152 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\tokr3260.dll"

            [b]Finished![/b]

            le rapport hijackthis

            Logfile of Trend Micro HijackThis v2.0.2
            Scan saved at 18:21:22, on 24/03/2009
            Platform: Windows XP SP3 (WinNT 5.01.2600)
            MSIE: Internet Explorer v8.00 (8.00.6001.18702)
            Boot mode: Normal

            Running processes:
            C:\windows\System32\smss.exe
            C:\windows\system32\winlogon.exe
            C:\windows\system32\services.exe
            C:\windows\system32\lsass.exe
            C:\windows\system32\Ati2evxx.exe
            C:\windows\system32\svchost.exe
            C:\windows\System32\svchost.exe
            C:\windows\system32\Ati2evxx.exe
            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            C:\Program Files\Alwil Software\Avast4\ashServ.exe
            C:\windows\system32\spoolsv.exe
            C:\Program Files\Sitecom\Logiciel Bluetooth\bin\btwdins.exe
            C:\windows\system32\cisvc.exe
            C:\Program Files\Java\jre6\bin\jqs.exe
            C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
            C:\windows\explorer.exe
            C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
            C:\windows\System32\svchost.exe
            C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
            C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
            C:\WINDOWS\System32\wbem\wmiapsrv.exe
            C:\windows\system32\cidaemon.exe
            C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
            C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE
            C:\windows\RTHDCPL.EXE
            C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe
            C:\windows\system32\rundll32.exe
            C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
            C:\Program Files\Java\jre6\bin\jusched.exe
            C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
            C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
            C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
            C:\PROGRA~1\MI3AA1~1\rapimgr.exe
            C:\windows\system32\ctfmon.exe
            C:\documents and settings\famillial\local settings\application data\woecgee.exe
            C:\Program Files\eMule\emule.exe
            C:\Program Files\Sitecom\Logiciel Bluetooth\BTTray.exe
            C:\Program Files\Logitech\SetPoint\SetPoint.exe
            F:\Program Files\Azureus\Azureus Ultra Accelerator\Azureus Ultra Accelerator.exe
            C:\Program Files\Azureus\Azureus.exe
            C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
            C:\Program Files\Mozilla Firefox\firefox.exe
            C:\Program Files\trend micro\HijackThis\HijackThis.exe

            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.sfr.fr/offres-numericable.html?v=1&cmpid=elgoogmarq
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
            R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=10611&gct=&gc=1&q=
            R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=10611&gct=&gc=1&q=%s
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
            O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
            O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
            O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
            O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
            O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
            O2 - BHO: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips\tbBest.dll
            O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
            O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
            O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
            O3 - Toolbar: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips\tbBest.dll
            O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
            O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
            O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
            O4 - HKLM\..\Run: [EPSON Stylus Photo R240 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE /P30 "EPSON Stylus Photo R240 Series" /O6 "USB001" /M "Stylus Photo R240"
            O4 - HKLM\..\Run: [trioService] "C:\PROGRA~1\Freeze.com\Living 3D Dolphins\trioService.exe "
            O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
            O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
            O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
            O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
            O4 - HKLM\..\Run: [HydraVisionDesktopManager] "C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe"
            O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
            O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
            O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
            O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
            O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
            O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
            O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
            O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
            O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
            O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\system32\ctfmon.exe
            O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
            O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
            O4 - HKCU\..\Run: [woecgee] "c:\documents and settings\famillial\local settings\application data\woecgee.exe" woecgee
            O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
            O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
            O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
            O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
            O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
            O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
            O4 - Startup: Azureus Ultra Accelerator.lnk = F:\Program Files\Azureus\Azureus Ultra Accelerator\Azureus Ultra Accelerator.exe
            O4 - Startup: Azureus.lnk = C:\Program Files\Azureus\Azureus.exe
            O4 - Global Startup: BTTray.lnk = ?
            O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
            O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
            O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
            O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie_ctx.htm
            O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2dcdf256432d479088fb1c19fbe7849d
            O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2dcdf256432d479088fb1c19fbe7849d
            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
            O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
            O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
            O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
            O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
            O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
            O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
            O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)
            O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
            O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
            O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
            O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
            O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
            O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
            O18 - Protocol: bw+0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw+0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw-0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw-0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw00 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw00s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw10 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw10s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw20 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw20s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw30 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw30s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw40 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw40s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw50 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw50s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw60 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw60s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw70 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw70s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw80 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw80s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw90 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw90s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwa0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwa0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwb0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwb0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwc0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwc0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwd0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwd0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwe0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwe0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwf0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwf0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
            O18 - Protocol: bwg0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwg0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwh0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwh0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwi0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwi0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwj0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwj0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwk0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwk0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwl0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwl0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwm0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwm0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwn0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwn0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwo0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwo0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwp0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwp0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwq0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwq0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwr0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwr0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bws0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bws0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwt0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwt0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwu0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwu0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwv0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwv0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bww0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bww0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwx0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwx0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwy0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwy0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwz0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bwz0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: offline-8876480 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
            O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
            O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
            O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
            O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
            O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\Sitecom\Logiciel Bluetooth\bin\btwdins.exe
            O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
            O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
            O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logitech\Bluetooth\LBTServ.exe
            O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
            O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
            O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
            0
            1. verni29 Contributeur sécurité
              As-tu toujours le message pour wmsncs.exe ?

              Pour le message sur IPX/SPX, quand as-tu eu ce message ? Tu par les de SDFix ou de Hijackthis .

              Télécharge navilog d'il mafioso.
              http://il.mafioso.pagesperso-orange.fr/Navifix/Navilog1.exe
              Tu l’installes.
              Double-clique sur le raccourci qui a été crée sur le bureau.
              Choisis l'option 1.

              Une fois l’analyse terminée, un rapport va s’ouvrir dans le bloc-notes.
              Tu copies et colles le texte de ce rapport dans ton prochain message.

              A+
              0
              1. marsupio94 Auteur
                salut

                le message c est avec sdfix
                wmsncs je ne sais pas,je vais redemarrer l ordi

                Search Navipromo version 3.7.6 commencé le 24/03/2009 à 19:16:21,15

                !!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
                !!! Postez ce rapport sur le forum pour le faire analyser !!!
                !!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

                Outil exécuté depuis C:\Program Files\navilog1

                Mise à jour le 14.03.2009 à 18h00 par IL-MAFIOSO

                Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
                X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) D CPU 2.66GHz )
                BIOS : Default System BIOS
                USER : famillial ( Administrator )
                BOOT : Normal boot

                Antivirus : avast! antivirus 4.8.1335 [VPS 090323-0] 4.8.1335 (Activated)

                A:\ (USB)
                C:\ (Local Disk) - NTFS - Total:76 Go (Free:9 Go)
                F:\ (Local Disk) - NTFS - Total:232 Go (Free:128 Go)
                H:\ (Local Disk) - NTFS - Total:153 Go (Free:98 Go)
                I:\ (CD or DVD)
                J:\ (CD or DVD)
                K:\ (CD or DVD)
                L:\ (CD or DVD)
                N:\ (Local Disk) - NTFS - Total:9 Go (Free:9 Go)
                O:\ (Local Disk) - NTFS - Total:455 Go (Free:232 Go)

                Recherche executé en mode normal

                *** Recherche dossiers dans "C:\windows" ***

                *** Recherche dossiers dans "C:\Program Files" ***

                ...\Live-Player trouvé !
                ...\WebMediaPlayer trouvé !

                *** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***

                ...\Live-Player trouvé !
                ...\WebMediaPlayer trouvé !

                *** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***

                *** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***

                *** Recherche dossiers dans "C:\Documents and Settings\famillial\applic~1" ***

                ...\Live-Player trouvé !

                *** Recherche dossiers dans "C:\Documents and Settings\famillial\locals~1\applic~1" ***

                *** Recherche dossiers dans "C:\Documents and Settings\famillial\menudm~1\progra~1" ***

                *** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
                pour + d'infos : http://www.gmer.net

                *** Recherche avec GenericNaviSearch ***
                !!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
                !!! A vérifier impérativement avant toute suppression manuelle !!!

                * Recherche dans "C:\windows\system32" *

                * Recherche dans "C:\Documents and Settings\famillial\locals~1\applic~1" *

                *** Recherche fichiers ***

                c:\docume~1\alluse~1\bureau\Live-Player.lnk trouvé !

                *** Recherche clés spécifiques dans le Registre ***
                !! Les clés trouvées ne sont pas forcément infectées !!

                [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                "woecgee"="\"c:\\documents and settings\\famillial\\local settings\\application data\\woecgee.exe\" woecgee"

                *** Module de Recherche complémentaire ***
                (Recherche fichiers spécifiques)

                1)Recherche nouveaux fichiers Instant Access :

                2)Recherche Heuristique :

                * Dans "C:\windows\system32" :

                * Dans "C:\Documents and Settings\famillial\locals~1\applic~1" :

                woecgee.exe trouvé !
                woecgee.dat trouvé !
                woecgee_nav.dat trouvé !
                woecgee_navps.dat trouvé !

                3)Recherche Certificats :

                Certificat Egroup absent !
                Certificat Electronic-Group absent !
                Certificat Montorgueil absent !
                Certificat OOO-Favorit absent !
                Certificat Sunny-Day-Design-Ltd absent !

                4)Recherche autres dossiers et fichiers connus :

                *** Analyse terminée le 24/03/2009 à 19:24:36,34 ***

                a+
                0
                1. marsupio94 Auteur
                  re
                  la fenetre wmsncs ne c est pas ouverte au redemarrage de l ordi
                  a+
                  0
                  1. verni29 Contributeur sécurité
                    Une des infections de ton Pc vient du logiciel Webmediaplayer que tu as du téléchargé sur un site pourri.
                    désinstalle-le ( Ajout/Supp de programmes )

                    1/ Si tu veux utiliser ce logiciel, télécharge la version officelle à ce lien :
                    http://www.azertysite.new.fr/

                    2/ Tu relances Navilog et tu choisis l'option 2.
                    Ton PC va redémarrer. C'est normal. Pour cela, tu fermes toutes les fenêtres ouvertes.
                    Après redémarrage, choisis ton compte.

                    Un rapport va s'afficher.
                    Tu copies/ colles ce rapport dans ton prochain message, ainsi qu'un rapport HijackThis.

                    A+
                    0
                    1. marsupio94 Auteur
                      re

                      Clean Navipromo version 3.7.6 commencé le 24/03/2009 à 21:28:31,98

                      Outil exécuté depuis C:\Program Files\navilog1

                      Mise à jour le 14.03.2009 à 18h00 par IL-MAFIOSO

                      Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
                      X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) D CPU 2.66GHz )
                      BIOS : Default System BIOS
                      USER : famillial ( Administrator )
                      BOOT : Normal boot

                      Antivirus : avast! antivirus 4.8.1335 [VPS 090323-0] 4.8.1335 (Activated)

                      A:\ (USB)
                      C:\ (Local Disk) - NTFS - Total:76 Go (Free:6 Go)
                      F:\ (Local Disk) - NTFS - Total:232 Go (Free:124 Go)
                      H:\ (Local Disk) - NTFS - Total:153 Go (Free:98 Go)
                      I:\ (CD or DVD)
                      J:\ (CD or DVD)
                      K:\ (CD or DVD)
                      L:\ (CD or DVD)
                      N:\ (Local Disk) - NTFS - Total:9 Go (Free:9 Go)
                      O:\ (Local Disk) - NTFS - Total:455 Go (Free:232 Go)

                      Mode suppression automatique
                      avec prise en charge résultats Catchme et GNS

                      Nettoyage exécuté au redémarrage de l'ordinateur

                      *** fsbl1.txt non trouvé ***
                      (Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)

                      *** Suppression avec sauvegardes résultats GenericNaviSearch ***

                      * Suppression dans "C:\windows\System32" *

                      * Suppression dans "C:\Documents and Settings\famillial\locals~1\applic~1" *

                      *** Suppression dossiers dans "C:\windows" ***

                      *** Suppression dossiers dans "C:\Program Files" ***

                      ...\Live-Player ...suppression...
                      ...\Live-Player supprimé !

                      *** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***

                      ...\Live-Player ...suppression...
                      ...\Live-Player supprimé !

                      *** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***

                      *** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***

                      *** Suppression dossiers dans "C:\Documents and Settings\famillial\applic~1" ***

                      ...\Live-Player ...suppression...
                      ...\Live-Player supprimé !

                      *** Suppression dossiers dans "C:\Documents and Settings\famillial\locals~1\applic~1" ***

                      *** Suppression dossiers dans "C:\Documents and Settings\famillial\menudm~1\progra~1" ***

                      *** Suppression fichiers ***

                      c:\docume~1\alluse~1\bureau\Live-Player.lnk supprimé !

                      *** Suppression fichiers temporaires ***

                      Nettoyage contenu C:\windows\Temp effectué !
                      Nettoyage contenu C:\Documents and Settings\famillial\locals~1\Temp effectué !

                      *** Traitement Recherche complémentaire ***
                      (Recherche fichiers spécifiques)

                      1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

                      2)Recherche, création sauvegardes et suppression Heuristique :

                      * Dans "C:\windows\system32" *

                      C:\windows\prefetch\woecgee*.pf trouvé !
                      Copie C:\windows\prefetch\woecgee*.pf réalisée avec succès !
                      C:\windows\prefetch\woecgee*.pf supprimé !

                      * Dans "C:\Documents and Settings\famillial\locals~1\applic~1" *

                      woecgee.exe trouvé !
                      Copie woecgee.exe réalisée avec succès !
                      woecgee.exe supprimé !

                      woecgee.dat trouvé !
                      Copie woecgee.dat réalisée avec succès !
                      woecgee.dat supprimé !

                      woecgee_nav.dat trouvé !
                      Copie woecgee_nav.dat réalisée avec succès !
                      woecgee_nav.dat supprimé !

                      woecgee_navps.dat trouvé !
                      Copie woecgee_navps.dat réalisée avec succès !
                      woecgee_navps.dat supprimé !

                      *** Sauvegarde du Registre vers dossier Safebackup ***

                      sauvegarde du Registre réalisée avec succès !

                      *** Nettoyage Registre ***

                      Nettoyage Registre Ok

                      *** Certificats ***

                      Certificat Egroup absent !
                      Certificat Electronic-Group absent !
                      Certificat Montorgueil absent !
                      Certificat OOO-Favorit absent !
                      Certificat Sunny-Day-Design-Ltdt absent !

                      *** Recherche autres dossiers et fichiers connus ***

                      *** Nettoyage terminé le 24/03/2009 à 21:32:45,42 ***
                      hijackthis

                      Logfile of Trend Micro HijackThis v2.0.2
                      Scan saved at 21:38:59, on 24/03/2009
                      Platform: Windows XP SP3 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v8.00 (8.00.6001.18702)
                      Boot mode: Normal

                      Running processes:
                      C:\windows\System32\smss.exe
                      C:\windows\system32\winlogon.exe
                      C:\windows\system32\services.exe
                      C:\windows\system32\lsass.exe
                      C:\windows\system32\Ati2evxx.exe
                      C:\windows\system32\svchost.exe
                      C:\windows\System32\svchost.exe
                      C:\windows\system32\Ati2evxx.exe
                      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                      C:\Program Files\Alwil Software\Avast4\ashServ.exe
                      C:\windows\system32\spoolsv.exe
                      C:\windows\Explorer.EXE
                      C:\Program Files\Sitecom\Logiciel Bluetooth\bin\btwdins.exe
                      C:\windows\system32\cisvc.exe
                      C:\Program Files\Java\jre6\bin\jqs.exe
                      C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
                      C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
                      C:\windows\System32\svchost.exe
                      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                      C:\WINDOWS\System32\wbem\wmiapsrv.exe
                      C:\windows\notepad.exe
                      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                      C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE
                      C:\windows\RTHDCPL.EXE
                      C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe
                      C:\windows\system32\rundll32.exe
                      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                      C:\Program Files\Java\jre6\bin\jusched.exe
                      C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                      C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
                      C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
                      C:\windows\system32\ctfmon.exe
                      C:\PROGRA~1\MI3AA1~1\rapimgr.exe
                      C:\Program Files\Sitecom\Logiciel Bluetooth\BTTray.exe
                      C:\Program Files\Logitech\SetPoint\SetPoint.exe
                      F:\Program Files\Azureus\Azureus Ultra Accelerator\Azureus Ultra Accelerator.exe
                      C:\Program Files\Azureus\Azureus.exe
                      C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
                      C:\Program Files\Mozilla Firefox\firefox.exe
                      C:\windows\system32\ping.exe
                      C:\windows\system32\cidaemon.exe
                      C:\Program Files\trend micro\HijackThis\HijackThis.exe

                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.sfr.fr/offres-numericable.html?v=1&cmpid=elgoogmarq
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=10611&gct=&gc=1&q=
                      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=10611&gct=&gc=1&q=%s
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
                      O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
                      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
                      O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
                      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
                      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                      O2 - BHO: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips\tbBest.dll
                      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
                      O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
                      O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
                      O3 - Toolbar: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips\tbBest.dll
                      O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
                      O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
                      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                      O4 - HKLM\..\Run: [EPSON Stylus Photo R240 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE /P30 "EPSON Stylus Photo R240 Series" /O6 "USB001" /M "Stylus Photo R240"
                      O4 - HKLM\..\Run: [trioService] "C:\PROGRA~1\Freeze.com\Living 3D Dolphins\trioService.exe "
                      O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
                      O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
                      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                      O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
                      O4 - HKLM\..\Run: [HydraVisionDesktopManager] "C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe"
                      O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
                      O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
                      O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
                      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
                      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
                      O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
                      O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
                      O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                      O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
                      O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
                      O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\system32\ctfmon.exe
                      O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
                      O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
                      O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
                      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                      O4 - Startup: Azureus Ultra Accelerator.lnk = F:\Program Files\Azureus\Azureus Ultra Accelerator\Azureus Ultra Accelerator.exe
                      O4 - Startup: Azureus.lnk = C:\Program Files\Azureus\Azureus.exe
                      O4 - Global Startup: BTTray.lnk = ?
                      O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                      O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
                      O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
                      O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie_ctx.htm
                      O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2dcdf256432d479088fb1c19fbe7849d
                      O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2dcdf256432d479088fb1c19fbe7849d
                      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
                      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
                      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                      O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
                      O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
                      O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
                      O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
                      O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)
                      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
                      O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
                      O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
                      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
                      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
                      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
                      O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
                      O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
                      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
                      O18 - Protocol: bw+0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw+0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw-0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw-0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw00 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw00s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw10 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw10s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw20 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw20s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw30 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw30s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw40 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw40s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw50 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw50s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw60 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw60s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw70 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw70s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw80 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw80s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw90 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bw90s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwa0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwa0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwb0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwb0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwc0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwc0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwd0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwd0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwe0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwe0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwf0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwf0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                      O18 - Protocol: bwg0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwg0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwh0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwh0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwi0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwi0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwj0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwj0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwk0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwk0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwl0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwl0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwm0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwm0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwn0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwn0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwo0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwo0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwp0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwp0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwq0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwq0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwr0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwr0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bws0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bws0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwt0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwt0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwu0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwu0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwv0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwv0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bww0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bww0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwx0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwx0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwy0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwy0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwz0 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: bwz0s - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O18 - Protocol: offline-8876480 - {043B6160-6A48-4105-AD14-816E3B0EFCE9} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
                      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                      O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\Sitecom\Logiciel Bluetooth\bin\btwdins.exe
                      O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
                      O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
                      O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logitech\Bluetooth\LBTServ.exe
                      O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
                      O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
                      O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
                      0
                      1. verni29 Contributeur sécurité
                        Il y a encore plusieurs choses à voir.

                        1/ Lance Hijackthis et tu choisis " Do a system scan only ".
                        Tu sélectionnes les lignes suivantes :

                        O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
                        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
                        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                        O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
                        O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)
                        Toutes les lignes en 018

                        Tu choisis l'option " Fixchecked" en bas de la page.

                        2/ Pour vérifier.

                        Télécharge Toolbar-S&D sur ton Bureau :
                        https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

                        * Lance l'installation du programme en exécutant le fichier téléchargé.
                        * Double-clique sur le raccourci de Toolbar-S&D.
                        * Sélectionne la langue puis valide.
                        * Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
                        * Copie/colle le contenu du rapport qui va s’afficher.
                        Si tu ne le trouves pas, il est situé à C:\TB.txt .

                        3/ J'aimerais que tu analyses trois fichiers inconnus sur le net pour vérifier si ils sont infectieux ou pas.
                        Tu posteras les trois rapports en trois messages différents.

                        Tu vas sur le site de VirusTotal et tu vas pouvoir analyser les fichiers.
                        https://www.virustotal.com/gui/
                        Copiez successivement les chemins indiqués ci-dessous et les coller ensuite dans la zone à analyser.

                        Chemins :
                        C:\WINDOWS\system32\702E53F13D.sys
                        C:\WINDOWS\system32\bibpy.exe
                        C:\WINDOWS\system32\msfDX.dll

                        Tu cliques ensuite sur envoyer le fichier.
                        Tu postes le rapport de l'analyse ( pour cela, tu sélectionnes la zone de résultat --> click droit --> copier )

                        A+
                        0
                        1. marsupio94 Auteur
                          -----------\\ ToolBar S&D 1.2.8 XP/Vista

                          Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
                          X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) D CPU 2.66GHz )
                          BIOS : Default System BIOS
                          USER : famillial ( Administrator )
                          BOOT : Normal boot
                          Antivirus : avast! antivirus 4.8.1335 [VPS 090324-0] 4.8.1335 (Activated)
                          A:\ (USB)
                          C:\ (Local Disk) - NTFS - Total:76 Go (Free:15 Go)
                          F:\ (Local Disk) - NTFS - Total:232 Go (Free:124 Go)
                          H:\ (Local Disk) - NTFS - Total:153 Go (Free:98 Go)
                          I:\ (CD or DVD)
                          J:\ (CD or DVD)
                          K:\ (CD or DVD)
                          L:\ (CD or DVD)
                          N:\ (Local Disk) - NTFS - Total:9 Go (Free:9 Go)
                          O:\ (Local Disk) - NTFS - Total:455 Go (Free:226 Go)

                          "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
                          Option : [1] ( 25/03/2009| 0:05 )

                          -----------\\ Recherche de Fichiers / Dossiers ...

                          C:\Program Files\Kiwee Toolbar
                          C:\Program Files\Kiwee Toolbar\2.8.167
                          C:\Program Files\Kiwee Toolbar\2.8.167\firefox
                          C:\Program Files\Kiwee Toolbar\2.8.167\firefox\chrome
                          C:\Program Files\Kiwee Toolbar\2.8.167\firefox\chrome\kiweetoolbar.jar

                          -----------\\ Extensions

                          (famillial) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar

                          -----------\\ [..\Internet Explorer\Main]

                          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                          "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
                          "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                          "Start Page"="https://www.sfr.fr/offres-numericable.html?v=1&cmpid=elgoogmarq"
                          "Search Bar"="https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5"

                          [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                          "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
                          "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
                          "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
                          "Local Page"="C:\\windows\\system32\\blank.htm"
                          "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"

                          --------------------\\ Recherche d'autres infections

                          C:\Program Files\Live-Player_setup.exe
                          [b]==> EGDACCESS <==/b

                          --------------------\\ Cracks & Keygens ..

                          C:\DOCUME~1\FAMILL~1\Application Data\Microsoft\Office\Recent\crack.LNK

                          1 - "C:\ToolBar SD\TB_1.txt" - 25/03/2009| 0:06 - Option : [1]

                          -----------\\ Fin du rapport a 0:06:58,95

                          a-squared 4.0.0.101 2009.03.24 -
                          AhnLab-V3 5.0.0.2 2009.03.24 -
                          AntiVir 7.9.0.120 2009.03.24 -
                          Antiy-AVL 2.0.3.1 2009.03.24 -
                          Authentium 5.1.2.4 2009.03.24 -
                          Avast 4.8.1335.0 2009.03.24 -
                          AVG 8.5.0.283 2009.03.24 -
                          BitDefender 7.2 2009.03.24 -
                          CAT-QuickHeal 10.00 2009.03.24 -
                          ClamAV 0.94.1 2009.03.24 -
                          Comodo 1083 2009.03.24 -
                          DrWeb 4.44.0.09170 2009.03.24 -
                          eSafe 7.0.17.0 2009.03.24 -
                          eTrust-Vet 31.6.6415 2009.03.24 -
                          F-Prot 4.4.4.56 2009.03.24 -
                          F-Secure 8.0.14470.0 2009.03.24 -
                          Fortinet 3.117.0.0 2009.03.24 -
                          GData 19 2009.03.24 -
                          Ikarus T3.1.1.48.0 2009.03.24 -
                          K7AntiVirus 7.10.680 2009.03.24 -
                          Kaspersky 7.0.0.125 2009.03.24 -
                          McAfee 5563 2009.03.24 -
                          McAfee+Artemis 5563 2009.03.24 -
                          McAfee-GW-Edition 6.7.6 2009.03.24 -
                          Microsoft 1.4502 2009.03.24 -
                          NOD32 3957 2009.03.24 -
                          Norman 6.00.06 2009.03.24 -
                          nProtect 2009.1.8.0 2009.03.24 -
                          Panda 10.0.0.10 2009.03.24 -
                          PCTools 4.4.2.0 2009.03.24 -
                          Prevx1 V2 2009.03.25 -
                          Rising 21.22.12.00 2009.03.24 -
                          Sophos 4.39.0 2009.03.24 -
                          Sunbelt 3.2.1858.2 2009.03.24 -
                          Symantec 1.4.4.12 2009.03.24 -
                          TheHacker 6.3.3.4.289 2009.03.24 -
                          TrendMicro 8.700.0.1004 2009.03.24 -
                          VBA32 3.12.10.1 2009.03.24 -
                          ViRobot 2009.3.24.1661 2009.03.24 -
                          VirusBuster 4.6.5.0 2009.03.24 -
                          Information additionnelle
                          File size: 56 bytes
                          MD5...: d358c44a11ed457863393afbee9734a3
                          SHA1..: 878475b10b52e3d2cd4f05a02ddafdef7d977810
                          SHA256: 826f73a46fd9eb1ee7914cf0529ca46bb409e37867752f15984f4e50c5558362
                          SHA512: 300101e3ca8e4c8c566ecd0ab00a9e0259ac7cf7ca6095043b410645cbe188e0
                          56c31a6475f49360a78dc7e5f94b66770a661d8e6027efd58af7fcc11f56411d
                          ssdeep: 3:/ldEV8QeLjruaX:Zpl
                          PEiD..: -
                          TrID..: File type identification
                          MS Flight Simulator Aircraft Performance Info (100.0%)
                          PEInfo: -

                          a-squared 4.0.0.101 2009.03.24 -
                          AhnLab-V3 5.0.0.2 2009.03.24 -
                          AntiVir 7.9.0.120 2009.03.24 -
                          Antiy-AVL 2.0.3.1 2009.03.24 -
                          Authentium 5.1.2.4 2009.03.24 -
                          Avast 4.8.1335.0 2009.03.24 -
                          AVG 8.5.0.283 2009.03.24 -
                          BitDefender 7.2 2009.03.24 -
                          CAT-QuickHeal 10.00 2009.03.24 -
                          ClamAV 0.94.1 2009.03.24 -
                          Comodo 1083 2009.03.24 -
                          DrWeb 4.44.0.09170 2009.03.25 -
                          eSafe 7.0.17.0 2009.03.24 -
                          eTrust-Vet 31.6.6415 2009.03.24 -
                          F-Prot 4.4.4.56 2009.03.24 -
                          F-Secure 8.0.14470.0 2009.03.25 -
                          Fortinet 3.117.0.0 2009.03.24 -
                          GData 19 2009.03.24 -
                          Ikarus T3.1.1.48.0 2009.03.24 -
                          K7AntiVirus 7.10.680 2009.03.24 -
                          Kaspersky 7.0.0.125 2009.03.24 -
                          McAfee 5563 2009.03.24 -
                          McAfee+Artemis 5563 2009.03.24 -
                          McAfee-GW-Edition 6.7.6 2009.03.24 -
                          Microsoft 1.4502 2009.03.24 -
                          NOD32 3957 2009.03.24 -
                          Norman 6.00.06 2009.03.24 -
                          nProtect 2009.1.8.0 2009.03.24 -
                          Panda 10.0.0.10 2009.03.24 -
                          PCTools 4.4.2.0 2009.03.24 -
                          Prevx1 V2 2009.03.25 -
                          Rising 21.22.12.00 2009.03.24 -
                          Sophos 4.39.0 2009.03.24 -
                          Sunbelt 3.2.1858.2 2009.03.24 -
                          Symantec 1.4.4.12 2009.03.25 -
                          TheHacker 6.3.3.4.289 2009.03.24 -
                          TrendMicro 8.700.0.1004 2009.03.24 -
                          ViRobot 2009.3.24.1661 2009.03.24 -
                          VirusBuster 4.6.5.0 2009.03.24 -
                          Information additionnelle
                          File size: 65460 bytes
                          MD5...: 99e1a2fe8de65f8c1192a7e19183fce5
                          SHA1..: 0f33ae44f80e53f32e44324ba7ec707f8adc65aa
                          SHA256: c7476aeaceb142936c6c33222585f21e21bb7f5657bffbdd79d09f92dee17611
                          SHA512: 2b1187c3ac1358baf506f6adef5f755f1001575d7200a7e35e7d2a058b4c8051
                          d69b6903ec3fd988fff0d67a9f432020ecc99bd31b8b9ab8fd0e43c9e25f3e4e
                          ssdeep: 3::
                          PEiD..: -
                          TrID..: File type identification
                          OpenGL object (29.2%)
                          Lotus 123 Worksheet (generic) (14.6%)
                          HSC music composer song (9.2%)
                          Game Music Creator Music (8.2%)
                          MacBinary 1 header (7.5%)
                          PEInfo: -

                          il me met ca

                          Le fichier a déjà été analysé:
                          MD5: bbed7d24d92b4b10f780051c417fba20
                          First received: 2008.01.18 08:34:28 (CET)
                          Date 2008.01.18 08:34:28 (CET) [>431D]
                          Résultats 4/32
                          Permalink: analisis/18ca56ec59f0228c197b93e786ae6371

                          je fait afficher le dernier rapport qui donne ca

                          AhnLab-V3 - - -
                          AntiVir - - -
                          Authentium - - -
                          Avast - - -
                          AVG - - -
                          BitDefender - - -
                          CAT-QuickHeal - - -
                          ClamAV - - -
                          DrWeb - - -
                          eSafe - - Suspicious File
                          eTrust-Vet - - -
                          Ewido - - -
                          F-Prot - - -
                          F-Secure - - -
                          FileAdvisor - - -
                          Fortinet - - -
                          Ikarus - - -
                          Kaspersky - - -
                          McAfee - - -
                          Microsoft - - -
                          NOD32v2 - - -
                          Norman - - -
                          Panda - - Suspicious file
                          Prevx1 - - Heuristic: Suspicious Self Modifying EXE
                          Rising - - -
                          Sophos - - -
                          Sunbelt - - VIPRE.Suspicious
                          Symantec - - -
                          TheHacker - - -
                          VBA32 - - -
                          VirusBuster - - -
                          Webwasher-Gateway - - -
                          Information additionnelle
                          MD5: bbed7d24d92b4b10f780051c417fba20
                          SHA1: 7a547d348504ffd3a8f800b24fc95091671c134a
                          SHA256: 5d3d82bfc2d40d1aab4b78f96e7694fc3910d5f54eee390caa821e4c67a4202e
                          SHA512: 451e55fc560b9a66b02acd6a9d109cf485509a29a56fb7f5fbbbc00ef90bc33e51428d9a967a48ab4613b4c7070eb20aed9c804082d300e2d6cd82652dc8b299

                          a+
                          0
                          1. verni29 Contributeur sécurité
                            1/ Relance Toolbar-S&D en double-cliquant sur le raccourci.

                            choisis l'option "2" puis valide en appuyant sur "Entrée".
                            Ne ferme pas la fenêtre lors de la suppression.

                            Un nouveau rapport sera généré, poste son contenu ici.

                            2/ Tu télécharges MalwareBytes.
                            http://www.malwarebytes.org/mbam/program/mbam-setup.exe

                            Tu l'installes. Choisis les options par défaut.
                            A la fin de l’installation, il te sera demandé de mettre à jour MalwareBytes et de l’éxecuter .
                            Accepte. Après la, mise à jour, le logiciel va s’ouvrir.

                            Dans l’onglet Recherche, sélectionne Exécuter un examen complet.
                            Clique sur recherche. Tu ne sélectionnes que les disques durs de l’ordinateur.
                            Clique sur lancer l’examen.

                            A la fin de la recherche, comme il est demandé, clique sur afficher les résultats.
                            Si des infections sont trouvées, clique sur Supprimer la sélection.
                            Tu postes le rapport dans ton prochain message.

                            Si tu ne retrouves pas le rapport, ouvre MalwareBytes et regarde dans l’onglet Rapport/logs. Il y est. Clique dessus et choisir ouvrir.

                            Le scan dure en moyenne 50 mn.

                            A+
                            0
                            1. marsupio94 Auteur
                              salut

                              en voila deja 1

                              -----------\\ ToolBar S&D 1.2.8 XP/Vista

                              Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
                              X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) D CPU 2.66GHz )
                              BIOS : Default System BIOS
                              USER : famillial ( Administrator )
                              BOOT : Normal boot
                              Antivirus : avast! antivirus 4.8.1335 [VPS 090324-0] 4.8.1335 (Activated)
                              A:\ (USB)
                              C:\ (Local Disk) - NTFS - Total:76 Go (Free:15 Go)
                              F:\ (Local Disk) - NTFS - Total:232 Go (Free:124 Go)
                              H:\ (Local Disk) - NTFS - Total:153 Go (Free:98 Go)
                              I:\ (CD or DVD)
                              J:\ (CD or DVD)
                              K:\ (CD or DVD)
                              L:\ (CD or DVD)
                              N:\ (Local Disk) - NTFS - Total:9 Go (Free:9 Go)
                              O:\ (Local Disk) - NTFS - Total:455 Go (Free:226 Go)

                              "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
                              Option : [2] ( 25/03/2009|17:44 )

                              -----------\\ SUPPRESSION

                              Supprime! - C:\Program Files\Kiwee Toolbar\2.8.167
                              Supprime! - C:\Program Files\Kiwee Toolbar

                              -----------\\ Recherche de Fichiers / Dossiers ...

                              -----------\\ Extensions

                              (famillial) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar

                              -----------\\ [..\Internet Explorer\Main]

                              [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                              "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
                              "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                              "Start Page"="https://www.sfr.fr/offres-numericable.html?v=1&cmpid=elgoogmarq"
                              "Search Bar"="https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5"

                              [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                              "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
                              "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
                              "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
                              "Local Page"="C:\\windows\\system32\\blank.htm"
                              "Start Page"="https://www.msn.com/fr-fr/"

                              --------------------\\ Recherche d'autres infections

                              C:\Program Files\Live-Player_setup.exe
                              [b]==> EGDACCESS <==/b

                              --------------------\\ Cracks & Keygens ..

                              C:\DOCUME~1\FAMILL~1\Application Data\Microsoft\Office\Recent\crack.LNK

                              1 - "C:\ToolBar SD\TB_1.txt" - 25/03/2009| 0:06 - Option : [1]
                              2 - "C:\ToolBar SD\TB_2.txt" - 25/03/2009|17:47 - Option : [2]

                              -----------\\ Fin du rapport a 17:47:09,07
                              0
                              1. marsupio94 Auteur
                                re
                                j ai avast qui me trouve des virus sur mon disque f

                                win32:virut
                                0
                                1. verni29 Contributeur sécurité
                                  Aie. sale infection.
                                  pas sur qu'on arrive à la nettoyer.
                                  C'est quoi au juste ce lecteur F: ?

                                  Tu vas télécharger Dr Web CureIT Enregistre-le sur le bureau.
                                  https://free.drweb.com/cureit/
                                  ( téléchargement en bas de page )

                                  Double-clique sur launch.exe pour le lancer.
                                  Une fenêtre va s’ouvrir. Clique sur « commencer le scan » .
                                  Une fenêtre de confirmation va s’ouvrir. Accepte.

                                  Le scan rapide va s’exécuter.
                                  Si des fichiers infectés sont trouvés, choisis « désinfecter» pour ces fichiers.
                                  Si cette action est impossible, choisis alors quarantaine.

                                  Lance ensuite une analyse complete .Mêmes actions.
                                  A la fin de ce scan , enregistre le rapport :
                                  Menu fichier --> enregistrer le rapport

                                  Poste ce rapport dans ton prochain message.

                                  A+
                                  0
                                  1. marsupio94 Auteur
                                    bonsoir

                                    le dd f c est ou je met
                                    photos,jaquettes,
                                    tous les exe c est ceux que j ai copier du dd c sur le f ?
                                    a+
                                    0
                                    1. verni29 Contributeur sécurité
                                      Il faut que tu passes Dr Web sans trop tarder.

                                      A+
                                      0
                                      1. marsupio94 Auteur
                                        salut
                                        ca fait 3 fois que je lance dr web,et il plante a chaque fois vers la fin
                                        presque 6h d analyse
                                        1)ou je pourrais trouver le rapport
                                        2)est ce que je peux analyser juste le dd f
                                        a+
                                        0
                                        1. verni29 Contributeur sécurité
                                          Il n'est pas possible d'uniquement choisir le lecteur f:.
                                          Ce sont tous les disques locaux qui sont scannés.

                                          Tu vas essayer de passer Dr Web une dernière fois .
                                          redémarre en mode sans échec et lance-le.

                                          A+
                                          0
                                          • 1
                                          • 2
                                          • 3