What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

PEDEVICE

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.99.1
Scan saved at 21:47:00, on 2007-01-15
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Fichiers communs\ACD Systems\FR\DevDetect.exe
C:\Program Files\Logitech\Video\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Ipwindows\ipwins.exe
C:\Program Files\Fichiers communs\{240E68F7-02DB-3084-0714-000323200002}\Update.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\lvcomsx.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5746\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\SMBOLS~1\alg.exe
C:\Program Files\Common files\?racle\d?dplay.exe
C:\Program Files\Ipwindows\ipwins.exe
C:\PROGRA~1\WINZIP\wzqkpick.exe
C:\utilitaire\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {721C8FD6-181E-1F97-6D22-6BE4BDB0BE9F} - C:\WINDOWS\system32\wjnlvm.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {721C8FD6-181E-1F97-6D22-6BE4BDB0BE9F} - C:\WINDOWS\system32\wjnlvm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: PEDEV_IEListener Class - {E1412445-4FF8-410e-8D24-F2CF86B171A4} - C:\Program Files\PeDevice\PeDev.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Logitech\Video\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Logitech\Video\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [IpWins] C:\Program Files\Ipwindows\ipwins.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5746\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [Ehnm] "C:\WINDOWS\system32\SMBOLS~1\alg.exe" -vt tzt
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by127fd.bay127.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O18 - Protocol: bw+0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: offline-8876480 - {33F4F81B-A733-4564-BBCA-73F40804FB03} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe



what i have to do
Post #3
Here is the result of combofix.exe "Lisette et Denis" - 07-01-16 20:34:44 Service Pack 2 ComboFix 07-01-16.2 - Running from: "C:\utilitaire" ((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log )))))))))))))))))))))))))))))))))))))))))))))))))) REGISTRY ENTRIES REMOVED: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\clsid\{7befaa06-254a-497d-a3a0-fbeab5b2f543}] @="" [HKEY_CLASSES_ROOT\clsid\{7befaa06-254a-497d-a3a0-fbeab5b2f543}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\clsid\{7befaa06-254a-497d-a3a0-fbeab5b2f543}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\clsid\{7befaa06-254a-497d-a3a0-fbeab5b2f543}\InprocServer32] "ThreadingModel"="Apartment" * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * FILES REMOVED: C:\WINDOWS\system32\i624lgfq162e.dll Granting SeDebugPrivilege to Administrateurs … successful (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\Fichiers communs\Yazzle1122OinAdmin.exe C:\Program Files\Fichiers communs\Yazzle1122OinUninstaller.exe C:\Program Files\Ipwindows\ipwins.dll C:\Program Files\Ipwindows\ipwins.exe C:\WINDOWS\system32\wapicc.exe C:\WINDOWS\RDFX4.exe C:\WINDOWS\wallpap.exe C:\Program Files\Fichiers communs\{240E6~3 C:\Program Files\Fichiers communs\{240E6~2 C:\Program Files\Ipwindows C:\Program Files\Outerinfo C:\Program Files\PrintView C:\Program Files\Fichiers communs\{240E6~1 ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\qoobox\purity\DOCUME~1 C:\qoobox\purity\DOCUME~1\LISETT~1 C:\qoobox\purity\DOCUME~1\LISETT~1\Application Data C:\qoobox\purity\DOCUME~1\LISETT~1\Application Data\from.txt C:\qoobox\purity\DOCUME~1\LISETT~1\Application Data\MBOLS~1 C:\qoobox\purity\DOCUME~1\LISETT~1\Application Data\RACLE~1 C:\qoobox\purity\DOCUME~1\LISETT~1\Application Data\SEMBLY~1 C:\qoobox\purity\DOCUME~1\LISETT~1\Application Data\SSEMBL~1 C:\qoobox\purity\DOCUME~1\LISETT~1\Application Data\YSTEM~1 C:\qoobox\purity\Program Files\DOBE~1 C:\qoobox\purity\Program Files\MBOLS~1 C:\qoobox\purity\Program Files\SMBOLS~1 C:\qoobox\purity\Program Files\STEM32~1 C:\qoobox\purity\WINDOWS\ICROSO~1 C:\qoobox\purity\WINDOWS\PPPATC~1 C:\qoobox\purity\WINDOWS\SEMBLY~1 C:\qoobox\purity\WINDOWS\SSTEM3~1 C:\qoobox\purity\WINDOWS\system32\CROSOF~1.NET C:\qoobox\purity\WINDOWS\system32\ICROSO~1 C:\qoobox\purity\WINDOWS\system32\SMBOLS~1 C:\qoobox\purity\WINDOWS\system32\SSTEM3~1 C:\qoobox\purity\WINDOWS\system32\WNSXS~1 C:\qoobox\purity\WINDOWS\system32\YMANTE~1 C:\qoobox\purity\WINDOWS\system32\YSTEM3~1 C:\qoobox\purity\WINDOWS\system32\YSTEM~1 C:\qoobox\purity\WINDOWS\system32\SMBOLS~1\alg.exe C:\qoobox\purity\WINDOWS\system32\SMBOLS~1\SMBOLS~1 ((((((((((((((((((((((((((((((( Files Created from 2006-12-16 to 2007-01-16 )))))))))))))))))))))))))))))))))) 2007-01-15 21:38 d——– C:\DOCUME~1\ALLUSE~1\Application Data\WinZip 2007-01-12 06:05 d——– C:\Program Files\RegCure 2007-01-11 22:43 57,856 –a—— C:\WINDOWS\system32\wjnlvm.dll 2007-01-11 18:56 d——– C:\DOCUME~1\ALLUSE~1\Application Data\Spybot - Search & Destroy 2007-01-11 18:37 d——– C:\utilitaire 2007-01-10 22:37 d——– C:\Program Files\SpywareBot 2007-01-03 17:20 d——– C:\Program Files\Java 2007-01-03 17:19 d——– C:\Program Files\Fichiers communs\Java 2006-12-26 18:01 7,136 -ra—— C:\WINDOWS\system32\drivers\lv302af.sys 2006-12-26 18:01 59,264 –a—— C:\WINDOWS\system32\drivers\USBAUDIO.sys 2006-12-26 18:00 39,424 -ra—— C:\WINDOWS\system32\drivers\LVUSBSta.sys 2006-12-26 18:00 380,928 -ra—— C:\WINDOWS\system32\LVUI2RC.dll 2006-12-26 18:00 217,088 -ra—— C:\WINDOWS\system32\LVUI2.dll 2006-12-26 18:00 204,800 -ra—— C:\WINDOWS\system32\lvcodec2.dll 2006-12-26 18:00 2,112 -ra—— C:\WINDOWS\system32\Repository.reg 2006-12-26 18:00 110,592 -ra—— C:\WINDOWS\system32\lvcoinst.dll 2006-12-26 17:59 916,096 -ra—— C:\WINDOWS\system32\drivers\LV302AV.SYS 2006-12-26 17:47 245,824 -ra—— C:\WINDOWS\system32\InstExec.exe 2006-12-26 17:47 245,824 -ra—— C:\WINDOWS\Instexec.exe 2006-12-26 17:46 d——– C:\Program Files\Fichiers communs\Logitech 2006-12-26 17:45 65,536 –a—— C:\WINDOWS\system32\MFC71DEU.DLL 2006-12-26 17:45 61,440 –a—— C:\WINDOWS\system32\MFC71ITA.DLL 2006-12-26 17:45 61,440 –a—— C:\WINDOWS\system32\MFC71ESP.DLL 2006-12-26 17:45 57,344 –a—— C:\WINDOWS\system32\MFC71ENU.DLL 2006-12-26 17:45 57,344 –a—— C:\WINDOWS\system32\ElkCtlPS.dll 2006-12-26 17:45 49,152 –a—— C:\WINDOWS\system32\MFC71KOR.DLL 2006-12-26 17:45 49,152 –a—— C:\WINDOWS\system32\MFC71JPN.DLL 2006-12-26 17:45 45,056 –a—— C:\WINDOWS\system32\MFC71CHT.DLL 2006-12-26 17:45 40,960 –a—— C:\WINDOWS\system32\VxLibRes.dll 2006-12-26 17:45 40,960 –a—— C:\WINDOWS\system32\MFC71CHS.DLL 2006-12-26 17:45 323,584 –a—— C:\WINDOWS\system32\CamCplRes.dll 2006-12-26 17:45 262,144 –a—— C:\WINDOWS\system32\ElkCtrl.exe 2006-12-26 17:45 152,576 –a—— C:\WINDOWS\system32\VxLib.dll 2006-12-26 17:45 135,680 –a—— C:\WINDOWS\system32\VLib.dll 2006-12-26 17:45 1,645,320 –a—— C:\WINDOWS\system32\gdiplus.dll 2006-12-26 17:45 1,047,552 –a—— C:\WINDOWS\system32\MFC71u.dll 2006-12-26 17:44 118,784 -r——- C:\WINDOWS\bwUnin-7.2.0.137-8876480SL.exe 2006-12-26 12:48 d——– C:\Program Files\Logitech 2006-12-25 12:19 d——– C:\WINDOWS\RegisteredPackages 2006-12-25 12:11 d——– C:\Program Files\Thomson 2006-12-22 15:35 d–h—– C:\Program Files\Fichiers communs\Uninstall Information 2006-12-21 21:50 d——– C:\Program Files\PeDevice (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-01-11 20:44 ——– d——– C:\Program Files\myway 2006-12-26 17:45 ——– d–h—– C:\Program Files\installshield installation information 2006-12-25 13:05 ——– d—s—- C:\Documents and Settings\Lisette et Denis\Application Data\microsoft 2006-12-25 12:43 ——– d——– C:\Documents and Settings\Lisette et Denis\Application Data\adobeum 2006-12-23 23:22 ——– d——– C:\Program Files\limewire 2006-11-22 10:36 ——– d——– C:\Program Files\common files (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe" "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.908.5746\\GoogleToolbarNotifier.exe" "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "LDM"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe" "Ehnm"="\"C:\\WINDOWS\\system32\\SMBOLS~1\\alg.exe\" -vt tzt" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "vptray"="C:\\PROGRA~1\\SYMANT~1\\SYMANT~1\\vptray.exe" "AdaptecDirectCD"="C:\\Program Files\\Adaptec\\Easy CD Creator 5\\DirectCD\\DirectCD.exe" "HPDJ Taskbar Utility"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb09.exe" "HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\"" "HP Software Update"="\"C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWuSchd.exe\"" "HPHmon05"="C:\\WINDOWS\\system32\\hphmon05.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "Picasa Media Detector"="C:\\Program Files\\Picasa2\\PicasaMediaDetector.exe" "Device Detector"="DevDetect.exe -autorun" "LogitechCameraAssistant"="C:\\Program Files\\Logitech\\Video\\CameraAssistant.exe" "LogitechVideo[inspector]"="C:\\Program Files\\Logitech\\Video\\InstallHelper.exe /inspect" "LogitechCameraService(E)"="C:\\WINDOWS\\system32\\ElkCtrl.exe /automation" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD05] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="hphupd05" "hkey"="HKLM" "command"="C:\\Program Files\\Hewlett-Packard\\{45B6180B-DCAB-4093-8EE8-6164457517F0}\\hphupd05.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Optimizer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="optimize" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPPDetect] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="IPP4Detect" "hkey"="HKLM" "command"="IPP4Detect.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="MSMSGS" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\MSMSGS.EXE\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qhiwawvA] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qhiwawvA" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smart Start UP] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="PnPDetect" "hkey"="HKLM" "command"="C:\\Program Files\\NewSoft\\Smart Start UP\\PnPDetect.exe /Automation " "inimapping"="0" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\HP DArC Task #Hewlett-Packard#7600#MY34G1114Y7I.job C:\WINDOWS\tasks\HP Usg Daily.job C:\WINDOWS\tasks\RegCure.job Completion time: 07-01-16 20:53:46
Post #6
Because no reply was made. :blink: This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.


Also follow the recommendations in Tony Klein's article
So how did I get infected in the first place?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI