Spyware pervers

fleetmoon · le 3 janvier 2006

Bonjour et Bonne Année à tous,

J'ai attrapé une cochonerie qui a d'abord tout bloqué sur l'ordi. J'ai peu à peu regagné du terrain.

Le malware m'empêche d'utiliser Spybot ou Ad-aware qui se bloquent dès que je lance l'analyse.

J'ai voulu installer Antivir pour la procédure décrite en première page du forum, impossible. Il y a systématiquement un blocage pendant l'installation.

Lorsque j'allume l'ordi, une fenêtre s'ouvre pour lancer un "anti-spyware" nommé UnSpy + une pub pour divers services.

Une analyse en ligne par un antivirus n'a rien donné.

Que puis-je faire? (Je suis nul en informatique).

Merci pour votre aide.

Fleetmoon

J'ai pu télécharger Hijackthis et voici le résultat:

Logfile of HijackThis v1.99.1

Scan saved at 10:42:41, on 03/01/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\windows\system\hpsysdrv.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe

C:\WINDOWS\System32\hphmon05.exe

C:\HP\KBD\KBD.EXE

C:\Program Files\Multimedia Card Reader\shwicon2k.exe

C:\WINDOWS\ALCXMNTR.EXE

C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\PROGRA~1\MYWEBS~1\bar\4.bin\mwsoemon.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\lycos\Lyc_SysTray.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\PROGRA~1\MOZILLA.ORG\MOZILLA\MOZILLA.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\idemlog.exe

C:\Program Files\AVPersonal\AVWUPSRV.EXE

C:\WINDOWS\System32\drivers\CDAC11BA.EXE

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\3M\PSN2Lite\PsnLite.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\3M\PSN2Lite\PSNGive.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\System32\HPZipm12.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\Product Assistant\bin\hprblog.exe

C:\WINDOWS\System32\alg.exe

C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\Répertoire temporaire 1 pour hijackthis.zip\HijackThis.exe

C:\Program Files\Microsoft Office\Office10\WINWORD.EXE

c:\Program Files\Microsoft Works\MSWorks.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr9.hpwis.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-fr9.hpwis.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\4.bin\MWSSRCAS.DLL

R3 - URLSearchHook: (no name) - {76BB2F6C-C448-55AD-1540-6B6A5AA76183} - uio.dll (file missing)

O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\4.bin\MWSSRCAS.DLL

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\4.bin\MWSBAR.DLL

O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\system32\eogfl.dll

O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - c:\Program Files\Microsoft Money\System\mnyside.dll

O2 - BHO: Quick! - {4E7BD74F-2B8D-469E-C0FF-FD67B79CAF2C} - C:\PROGRA~1\quickbar\quickbar.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: (no name) - {D80C4E21-C346-4E21-8E64-20746AA20AEB} - (no file)

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O3 - Toolbar: (no name) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file)

O3 - Toolbar: Quick! - {4E7BD74F-2B8D-469E-C0FF-FD67B79CAF2C} - C:\PROGRA~1\quickbar\quickbar.dll

O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\4.bin\MWSBAR.DLL

O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\system32\eogfl.dll

O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe

O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe

O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE

O4 - HKLM\..\Run: [storageGuard] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect

O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe

O4 - HKLM\..\Run: [sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe

O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe

O4 - HKLM\..\Run: [KAVPersonal50] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe /minimize

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\4.bin\mwsoemon.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [AliceSD] PasswdMon.exe

O4 - HKLM\..\Run: [bogobot] ExchangeMaster.exe

O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook

O4 - HKCU\..\Run: [lycosInside] C:\Program Files\lycos\Lyc_SysTray.exe

O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\PROGRA~1\MOZILLA.ORG\MOZILLA\MOZILLA.EXE" -turbo

O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\4.bin\mwsoemon.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [desktop] C:\WINDOWS\system32\idemlog.exe

O4 - HKCU\..\Run: [unSpyPC] "C:\Program Files\UnSpyPC\UnSpyPC.exe"

O4 - HKCU\..\Run: [slamm] qwe.exe

O4 - HKCU\..\Run: [scanSYS] ActionScr.exe

O4 - HKCU\..\Run: [typeconf] hyandex.exe

O4 - Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\4.bin\MWSOEMON.EXE

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\4.bin\MWSOEMON.EXE

O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\3M\PSN2Lite\PsnLite.exe

O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/...arch.jhtml?p=ZN

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Corel Network monitor worker - {1E274DF0-4755-42AF-BCC4-FE545E36C1E7} - C:\WINDOWS\System32\intlmain.dll (file missing)

O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {1E274DF0-4755-42AF-BCC4-FE545E36C1E7} - C:\WINDOWS\System32\intlmain.dll (file missing)

O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyside.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

O9 - Extra button: Corel Network monitor worker - {1E274DF0-4755-42AF-BCC4-FE545E36C1E7} - C:\WINDOWS\System32\intlmain.dll (file missing) (HKCU)

O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {1E274DF0-4755-42AF-BCC4-FE545E36C1E7} - C:\WINDOWS\System32\intlmain.dll (file missing) (HKCU)

O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll

O15 - Trusted IP range: 206.161.125.149

O15 - Trusted IP range: 206.161.125.149 (HKLM)

O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)

O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://195.225.177.13/11225/online.chm::/on-line.exe

O16 - DPF: {11111111-1111-1111-1111-111111113456} - file://c:\info6_s.cab

O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/...s/yinst0401.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1097407490140

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.coupdepoucepc.com/scan/Msie/bitdefender.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...400/mcfscan.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{14355376-ACC0-4A43-A8BE-CE81CD1E5169}: NameServer = 85.255.116.30,85.255.112.197

O17 - HKLM\System\CCS\Services\Tcpip\..\{43D4BB8C-6898-4CC2-BA11-39970E51F0D6}: NameServer = 85.255.116.30,85.255.112.197

O17 - HKLM\System\CCS\Services\Tcpip\..\{90BAA7C6-2B89-40DB-BE57-A8BC4E0515D7}: NameServer = 85.255.116.30,85.255.112.197

O17 - HKLM\System\CS1\Services\Tcpip\..\{14355376-ACC0-4A43-A8BE-CE81CD1E5169}: NameServer = 85.255.116.30,85.255.112.197

O18 - Protocol: bw+0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw+0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw-0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw-0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw00 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw00s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw10 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw10s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw20 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw20s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw30 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw30s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw40 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw40s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw50 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw50s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw60 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw60s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw70 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw70s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw80 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw80s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw90 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw90s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwa0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwa0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwb0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwb0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwc0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwc0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwd0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwd0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwe0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwe0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwf0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwf0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O18 - Protocol: bwg0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwg0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwh0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwh0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwi0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwi0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwj0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwj0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwk0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwk0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwl0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwl0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwm0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwm0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwn0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwn0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwo0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwo0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwp0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwp0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwq0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwq0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwr0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwr0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bws0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bws0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwt0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwt0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwu0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwu0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwv0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwv0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bww0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bww0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwx0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwx0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwy0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwy0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwz0 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwz0s - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O18 - Protocol: offline-8876480 - {6C38C3CB-4D6B-4BBB-B5A0-E8A84E214477} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE

O23 - Service: Service Bonjour (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

:-P

Ruby · le 3 janvier 2006

Bonjour et Bonne Année à toi @ Fleetmoon

il est nécessaire de faire l' eScan.

télécharger et lancer eScan

Il faut d'actualiser eScan avec kavupd.exe

Démarre en mode sans échec (F8 ou F5)

(pour un scan complet)

cocher la case "Drive"

sélectionner le bouton-radio "Scan All Files"

cliquer sur le bouton "Scan Clean" (sous Action)

Le scan dure un certain temps... efficace, eScan distingue plusieurs catégories dans les éléments douteux :

"No action taken" pour des éléments qu'il reconnait finalement comme n'étant pas des virus

"File renamed" pour des éléments douteux

"File deleted" pour ceux qui ne méritent que çà !

S'il vous plaît montre nous le résultat et tous les fichiers contaminés.

Merci.

Modifié le 3 janvier 2006 par Ruby

fleetmoon · le 4 janvier 2006

Bonjour Ruby et Bonne Année à toi.

Voici le résultat de l'analyse:

Wed Jan 04 12:09:19 2006 => ***** Scanne complèt. *****

Wed Jan 04 12:09:19 2006 => Total de Fichiers scannés: 30548

Wed Jan 04 12:09:19 2006 => Total de virus trouvés: 80

Wed Jan 04 12:09:19 2006 => Total de fichiers désinfectés: 0

Wed Jan 04 12:09:19 2006 => Nombre de fichiers renommés: 0

Wed Jan 04 12:09:19 2006 => Total de fichiers supprimés: 0

Wed Jan 04 12:09:19 2006 => Nombre d'erreurs: 382

Wed Jan 04 12:09:20 2006 => Temps écoulé: 00:13:09

Wed Jan 04 12:09:20 2006 => Date de la Base de donné Virale: 1/3/2006

Wed Jan 04 12:09:20 2006 => Nombre de Virus Dans la Base de Donnéeta: 168773

Je me demande comment je peux encore allumer mon ordi.

Fichier C:\PROGRA~1\MYWEBS~1\bar\4.bin\M3OUTLCN.DLL nommé "not-a-virus:AdWare.Win32.MyWebSearch". Action faite: Pas d'action prise.

Fichier C:\PROGRA~1\MYWEBS~1\bar\4.bin\MWSBAR.DLL nommé "not-a-virus:AdWare.Win32.MyWebSearch.p". Action faite: Pas d'action prise.

Fichier C:\WINDOWS\system32\eogfl.dll nommé "not-a-virus:AdWare.Win32.SBSoft.h". Action faite: Pas d'action prise.

Fichier C:\PROGRA~1\MYWEBS~1\SrchAstt\4.bin\MWSSRCAS.DLL nommé "not-a-virus:AdWare.Win32.MyWebSearch.ai". Action faite: Pas d'action prise.

Fichier C:\PROGRA~1\MYWEBS~1\bar\4.bin\mwsoemon.exe nommé "not-a-virus:AdWare.Win32.MyWebSearch". Action faite: Pas d'action prise.

Fichier C:\WINDOWS\system32\idemlog.exe infecté par "Backdoor.Win32.Agent.rw" Virus. Action Prise: Pas d'action prise.

Objet "mywebsearch Spyware/Adware" trouvé dans fichier système! Action faite: Pas d'action prise.

Objet "funweb Spyware/Adware" trouvé dans fichier système! Action faite: Pas d'action prise.

Objet "mywebsearch Spyware/Adware" trouvé dans fichier système! Action faite: Pas d'action prise.

Objet "mywebsearchemailplugin Spyware/Adware" trouvé dans fichier système! Action faite: Pas d'action prise.

Objet "adware.toolbar.sbsoft.h Spyware/Adware" trouvé dans fichier système! Action faite: Pas d'action prise.

Objet "funweb Spyware/Adware" trouvé dans fichier système! Action faite: Pas d'action prise.

Objet "quick! (newdotnet) searchbar Spyware/Adware" trouvé dans fichier système! Action faite: Pas d'action prise.