cgombert

Mille mercis pour ton aide et tous tes conseilles J'en profite pour saluer l'ensemble de l'équipe du forum de zebulon.

Voici le nouveau rapport hijackthis je te remercie vraiement beaucoup pour ton aide ainsi que tes renseignements. Et chapeau pour ta rapidité. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 02:01:15, on 07/09/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\windows\system\hpsysdrv.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\system32\keyhook.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\RAMpage\RAMpage.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Fichiers communs\ACD Systems\FR\DevDetect.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\PCHButton.exe C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\Compaq_Propriétaire\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe C:\Documents and Settings\Compaq_Propriétaire\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.msn.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.defaulthomepage.info R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [siS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RAMpage] "C:\Program Files\RAMpage\RAMpage.exe" M=28 T=4 P="C:\Program Files\RAMpage\RAMpageConfig.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Fichiers communs\ACD Systems\FR\DevDetect.exe" -autorun O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\PCHButton.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - Startup: Outil de notification Live Search.lnk = ? O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.03\AMVConverter\grab.html O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.03\MediaManager\grab.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://www.3suisses.fr O15 - Trusted Zone: http://www.adobe.com O15 - Trusted Zone: http://abonnement.aliceadsl.fr O15 - Trusted Zone: http://www.bpbfc.banquepopulaire.fr O15 - Trusted Zone: http://www.caisse-epargne.fr O15 - Trusted Zone: http://www.conrad.fr O15 - Trusted Zone: http://www.cybergrattage.com O15 - Trusted Zone: http://www.extrafilm.fr O15 - Trusted Zone: http://www.agence.francetelecom.com O15 - Trusted Zone: http://www.goldsofts.com O15 - Trusted Zone: http://www.impots.gouv.fr O15 - Trusted Zone: http://www.ledemondujeu.com O15 - Trusted Zone: http://www.quelle.fr O15 - Trusted Zone: http://www.sunsilk.fr O15 - Trusted Zone: http://www.viamichelin.fr O15 - Trusted Zone: http://download.zonelabs.com O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab O16 - DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} - http://messenger.zone.msn.com/binary/MJSS.cab69309.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/frame...geUploader5.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://www.shockwave.com/content/dinerdash...h2.1.0.0.67.cab O16 - DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} (CPlayFirstDoggieDashControl Object) - http://webgames.d.tmsrv.com/c=ed2c06a087cb...ash.1.0.0.6.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/webplayer/stage6/...owserPlugin.cab O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.extrafilm.fr/ImageUploader4.cab O16 - DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} (GameHouse Games Player) - http://www.gamehouse.com/realarcade-webgam...houseplayer.cab O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://oceceocece.spaces.live.com/PhotoUpload/MsnPUpld.cab O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/a...gnerADP-1.0.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://abonnement.aliceadsl.fr/configurate...countHelper.cab O16 - DPF: {935F9B04-0C7B-4454-A391-348C54AD7ADD} (Jolly Bear Games Player) - http://www.shockwave.com/content/bigcityad...BGamePlayer.cab O16 - DPF: {A73BAEFA-EE65-494D-BEDB-DD3E5A34FA98} (Image Uploader) - http://www.extrafilm.fr/ImageUploader4.cab O16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) - http://www.gamehouse.com/realarcade-webgam...GamesPlayer.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://www.shockwave.com/content/dinerdash...tg.1.0.0.33.cab O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://www.gamehouse.com/realarcade-webgam...zylomplayer.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.photobox.fr/discount/clients/up...r_v2.1.0.56.cab O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxenligne.orange.fr/Gameshell/Gam...ronGameHost.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553541000} - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O16 - DPF: {D40F5876-A494-4124-8161-82625BB28C06} (CPlayFirstChocolatieControl Object) - http://www.gamehouse.com/realarcade-webgam...hocolatier2.cab O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://www.gamehouse.com/realarcade-webgam...inematycoon.cab O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://msnfr.oberon-media.com/online2/MSN_...sh.1.0.0.80.cab O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/layou...IPSUploader.cab O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://msnfr.oberon-media.com/online2/MSN_...gamesloader.cab O16 - DPF: {EA6246B4-F380-443F-8727-9AEA3371146C} (CPlayFirstWeddingDashControl Object) - http://www.gamehouse.com/realarcade-webgam...WeddingDash.cab O16 - DPF: {F4EBFE42-D82A-48EB-B70E-7499FFEAFF3F} (CPlayFirstDressShopHControl Object) - http://webgames.d.tmsrv.com/c=ed2c06a087cb...Web.1.0.0.7.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Service de l'iPod (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 14506 bytes

7 clés de registre étaient infectés. ci-dessous le rapport MBAM ANTI MALWARE A parement, je n'ai plus de fenetre qui s'ouvrent toute seule. Malwarebytes' Anti-Malware 1.26 Version de la base de données: 1120 Windows 5.1.2600 Service Pack 3 07/09/2008 01:43:59 mbam-log-2008-09-07 (01-43-59).txt Type de recherche: Examen rapide Eléments examinés: 47138 Temps écoulé: 4 minute(s), 2 second(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 0 Clé(s) du Registre infectée(s): 7 Valeur(s) du Registre infectée(s): 0 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 0 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): (Aucun élément nuisible détecté) Clé(s) du Registre infectée(s): HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{e4e3e0f8-cd30-4380-8ce9-b96904bdefca} (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{fe8a736f-4124-4d9c-b4b1-3b12381efabe} (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{c9c5deaf-0a1f-4660-8279-9edfad6fefe1} (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully. Valeur(s) du Registre infectée(s): (Aucun élément nuisible détecté) Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): (Aucun élément nuisible détecté)

Voici le nouveau rapport navilog1 Clean Navipromo version 3.6.5 commencé le 07/09/2008 à 1:06:34,64 Outil exécuté depuis C:\Program Files\navilog1 Session actuelle : "Compaq_Propriétaire" Mise à jour le 22.08.2008 à 17h30 par IL-MAFIOSO Microsoft Windows XP [version 5.1.2600] Internet Explorer : 7.0.5730.11 Système de fichiers : NTFS Mode suppression automatique avec prise en charge résultats Catchme et GNS Nettoyage exécuté au redémarrage de l'ordinateur *** fsbl1.txt non trouvé *** (Assurez-vous que Catchme n'avait rien trouvé lors de la recherche) *** Suppression avec sauvegardes résultats GenericNaviSearch *** * Suppression dans "C:\WINDOWS\System32" * * Suppression dans "C:\Documents and Settings\Compaq_Propriétaire\locals~1\applic~1" * * Suppression dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" * * Suppression dans "C:\DOCUME~1\L2MFIX\locals~1\applic~1" * *** Suppression dossiers dans "C:\WINDOWS" *** *** Suppression dossiers dans "C:\Program Files" *** *** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" *** *** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" *** *** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" *** *** Suppression dossiers dans "C:\Documents and Settings\Compaq_Propriétaire\applic~1" *** *** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" *** *** Suppression dossiers dans "C:\Documents and Settings\Compaq_Propriétaire\locals~1\applic~1" *** *** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *** *** Suppression dossiers dans "C:\DOCUME~1\L2MFIX\locals~1\applic~1" *** *** Suppression dossiers dans "C:\Documents and Settings\Compaq_Propriétaire\menudm~1\progra~1" *** *** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\menudm~1\progra~1" *** *** Suppression fichiers *** C:\WINDOWS\pack.epk supprimé ! C:\WINDOWS\system32\nvs2.inf supprimé ! *** Suppression fichiers temporaires *** Nettoyage contenu C:\WINDOWS\Temp effectué ! Nettoyage contenu C:\Documents and Settings\Compaq_Propri‚taire\locals~1\Temp effectué ! *** Traitement Recherche complémentaire *** (Recherche fichiers spécifiques) 1)Suppression avec sauvegardes nouveaux fichiers Instant Access : 2)Recherche, création sauvegardes et suppression Heuristique : * Dans "C:\WINDOWS\system32" * overaiftgb.da_ trouvé ! Copie overaiftgb.da_ réalisée avec succès ! overaiftgb.da_ supprimé ! overaiftgb_nav.da_ trouvé ! Copie overaiftgb_nav.da_ réalisée avec succès ! overaiftgb_nav.da_ supprimé ! overaiftgb_navps.da_ trouvé ! Copie overaiftgb_navps.da_ réalisée avec succès ! overaiftgb_navps.da_ supprimé ! * Dans "C:\Documents and Settings\Compaq_Propriétaire\locals~1\applic~1" * * Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" * * Dans "C:\DOCUME~1\L2MFIX\locals~1\applic~1" * *** Sauvegarde du Registre vers dossier Safebackup *** sauvegarde du Registre réalisée avec succès ! *** Nettoyage Registre *** Nettoyage Registre Ok *** Certificats *** Certificat Egroup supprimé ! Certificat Electronic-Group absent ! Certificat Montorgueil absent ! Certificat OOO-Favorit absent ! Certificat Sunny-Day-Design-Ltdt absent ! *** Nettoyage terminé le 07/09/2008 à 1:11:33,53 ***

Ci dessous rapport Lop S&D avec option 2 et navilog1 option 1 --------------------\\ Lop S&D 4.2.4-1 XP/Vista Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3 X86-based PC ( Uniprocessor Free : AMD Sempron 3000+ ) BIOS : Rev. 3.11 USER : Compaq_Propriétaire ( Administrator ) BOOT : Normal boot Antivirus : avast! antivirus 4.8.1229 [VPS 080906-0] 4.8.1229 (Activated) Firewall : ZoneAlarm Firewall 7.0.462.000 (Activated) "C:\Lop SD" ( MAJ : 06-09-2008|22:02 ) Option : [2] ( 07/09/2008| 0:33 ) \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Frag great bend logo\thunk chin.exe Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Frag great bend logo \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ --------------------\\ Listing des dossiers dans APPLIC~1 [02/01/2004|02:04] C:\DOCUME~1\ADMINI~1\APPLIC~1\Apple Computer [01/01/2004|23:51] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities [02/01/2004|01:55] C:\DOCUME~1\ADMINI~1\APPLIC~1\Intervideo [26/12/2006|23:34] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft [02/01/2004|02:38] C:\DOCUME~1\ADMINI~1\APPLIC~1\SampleView [02/01/2004|01:08] C:\DOCUME~1\ADMINI~1\APPLIC~1\Sun [01/01/2004|22:38] C:\DOCUME~1\ADMINI~1\APPLIC~1\Symantec [25/12/2006|22:01] C:\DOCUME~1\ADMINI~1\APPLIC~1\Template [03/06/2007|11:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ACD Systems [13/02/2008|21:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe [20/01/2008|13:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple [12/03/2007|22:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer [26/12/2006|21:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVG7 [05/08/2008|02:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOONTY [15/08/2007|15:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Coktel [10/12/2006|19:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink [27/12/2007|16:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\GameHouse [10/04/2008|14:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\GoBit Games [06/09/2008|09:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google [30/07/2007|00:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft [02/01/2004|01:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InterVideo [25/04/2007|12:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\iWin [09/09/2007|12:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\JollyBear [26/02/2005|14:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Knowledge Adventure [17/07/2008|17:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier [30/09/2007|13:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft [02/01/2004|02:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Motive [15/04/2007|22:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles [26/02/2007|17:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Oberongames [11/07/2008|14:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst [08/04/2007|18:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PopCap [22/07/2006|12:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime [13/06/2007|21:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Recisio [06/01/2007|20:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\RoboForm [23/09/2007|13:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sandlot Games [01/01/2004|23:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI [26/12/2006|23:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec [02/09/2008|21:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP [03/10/2007|17:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia [17/12/2006|00:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage [16/12/2006|00:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar [07/07/2008|20:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller [10/08/2007|10:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom [03/06/2007|11:20] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ACD Systems [21/06/2008|15:36] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Adobe [15/02/2007|22:46] C:\DOCUME~1\COMPAQ~1\APPLIC~1\AdobeUM [28/07/2007|15:24] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Apple Computer [02/12/2007|21:42] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ArcSoft [15/01/2007|23:42] C:\DOCUME~1\COMPAQ~1\APPLIC~1\DivX [16/12/2006|22:58] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Google [18/04/2008|14:02] C:\DOCUME~1\COMPAQ~1\APPLIC~1\gtk-2.0 [26/02/2006|15:03] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Help [04/09/2008|21:41] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Htmvcrect [20/04/2008|12:33] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Identities [15/02/2005|21:49] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Intervideo [25/04/2007|12:10] C:\DOCUME~1\COMPAQ~1\APPLIC~1\iWin [02/02/2005|21:56] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Leadertech [08/02/2007|11:59] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Macromedia [23/06/2008|20:32] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Microsoft [19/09/2006|18:58] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Motive [11/07/2008|14:49] C:\DOCUME~1\COMPAQ~1\APPLIC~1\PlayFirst [02/01/2004|02:38] C:\DOCUME~1\COMPAQ~1\APPLIC~1\SampleView [25/12/2007|22:44] C:\DOCUME~1\COMPAQ~1\APPLIC~1\SecuROM [07/11/2007|21:16] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Snapfish [02/02/2005|21:58] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Sonic [02/01/2004|01:08] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Sun [01/01/2004|22:38] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Symantec [15/02/2005|20:15] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Template [05/08/2008|02:02] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ViquaSoft [01/05/2007|13:41] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Vso [03/01/2007|14:28] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ZapSpot [20/04/2008|12:33] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Zylom [02/01/2004|02:04] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Apple Computer [01/01/2004|23:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities [02/01/2004|01:55] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Intervideo [01/01/2004|23:54] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft [02/01/2004|02:38] C:\DOCUME~1\DEFAUL~1\APPLIC~1\SampleView [02/01/2004|01:08] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun [01/01/2004|22:38] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec [30/09/2007|11:47] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft [26/12/2006|23:34] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft --------------------\\ Tâches planifiées dans C:\WINDOWS\tasks [26/08/2008 23:01][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job [05/08/2004 12:00][-rah-----] C:\WINDOWS\tasks\desktop.ini [06/09/2008 23:25][--ah-----] C:\WINDOWS\tasks\SA.DAT --------------------\\ Listing des dossiers dans C:\Program Files [01/06/2007|21:40] C:\Program Files\7-Zip [03/06/2007|11:07] C:\Program Files\ACD Systems [11/08/2008|09:36] C:\Program Files\Adibou,Je lis, je calcule 4-5 [04/07/2008|09:47] C:\Program Files\Adobe [15/12/2006|19:38] C:\Program Files\Alice [15/12/2006|20:03] C:\Program Files\Alwil Software [20/01/2008|13:38] C:\Program Files\Apple Software Update [18/06/2006|13:37] C:\Program Files\Atout Clic CM2 [03/06/2007|12:49] C:\Program Files\Avi2Dvd [03/06/2007|12:50] C:\Program Files\AviSynth 2.5 [17/07/2008|09:42] C:\Program Files\azebon [23/01/2005|15:35] C:\Program Files\BeachVolleyball [05/08/2008|01:59] C:\Program Files\Boonty [05/08/2008|02:01] C:\Program Files\BoontyGames [26/02/2006|14:57] C:\Program Files\Borland [26/10/2006|13:41] C:\Program Files\Bullfrog [27/12/2006|20:16] C:\Program Files\CCleaner [24/06/2007|23:07] C:\Program Files\CD-ROM Diva Starz [23/02/2007|22:26] C:\Program Files\CENEGA [30/01/2007|17:49] C:\Program Files\Clic d'Api Nø26 [01/01/2004|23:49] C:\Program Files\ComPlus Applications [23/01/2005|20:18] C:\Program Files\Digitale Huehnerjagd [19/01/2005|21:27] C:\Program Files\directx [17/07/2008|09:47] C:\Program Files\Disney Interactive [01/09/2008|21:41] C:\Program Files\DivX [03/06/2008|12:59] C:\Program Files\EA GAMES [01/02/2007|19:49] C:\Program Files\Easy Internet signup [22/05/2005|13:46] C:\Program Files\English Fever [02/09/2008|21:27] C:\Program Files\Fichiers communs [15/12/2007|22:15] C:\Program Files\FLV Player [11/07/2008|19:18] C:\Program Files\Gamenext [11/07/2008|14:48] C:\Program Files\GamesBar [23/01/2008|20:24] C:\Program Files\GIMP-2.0 [06/09/2008|09:49] C:\Program Files\Google [10/02/2007|14:00] C:\Program Files\Grisoft [02/01/2004|02:13] C:\Program Files\Help and Support Additions [11/01/2007|20:13] C:\Program Files\Hercules [01/09/2006|12:55] C:\Program Files\HighwayPursuit [06/09/2008|23:36] C:\Program Files\hijackthis [13/02/2005|16:26] C:\Program Files\Hits Collection [02/09/2008|09:21] C:\Program Files\Htmvcrect [29/12/2007|17:09] C:\Program Files\InstallShield Installation Information [13/08/2008|11:41] C:\Program Files\Internet Explorer [15/01/2005|14:50] C:\Program Files\InterVideo [29/07/2008|21:25] C:\Program Files\Java [21/01/2005|20:33] C:\Program Files\jetspeed [13/06/2007|21:21] C:\Program Files\KaraFun [10/10/2007|20:37] C:\Program Files\Lambda [31/01/2007|22:11] C:\Program Files\LaserMedia [10/10/2007|20:34] C:\Program Files\Maxis [20/02/2007|22:48] C:\Program Files\MeowCdMp3 [13/08/2008|11:43] C:\Program Files\Messenger [01/01/2004|23:51] C:\Program Files\microsoft frontpage [05/01/2007|22:29] C:\Program Files\Microsoft Office [30/09/2007|11:41] C:\Program Files\Microsoft SQL Server Compact Edition [24/01/2005|20:21] C:\Program Files\Microsoft Works [28/06/2007|16:40] C:\Program Files\Mindscape [15/05/2008|20:53] C:\Program Files\Movie Maker [14/09/2006|20:40] C:\Program Files\MP3 Player Utilities [25/12/2007|16:48] C:\Program Files\MP3 Player Utilities 4.03 [11/09/2007|19:16] C:\Program Files\MSBuild [13/08/2008|20:22] C:\Program Files\MSN [09/10/2007|20:53] C:\Program Files\MSN Games [01/01/2004|23:48] C:\Program Files\MSN Gaming Zone [12/09/2007|12:54] C:\Program Files\MSXML 6.0 [26/02/2006|14:57] C:\Program Files\Mvm [15/05/2008|20:50] C:\Program Files\NetMeeting [23/02/2008|10:48] C:\Program Files\NRJ [01/01/2004|23:48] C:\Program Files\Online Services [15/05/2008|20:50] C:\Program Files\Outlook Express [15/08/2007|14:54] C:\Program Files\Pac-Manic Worlds [03/09/2008|13:05] C:\Program Files\Panda Security [02/01/2004|02:14] C:\Program Files\PC-Doctor for Windows [11/05/2007|18:31] C:\Program Files\PDFCreator [24/01/2005|20:33] C:\Program Files\Phenomedia AG [04/06/2008|20:46] C:\Program Files\Picasa2 [29/12/2007|17:34] C:\Program Files\QuickTime [09/10/2007|20:59] C:\Program Files\RAMpage [11/09/2007|19:10] C:\Program Files\Reference Assemblies [09/09/2007|19:06] C:\Program Files\RegCleaner [24/07/2008|15:46] C:\Program Files\RoadRoll [14/03/2007|22:02] C:\Program Files\SdLL [11/02/2005|21:16] C:\Program Files\Serpik [02/01/2004|02:20] C:\Program Files\Services en ligne [06/01/2007|20:21] C:\Program Files\Siber Systems [01/01/2004|21:33] C:\Program Files\SiS VGA Utilities V3.59e [24/04/2005|13:04] C:\Program Files\Small Rockets [11/02/2005|21:13] C:\Program Files\Snoopy [02/01/2004|01:53] C:\Program Files\Sonic [02/01/2004|01:53] C:\Program Files\Sonic RecordNow! [01/05/2008|20:19] C:\Program Files\Sun [17/07/2008|10:00] C:\Program Files\SuperMarioPac [15/12/2006|19:38] C:\Program Files\TechCity Solutions [30/01/2005|16:32] C:\Program Files\TLC-Edusoft [31/10/2007|17:01] C:\Program Files\TrackMania Nations ESWC [21/10/2007|17:06] C:\Program Files\Ubisoft [01/01/2004|23:54] C:\Program Files\Uninstall Information [11/10/2007|19:17] C:\Program Files\Windows Desktop Search [07/07/2008|20:42] C:\Program Files\Windows Live [07/07/2008|19:54] C:\Program Files\Windows Live Toolbar [23/02/2008|10:50] C:\Program Files\Windows Media Components [30/12/2006|00:31] C:\Program Files\Windows Media Connect 2 [15/05/2008|20:50] C:\Program Files\Windows Media Player [15/05/2008|20:50] C:\Program Files\Windows NT [01/01/2004|23:50] C:\Program Files\WindowsUpdate [01/01/2004|23:51] C:\Program Files\xerox [26/12/2006|23:41] C:\Program Files\Zone Labs --------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs [03/06/2007|11:08] C:\Program Files\Fichiers communs\ACD Systems [13/02/2008|21:27] C:\Program Files\Fichiers communs\Adobe [11/01/2007|20:16] C:\Program Files\Fichiers communs\ArcSoft [05/08/2008|02:02] C:\Program Files\Fichiers communs\BOONTY Shared [22/05/2005|13:36] C:\Program Files\Fichiers communs\EverAd Shared [01/01/2004|21:33] C:\Program Files\Fichiers communs\InstallShield [28/12/2006|20:51] C:\Program Files\Fichiers communs\Java [27/01/2008|11:55] C:\Program Files\Fichiers communs\Microsoft Shared [01/01/2004|23:49] C:\Program Files\Fichiers communs\MSSoap [11/07/2008|14:48] C:\Program Files\Fichiers communs\Oberon Media [02/01/2004|00:45] C:\Program Files\Fichiers communs\ODBC [15/12/2004|05:21] C:\Program Files\Fichiers communs\Services [02/01/2004|00:45] C:\Program Files\Fichiers communs\SpeechEngines [02/01/2004|01:53] C:\Program Files\Fichiers communs\SureThing Shared [15/05/2008|20:50] C:\Program Files\Fichiers communs\System [27/01/2008|11:52] C:\Program Files\Fichiers communs\WindowsLiveInstaller --------------------\\ Process ( 43 Processes ) ... OK ! --------------------\\ Recherche avec S_Lop Aucun fichier / dossier Lop trouvé ! --------------------\\ Recherche de Fichiers / Dossiers Lop Aucun fichier / dossier Lop trouvé ! --------------------\\ Verification du Registre ..... OK ! --------------------\\ Verification du fichier Hosts Fichier Hosts PROPRE --------------------\\ Recherche de fichiers avec Catchme catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-07 00:35:54 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden files: 974 --------------------\\ Recherche d'autres infections C:\WINDOWS\Pack.epk C:\WINDOWS\System32\nvs2.inf C:\WINDOWS\System32\wuhxlnjk.dat.ren C:\WINDOWS\System32\wuhxlnjk_nav.dat.ren C:\WINDOWS\System32\wuhxlnjk_navps.dat.ren ==> EGDACCESS <== [F:1884][D:22]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp [F:46][D:0]-> C:\DOCUME~1\COMPAQ~1\Cookies [F:1271][D:4]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\TEMPOR~1\content.IE5 1 - "C:\Lop SD\LopR_1.txt" - 07/09/2008| 0:07 - Option : [1] 2 - "C:\Lop SD\LopR_2.txt" - 07/09/2008| 0:37 - Option : [2] --------------------\\ Fin du rapport a 0:37:57 Search Navipromo version 3.6.5 commencé le 07/09/2008 à 0:43:53,82 !!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!! !!! Postez ce rapport sur le forum pour le faire analyser !!! !!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!! Outil exécuté depuis C:\Program Files\navilog1 Session actuelle : "Compaq_Propriétaire" Mise à jour le 22.08.2008 à 17h30 par IL-MAFIOSO Microsoft Windows XP [version 5.1.2600] Internet Explorer : 7.0.5730.11 Système de fichiers : NTFS Recherche executé en mode normal *** Recherche Programmes installés *** *** Recherche dossiers dans "C:\WINDOWS" *** *** Recherche dossiers dans "C:\Program Files" *** *** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" *** *** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" *** *** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" *** *** Recherche dossiers dans "C:\Documents and Settings\Compaq_Propriétaire\applic~1" *** *** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" *** *** Recherche dossiers dans "C:\Documents and Settings\Compaq_Propriétaire\locals~1\applic~1" *** *** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *** *** Recherche dossiers dans "C:\DOCUME~1\L2MFIX\locals~1\applic~1" *** *** Recherche dossiers dans "C:\Documents and Settings\Compaq_Propriétaire\menudm~1\progra~1" *** *** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\menudm~1\progra~1" *** *** Recherche avec Catchme-rootkit/stealth malware detector par gmer *** pour + d'infos : http://www.gmer.net *** Recherche avec GenericNaviSearch *** !!! Tous ces résultats peuvent révéler des fichiers légitimes !!! !!! A vérifier impérativement avant toute suppression manuelle !!! * Recherche dans "C:\WINDOWS\system32" * * Recherche dans "C:\Documents and Settings\Compaq_Propriétaire\locals~1\applic~1" * * Recherche dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" * * Recherche dans "C:\DOCUME~1\L2MFIX\locals~1\applic~1" * *** Recherche fichiers *** C:\WINDOWS\pack.epk trouvé ! C:\WINDOWS\system32\nvs2.inf trouvé ! *** Recherche clés spécifiques dans le Registre *** HKEY_CURRENT_USER\Software\Lanconfig trouvé ! *** Module de Recherche complémentaire *** (Recherche fichiers spécifiques) 1)Recherche nouveaux fichiers Instant Access : 2)Recherche Heuristique : * Dans "C:\WINDOWS\system32" : overaiftgb.da_ trouvé ! overaiftgb_nav.da_ trouvé ! overaiftgb_navps.da_ trouvé ! * Dans "C:\Documents and Settings\Compaq_Propriétaire\locals~1\applic~1" : * Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" : * Dans "C:\DOCUME~1\L2MFIX\locals~1\applic~1" : 3)Recherche Certificats : Certificat Egroup trouvé ! Certificat Electronic-Group absent ! Certificat Montorgueil absent ! Certificat OOO-Favorit absent ! Certificat Sunny-Day-Design-Ltd absent ! 4)Recherche fichiers connus : *** Analyse terminée le 07/09/2008 à 0:53:08,04 ***

Bonjour Thanos, Je te remercie pour ta réactivité. Tu trouvera ci-dessous le rapport Lop S&D --------------------\\ Lop S&D 4.2.4-1 XP/Vista Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3 X86-based PC ( Uniprocessor Free : AMD Sempron 3000+ ) BIOS : Rev. 3.11 USER : Compaq_Propriétaire ( Administrator ) BOOT : Normal boot Antivirus : avast! antivirus 4.8.1229 [VPS 080906-0] 4.8.1229 (Not Activated) Firewall : ZoneAlarm Firewall 7.0.462.000 (Activated) "C:\Lop SD" ( MAJ : 06-09-2008|22:02 ) Option : [1] ( 07/09/2008| 0:02 ) --------------------\\ Listing des dossiers dans APPLIC~1 [02/01/2004|02:04] C:\DOCUME~1\ADMINI~1\APPLIC~1\Apple Computer [01/01/2004|23:51] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities [02/01/2004|01:55] C:\DOCUME~1\ADMINI~1\APPLIC~1\Intervideo [26/12/2006|23:34] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft [02/01/2004|02:38] C:\DOCUME~1\ADMINI~1\APPLIC~1\SampleView [02/01/2004|01:08] C:\DOCUME~1\ADMINI~1\APPLIC~1\Sun [01/01/2004|22:38] C:\DOCUME~1\ADMINI~1\APPLIC~1\Symantec [25/12/2006|22:01] C:\DOCUME~1\ADMINI~1\APPLIC~1\Template [03/06/2007|11:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ACD Systems [13/02/2008|21:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe [20/01/2008|13:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple [12/03/2007|22:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer [26/12/2006|21:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVG7 [05/08/2008|02:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOONTY [15/08/2007|15:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Coktel [10/12/2006|19:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink [02/09/2008|09:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Frag great bend logo [27/12/2007|16:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\GameHouse [10/04/2008|14:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\GoBit Games [06/09/2008|09:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google [30/07/2007|00:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft [02/01/2004|01:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InterVideo [25/04/2007|12:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\iWin [09/09/2007|12:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\JollyBear [26/02/2005|14:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Knowledge Adventure [17/07/2008|17:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier [30/09/2007|13:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft [02/01/2004|02:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Motive [15/04/2007|22:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles [26/02/2007|17:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Oberongames [11/07/2008|14:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst [08/04/2007|18:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PopCap [22/07/2006|12:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime [13/06/2007|21:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Recisio [06/01/2007|20:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\RoboForm [23/09/2007|13:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sandlot Games [01/01/2004|23:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI [26/12/2006|23:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec [02/09/2008|21:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP [03/10/2007|17:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia [17/12/2006|00:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage [16/12/2006|00:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar [07/07/2008|20:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller [10/08/2007|10:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom [03/06/2007|11:20] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ACD Systems [21/06/2008|15:36] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Adobe [15/02/2007|22:46] C:\DOCUME~1\COMPAQ~1\APPLIC~1\AdobeUM [28/07/2007|15:24] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Apple Computer [02/12/2007|21:42] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ArcSoft [15/01/2007|23:42] C:\DOCUME~1\COMPAQ~1\APPLIC~1\DivX [16/12/2006|22:58] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Google [18/04/2008|14:02] C:\DOCUME~1\COMPAQ~1\APPLIC~1\gtk-2.0 [26/02/2006|15:03] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Help [04/09/2008|21:41] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Htmvcrect [20/04/2008|12:33] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Identities [15/02/2005|21:49] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Intervideo [25/04/2007|12:10] C:\DOCUME~1\COMPAQ~1\APPLIC~1\iWin [02/02/2005|21:56] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Leadertech [08/02/2007|11:59] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Macromedia [23/06/2008|20:32] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Microsoft [19/09/2006|18:58] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Motive [11/07/2008|14:49] C:\DOCUME~1\COMPAQ~1\APPLIC~1\PlayFirst [02/01/2004|02:38] C:\DOCUME~1\COMPAQ~1\APPLIC~1\SampleView [25/12/2007|22:44] C:\DOCUME~1\COMPAQ~1\APPLIC~1\SecuROM [07/11/2007|21:16] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Snapfish [02/02/2005|21:58] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Sonic [02/01/2004|01:08] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Sun [01/01/2004|22:38] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Symantec [15/02/2005|20:15] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Template [05/08/2008|02:02] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ViquaSoft [01/05/2007|13:41] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Vso [03/01/2007|14:28] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ZapSpot [20/04/2008|12:33] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Zylom [02/01/2004|02:04] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Apple Computer [01/01/2004|23:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities [02/01/2004|01:55] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Intervideo [01/01/2004|23:54] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft [02/01/2004|02:38] C:\DOCUME~1\DEFAUL~1\APPLIC~1\SampleView [02/01/2004|01:08] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun [01/01/2004|22:38] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec [30/09/2007|11:47] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft [26/12/2006|23:34] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft --------------------\\ Tâches planifiées dans C:\WINDOWS\tasks [26/08/2008 23:01][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job [05/08/2004 12:00][-rah-----] C:\WINDOWS\tasks\desktop.ini [06/09/2008 23:25][--ah-----] C:\WINDOWS\tasks\SA.DAT --------------------\\ Listing des dossiers dans C:\Program Files [01/06/2007|21:40] C:\Program Files\7-Zip [03/06/2007|11:07] C:\Program Files\ACD Systems [11/08/2008|09:36] C:\Program Files\Adibou,Je lis, je calcule 4-5 [04/07/2008|09:47] C:\Program Files\Adobe [15/12/2006|19:38] C:\Program Files\Alice [15/12/2006|20:03] C:\Program Files\Alwil Software [20/01/2008|13:38] C:\Program Files\Apple Software Update [18/06/2006|13:37] C:\Program Files\Atout Clic CM2 [03/06/2007|12:49] C:\Program Files\Avi2Dvd [03/06/2007|12:50] C:\Program Files\AviSynth 2.5 [17/07/2008|09:42] C:\Program Files\azebon [23/01/2005|15:35] C:\Program Files\BeachVolleyball [05/08/2008|01:59] C:\Program Files\Boonty [05/08/2008|02:01] C:\Program Files\BoontyGames [26/02/2006|14:57] C:\Program Files\Borland [26/10/2006|13:41] C:\Program Files\Bullfrog [27/12/2006|20:16] C:\Program Files\CCleaner [24/06/2007|23:07] C:\Program Files\CD-ROM Diva Starz [23/02/2007|22:26] C:\Program Files\CENEGA [30/01/2007|17:49] C:\Program Files\Clic d'Api Nø26 [01/01/2004|23:49] C:\Program Files\ComPlus Applications [23/01/2005|20:18] C:\Program Files\Digitale Huehnerjagd [19/01/2005|21:27] C:\Program Files\directx [17/07/2008|09:47] C:\Program Files\Disney Interactive [01/09/2008|21:41] C:\Program Files\DivX [03/06/2008|12:59] C:\Program Files\EA GAMES [01/02/2007|19:49] C:\Program Files\Easy Internet signup [22/05/2005|13:46] C:\Program Files\English Fever [02/09/2008|21:27] C:\Program Files\Fichiers communs [15/12/2007|22:15] C:\Program Files\FLV Player [11/07/2008|19:18] C:\Program Files\Gamenext [11/07/2008|14:48] C:\Program Files\GamesBar [23/01/2008|20:24] C:\Program Files\GIMP-2.0 [06/09/2008|09:49] C:\Program Files\Google [10/02/2007|14:00] C:\Program Files\Grisoft [02/01/2004|02:13] C:\Program Files\Help and Support Additions [11/01/2007|20:13] C:\Program Files\Hercules [01/09/2006|12:55] C:\Program Files\HighwayPursuit [06/09/2008|23:36] C:\Program Files\hijackthis [13/02/2005|16:26] C:\Program Files\Hits Collection [02/09/2008|09:21] C:\Program Files\Htmvcrect [29/12/2007|17:09] C:\Program Files\InstallShield Installation Information [13/08/2008|11:41] C:\Program Files\Internet Explorer [15/01/2005|14:50] C:\Program Files\InterVideo [29/07/2008|21:25] C:\Program Files\Java [21/01/2005|20:33] C:\Program Files\jetspeed [13/06/2007|21:21] C:\Program Files\KaraFun [10/10/2007|20:37] C:\Program Files\Lambda [31/01/2007|22:11] C:\Program Files\LaserMedia [10/10/2007|20:34] C:\Program Files\Maxis [20/02/2007|22:48] C:\Program Files\MeowCdMp3 [13/08/2008|11:43] C:\Program Files\Messenger [01/01/2004|23:51] C:\Program Files\microsoft frontpage [05/01/2007|22:29] C:\Program Files\Microsoft Office [30/09/2007|11:41] C:\Program Files\Microsoft SQL Server Compact Edition [24/01/2005|20:21] C:\Program Files\Microsoft Works [28/06/2007|16:40] C:\Program Files\Mindscape [15/05/2008|20:53] C:\Program Files\Movie Maker [14/09/2006|20:40] C:\Program Files\MP3 Player Utilities [25/12/2007|16:48] C:\Program Files\MP3 Player Utilities 4.03 [11/09/2007|19:16] C:\Program Files\MSBuild [13/08/2008|20:22] C:\Program Files\MSN [09/10/2007|20:53] C:\Program Files\MSN Games [01/01/2004|23:48] C:\Program Files\MSN Gaming Zone [12/09/2007|12:54] C:\Program Files\MSXML 6.0 [26/02/2006|14:57] C:\Program Files\Mvm [15/05/2008|20:50] C:\Program Files\NetMeeting [23/02/2008|10:48] C:\Program Files\NRJ [01/01/2004|23:48] C:\Program Files\Online Services [15/05/2008|20:50] C:\Program Files\Outlook Express [15/08/2007|14:54] C:\Program Files\Pac-Manic Worlds [03/09/2008|13:05] C:\Program Files\Panda Security [02/01/2004|02:14] C:\Program Files\PC-Doctor for Windows [11/05/2007|18:31] C:\Program Files\PDFCreator [24/01/2005|20:33] C:\Program Files\Phenomedia AG [04/06/2008|20:46] C:\Program Files\Picasa2 [29/12/2007|17:34] C:\Program Files\QuickTime [09/10/2007|20:59] C:\Program Files\RAMpage [11/09/2007|19:10] C:\Program Files\Reference Assemblies [09/09/2007|19:06] C:\Program Files\RegCleaner [24/07/2008|15:46] C:\Program Files\RoadRoll [14/03/2007|22:02] C:\Program Files\SdLL [11/02/2005|21:16] C:\Program Files\Serpik [02/01/2004|02:20] C:\Program Files\Services en ligne [06/01/2007|20:21] C:\Program Files\Siber Systems [01/01/2004|21:33] C:\Program Files\SiS VGA Utilities V3.59e [24/04/2005|13:04] C:\Program Files\Small Rockets [11/02/2005|21:13] C:\Program Files\Snoopy [02/01/2004|01:53] C:\Program Files\Sonic [02/01/2004|01:53] C:\Program Files\Sonic RecordNow! [01/05/2008|20:19] C:\Program Files\Sun [17/07/2008|10:00] C:\Program Files\SuperMarioPac [15/12/2006|19:38] C:\Program Files\TechCity Solutions [30/01/2005|16:32] C:\Program Files\TLC-Edusoft [31/10/2007|17:01] C:\Program Files\TrackMania Nations ESWC [21/10/2007|17:06] C:\Program Files\Ubisoft [01/01/2004|23:54] C:\Program Files\Uninstall Information [11/10/2007|19:17] C:\Program Files\Windows Desktop Search [07/07/2008|20:42] C:\Program Files\Windows Live [07/07/2008|19:54] C:\Program Files\Windows Live Toolbar [23/02/2008|10:50] C:\Program Files\Windows Media Components [30/12/2006|00:31] C:\Program Files\Windows Media Connect 2 [15/05/2008|20:50] C:\Program Files\Windows Media Player [15/05/2008|20:50] C:\Program Files\Windows NT [01/01/2004|23:50] C:\Program Files\WindowsUpdate [01/01/2004|23:51] C:\Program Files\xerox [26/12/2006|23:41] C:\Program Files\Zone Labs --------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs [03/06/2007|11:08] C:\Program Files\Fichiers communs\ACD Systems [13/02/2008|21:27] C:\Program Files\Fichiers communs\Adobe [11/01/2007|20:16] C:\Program Files\Fichiers communs\ArcSoft [05/08/2008|02:02] C:\Program Files\Fichiers communs\BOONTY Shared [22/05/2005|13:36] C:\Program Files\Fichiers communs\EverAd Shared [01/01/2004|21:33] C:\Program Files\Fichiers communs\InstallShield [28/12/2006|20:51] C:\Program Files\Fichiers communs\Java [27/01/2008|11:55] C:\Program Files\Fichiers communs\Microsoft Shared [01/01/2004|23:49] C:\Program Files\Fichiers communs\MSSoap [11/07/2008|14:48] C:\Program Files\Fichiers communs\Oberon Media [02/01/2004|00:45] C:\Program Files\Fichiers communs\ODBC [15/12/2004|05:21] C:\Program Files\Fichiers communs\Services [02/01/2004|00:45] C:\Program Files\Fichiers communs\SpeechEngines [02/01/2004|01:53] C:\Program Files\Fichiers communs\SureThing Shared [15/05/2008|20:50] C:\Program Files\Fichiers communs\System [27/01/2008|11:52] C:\Program Files\Fichiers communs\WindowsLiveInstaller --------------------\\ Process ( 42 Processes ) IEXPLORE.EXE ~ [PID:3168] iexplore.exe ~ [PID:3532] --------------------\\ Recherche avec S_Lop Aucun fichier / dossier Lop trouvé ! --------------------\\ Recherche de Fichiers / Dossiers Lop C:\DOCUME~1\ALLUSE~1\APPLIC~1\Frag great bend logo C:\DOCUME~1\ALLUSE~1\APPLIC~1\Frag great bend logo\thunk chin.exe --------------------\\ Verification du Registre [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "bend logo clock film"="C:\\Documents and Settings\\All Users\\Application Data\\Frag great bend logo\\thunk chin.exe" --------------------\\ Verification du fichier Hosts Fichier Hosts PROPRE --------------------\\ Recherche de fichiers avec Catchme catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-07 00:04:37 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden files: 974 --------------------\\ Recherche d'autres infections C:\WINDOWS\Pack.epk C:\WINDOWS\System32\nvs2.inf C:\WINDOWS\System32\wuhxlnjk.dat.ren C:\WINDOWS\System32\wuhxlnjk_nav.dat.ren C:\WINDOWS\System32\wuhxlnjk_navps.dat.ren ==> EGDACCESS <== [F:1886][D:22]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp [F:30][D:0]-> C:\DOCUME~1\COMPAQ~1\Cookies [F:633][D:4]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\TEMPOR~1\content.IE5 1 - "C:\Lop SD\LopR_1.txt" - 07/09/2008| 0:07 - Option : [1] --------------------\\ Fin du rapport a 0:07:34

Bonjour, depuis quelques jour, j'ai des fenetres publicitaires qui s'ouvres toute seules. J'ai procédé au prénettoyage de mon PC comme indiqué sur le post de megapaute avec antivir. Il y avaient des virus et des logiciels espions. (Avast ne les avaient pas trouvé) Le problème continu. Je me permet de vous poster le log hijackthis pour analyse. Merci d'avance. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:36:06, on 06/09/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\windows\system\hpsysdrv.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\system32\keyhook.exe C:\WINDOWS\AGRSMMSG.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\RAMpage\RAMpage.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Fichiers communs\ACD Systems\FR\DevDetect.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\PCHButton.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\Compaq_Propriétaire\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe C:\Documents and Settings\Compaq_Propriétaire\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe C:\Program Files\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.msn.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.defaulthomepage.info R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [siS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RAMpage] "C:\Program Files\RAMpage\RAMpage.exe" M=28 T=4 P="C:\Program Files\RAMpage\RAMpageConfig.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Fichiers communs\ACD Systems\FR\DevDetect.exe" -autorun O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [bend logo clock film] C:\Documents and Settings\All Users\Application Data\Frag great bend logo\thunk chin.exe O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\PCHButton.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - Startup: Outil de notification Live Search.lnk = ? O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.03\AMVConverter\grab.html O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.03\MediaManager\grab.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://www.3suisses.fr O15 - Trusted Zone: http://www.adobe.com O15 - Trusted Zone: http://abonnement.aliceadsl.fr O15 - Trusted Zone: http://www.bpbfc.banquepopulaire.fr O15 - Trusted Zone: http://www.caisse-epargne.fr O15 - Trusted Zone: http://www.conrad.fr O15 - Trusted Zone: http://www.cybergrattage.com O15 - Trusted Zone: http://www.extrafilm.fr O15 - Trusted Zone: http://www.agence.francetelecom.com O15 - Trusted Zone: http://www.goldsofts.com O15 - Trusted Zone: http://www.impots.gouv.fr O15 - Trusted Zone: http://www.ledemondujeu.com O15 - Trusted Zone: http://www.quelle.fr O15 - Trusted Zone: http://www.sunsilk.fr O15 - Trusted Zone: http://www.viamichelin.fr O15 - Trusted Zone: http://download.zonelabs.com O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab O16 - DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} - http://messenger.zone.msn.com/binary/MJSS.cab69309.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/frame...geUploader5.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://www.shockwave.com/content/dinerdash...h2.1.0.0.67.cab O16 - DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} (CPlayFirstDoggieDashControl Object) - http://webgames.d.tmsrv.com/c=ed2c06a087cb...ash.1.0.0.6.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/webplayer/stage6/...owserPlugin.cab O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.extrafilm.fr/ImageUploader4.cab O16 - DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} (GameHouse Games Player) - http://www.gamehouse.com/realarcade-webgam...houseplayer.cab O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://oceceocece.spaces.live.com/PhotoUpload/MsnPUpld.cab O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/a...gnerADP-1.0.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://abonnement.aliceadsl.fr/configurate...countHelper.cab O16 - DPF: {935F9B04-0C7B-4454-A391-348C54AD7ADD} (Jolly Bear Games Player) - http://www.shockwave.com/content/bigcityad...BGamePlayer.cab O16 - DPF: {A73BAEFA-EE65-494D-BEDB-DD3E5A34FA98} (Image Uploader) - http://www.extrafilm.fr/ImageUploader4.cab O16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) - http://www.gamehouse.com/realarcade-webgam...GamesPlayer.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://www.shockwave.com/content/dinerdash...tg.1.0.0.33.cab O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://www.gamehouse.com/realarcade-webgam...zylomplayer.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.photobox.fr/discount/clients/up...r_v2.1.0.56.cab O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxenligne.orange.fr/Gameshell/Gam...ronGameHost.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553541000} - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O16 - DPF: {D40F5876-A494-4124-8161-82625BB28C06} (CPlayFirstChocolatieControl Object) - http://www.gamehouse.com/realarcade-webgam...hocolatier2.cab O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://www.gamehouse.com/realarcade-webgam...inematycoon.cab O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://msnfr.oberon-media.com/online2/MSN_...sh.1.0.0.80.cab O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/layou...IPSUploader.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/chuzzle/s...ploader_v10.cab O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://msnfr.oberon-media.com/online2/MSN_...gamesloader.cab O16 - DPF: {EA6246B4-F380-443F-8727-9AEA3371146C} (CPlayFirstWeddingDashControl Object) - http://www.gamehouse.com/realarcade-webgam...WeddingDash.cab O16 - DPF: {F4EBFE42-D82A-48EB-B70E-7499FFEAFF3F} (CPlayFirstDressShopHControl Object) - http://webgames.d.tmsrv.com/c=ed2c06a087cb...Web.1.0.0.7.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Service de l'iPod (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 14778 bytes

Bonjour dmicke6, Je te remercie de ta réactivité, Je vais me rapprocher d'ALICE. Je vous recontacte dés que j'ai des nouvelles. Merci

Bonjour, J'ai un abonnement ALICE NU ABONNEMENT TEL INCLUS Jusqu'il y à quelques semaines, tout alait bien, J'avais un débit entre 1,2 et 2 Méga/s aux heures de pointes. Depuis quelques semaines, j'ai remarqué une perte énorme de débit Aux heures de pointes, je dépasse rarement les 300 Kb/s Voici ci-dessous les caractéristiques de ma ligne: Numéro de téléphone : Code NRA : BRA89 NRA (commutateur local) : BRANNAY Distance vous séparant du central : 1477 m (détails) Taux d'atténuation : 22.15 dB Débit ADSL (estimation) : 2 Mbps Débit ADSL2+ (estimation, si disponible) : 2 Mbps Nombre de lignes téléphoniques : 1 500 Type de DSLAM : ALCATEL Votre répartiteur n'est actuellement pas équipé pour l'ADSL. Le raccordement de votre répartiteur en ADSL est prévus pour le le : 05-11-2007 Avez-vous déjà rencontré ce problème? La perte de débit aux heurs de pointes est-elle normale? (J'habite à la campagne) Dois-je contacter ALICE? Que signifie la ligne: Votre répartiteur n'est actuellement pas équipé pour l'ADSL. Le raccordement de votre répartiteur en ADSL est prévus pour le le : 05-11-2007

Bonjour Mykerinos, après plusieurs jour de surveillance, tout à l'air correcte. Je t'en remercie vraiement beaucoup. Peux-tu me conseiller sur ma protection? Actuellement installé sur ma machine: Zone alarme free AVG Anti-spyware free SpywareGuard Avast Suis-je bien protégé ?

Bonjour Mykerinos et bonne année. Ci dessous nouveau rapport Blacklight. Apparemment, je n'ai plus de fenêtres EI qui s'ouvrent toute seule. Suite à ton conseil, j'ai téléchargé ZONE ALARME. C'est une version d'évaluation valable 15 Jours, connais-tu une version gratuite? 01/02/07 20:11:41 [info]: BlackLight Engine 1.0.55 initialized 01/02/07 20:11:41 [info]: OS: 5.1 build 2600 (Service Pack 2) 01/02/07 20:11:42 [Note]: 7019 4 01/02/07 20:11:42 [Note]: 7005 0 01/02/07 20:11:44 [Note]: 7006 0 01/02/07 20:11:44 [Note]: 7011 1472 01/02/07 20:11:44 [Note]: 7026 0 01/02/07 20:11:45 [Note]: 7026 0 01/02/07 20:12:04 [Note]: FSRAW library version 1.7.1021 01/02/07 20:21:26 [Note]: 7007 0

Après BFU, ci dessous nouveaux log Blacklight et HijackThis 12/30/06 22:47:58 [info]: BlackLight Engine 1.0.55 initialized 12/30/06 22:47:58 [info]: OS: 5.1 build 2600 (Service Pack 2) 12/30/06 22:47:58 [Note]: 7019 4 12/30/06 22:47:58 [Note]: 7005 0 12/30/06 22:48:09 [Note]: 7006 0 12/30/06 22:48:09 [Note]: 7011 1460 12/30/06 22:48:10 [Note]: 7026 0 12/30/06 22:48:10 [Note]: 7026 0 12/30/06 22:48:10 [Note]: 7024 3 12/30/06 22:48:10 [info]: Hidden process: C:\windows\system32\vtmxyuio.exe 12/30/06 22:48:24 [Note]: FSRAW library version 1.7.1021 12/30/06 22:52:35 [info]: Hidden file: c:\WINDOWS\system32\vtmxyuio.dat 12/30/06 22:52:35 [Note]: 10002 1 12/30/06 22:52:35 [info]: Hidden file: C:\windows\system32\vtmxyuio.exe 12/30/06 22:52:35 [Note]: 10002 1 12/30/06 22:52:35 [info]: Hidden file: c:\WINDOWS\system32\vtmxyuio_nav.dat 12/30/06 22:52:35 [Note]: 10002 1 12/30/06 22:52:35 [info]: Hidden file: c:\WINDOWS\system32\vtmxyuio_navps.dat 12/30/06 22:52:35 [Note]: 10002 1 12/30/06 22:53:00 [Error]: 6019 0 12/30/06 22:53:00 [Error]: 6017 0 Logfile of HijackThis v1.99.1 Scan saved at 22:55:22, on 30/12/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\windows\system\hpsysdrv.exe C:\HP\KBD\KBD.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\keyhook.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Java\jre1.6.0\bin\jusched.exe C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\PCHButton.exe C:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\HJT\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://aliceadsl.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [siS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\PCHButton.exe O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [iNTERNATIONAL] International* O15 - Trusted Zone: http://www.adobe.com O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://abonnement.aliceadsl.fr/configurate...countHelper.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Ci-dessous le rapport BlackLight ainsi que la liste Hijackthis 12/29/06 23:45:27 [info]: BlackLight Engine 1.0.55 initialized 12/29/06 23:45:27 [info]: OS: 5.1 build 2600 (Service Pack 2) 12/29/06 23:45:27 [Note]: 7019 4 12/29/06 23:45:27 [Note]: 7005 0 12/29/06 23:45:35 [Note]: 7006 0 12/29/06 23:45:35 [Note]: 7011 1480 12/29/06 23:45:36 [Note]: 7026 0 12/29/06 23:45:36 [Note]: 7026 0 12/29/06 23:45:36 [Note]: 7024 3 12/29/06 23:45:36 [info]: Hidden process: C:\windows\system32\vtmxyuio.exe 12/29/06 23:45:50 [Note]: FSRAW library version 1.7.1021 12/29/06 23:49:45 [info]: Hidden file: c:\WINDOWS\system32\vtmxyuio.dat 12/29/06 23:49:45 [Note]: 10002 1 12/29/06 23:49:45 [info]: Hidden file: C:\windows\system32\vtmxyuio.exe 12/29/06 23:49:45 [Note]: 10002 1 12/29/06 23:49:45 [info]: Hidden file: c:\WINDOWS\system32\vtmxyuio_nav.dat 12/29/06 23:49:45 [Note]: 10002 1 12/29/06 23:49:45 [info]: Hidden file: c:\WINDOWS\system32\vtmxyuio_navps.dat 12/29/06 23:49:45 [Note]: 10002 1 12/29/06 23:57:01 [Note]: 7007 0 "Je Crée Ma Cuisine Avec Leroy-Merlin" 101 Dalmatiens LAI Absolute Mastermind v1.4 Adobe Flash Player 9 ActiveX Adobe Reader 7.0 - Français Agent Rico II Mission Pack Agere Systems PCI Soft Modem Aladdin Alice Auto-diagnostic Aspirin Protector Atout Clic CM2 avast! Antivirus AVG Anti-Spyware 7.5 AviSynth 2.5 Azebon Installation Beach Volleyball (remove only) BlindWrite 6 Bob le Bricoleur - Bob construit un parc Cake Mania Deluxe CCleaner (remove only) CD-ROM Diva Starz Cédric - Chen a disparu Charlie II (Remove) Clic d'Api N°26 Client Windows Rights Management avec Service Pack 2 Connexion Facile à Internet Correctif pour Windows XP (KB914440) Correctif pour Windows XP (KB928388) Correctif pour Windows XP (KB929120) Correctif Windows XP - KB873339 Correctif Windows XP - KB885835 Correctif Windows XP - KB885836 Correctif Windows XP - KB886185 Correctif Windows XP - KB887472 Correctif Windows XP - KB888302 Correctif Windows XP - KB890859 Correctif Windows XP - KB891781 Dictee6e Dictées6e Digitale Huehnerjagd Disney Tarzan, Atelier de Jeux DivX Player DivX Pro Trial DMSI - v1.04 DVD Shrink 3.2 DXtris 1.5 ffvfw MPEG-4 Video Codec (uninstall only) Freeride Thrash Funny Camp Google Toolbar for Internet Explorer Happyland Adventures - Xmas Edition v1.3 Help and Support Additions High Definition Audio Driver Package - KB835221 Highway Pursuit v1.1 HijackThis 1.99.1 Hotfix for Windows XP (KB915865) Hotfix for Windows XP (KB926239) Iggle Pop Deluxe InterVideo WinDVD Creator 2 InterVideo WinDVD Player iTunes Java SE Runtime Environment 6 Kawasaki ATV PowerSports DEMO KBD Kit de Connexion Alice ADSL Kookabonga La savane en folie Lecteur Windows Media 11 Les Chemins de la Lecture Les MOUZZ 2000 Les Sims : Entre Chiens et Chats Menus intelligents (Windows Live Toolbar) MeowCdMp3 1.00 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 French Language Pack Microsoft .NET Framework 1.1 Hotfix (KB886903) Microsoft .NET Framework 2.0 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Works 7.0 Millie dans la vallée des géants MiniMouzz Mise à jour de sécurité pour Lecteur Windows Media (KB911564) Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398) Mise à jour de sécurité pour Lecteur Windows Media 9 (KB917734) Mise à jour de sécurité pour Step by Step Interactive Training (KB898458) Mise à jour de sécurité pour Windows XP (KB893756) Mise à jour de sécurité pour Windows XP (KB896358) Mise à jour de sécurité pour Windows XP (KB896423) Mise à jour de sécurité pour Windows XP (KB896424) Mise à jour de sécurité pour Windows XP (KB896428) Mise à jour de sécurité pour Windows XP (KB899587) Mise à jour de sécurité pour Windows XP (KB899591) Mise à jour de sécurité pour Windows XP (KB900725) Mise à jour de sécurité pour Windows XP (KB901017) Mise à jour de sécurité pour Windows XP (KB901214) Mise à jour de sécurité pour Windows XP (KB902400) Mise à jour de sécurité pour Windows XP (KB904706) Mise à jour de sécurité pour Windows XP (KB905414) Mise à jour de sécurité pour Windows XP (KB905749) Mise à jour de sécurité pour Windows XP (KB908519) Mise à jour de sécurité pour Windows XP (KB911562) Mise à jour de sécurité pour Windows XP (KB911927) Mise à jour de sécurité pour Windows XP (KB912919) Mise à jour de sécurité pour Windows XP (KB913580) Mise à jour de sécurité pour Windows XP (KB914388) Mise à jour de sécurité pour Windows XP (KB914389) Mise à jour de sécurité pour Windows XP (KB917344) Mise à jour de sécurité pour Windows XP (KB917422) Mise à jour de sécurité pour Windows XP (KB917953) Mise à jour de sécurité pour Windows XP (KB918439) Mise à jour de sécurité pour Windows XP (KB919007) Mise à jour de sécurité pour Windows XP (KB920213) Mise à jour de sécurité pour Windows XP (KB920670) Mise à jour de sécurité pour Windows XP (KB920683) Mise à jour de sécurité pour Windows XP (KB920685) Mise à jour de sécurité pour Windows XP (KB921398) Mise à jour de sécurité pour Windows XP (KB922616) Mise à jour de sécurité pour Windows XP (KB922819) Mise à jour de sécurité pour Windows XP (KB923191) Mise à jour de sécurité pour Windows XP (KB923414) Mise à jour de sécurité pour Windows XP (KB923689) Mise à jour de sécurité pour Windows XP (KB923694) Mise à jour de sécurité pour Windows XP (KB923980) Mise à jour de sécurité pour Windows XP (KB924191) Mise à jour de sécurité pour Windows XP (KB924270) Mise à jour de sécurité pour Windows XP (KB924496) Mise à jour de sécurité pour Windows XP (KB925454) Mise à jour de sécurité pour Windows XP (KB925486) Mise à jour de sécurité pour Windows XP (KB926255) Mise à jour pour Windows XP (KB894391) Mise à jour pour Windows XP (KB898461) Mise à jour pour Windows XP (KB900485) Mise à jour pour Windows XP (KB904942) Mise à jour pour Windows XP (KB908531) Mise à jour pour Windows XP (KB910437) Mise à jour pour Windows XP (KB911280) Mise à jour pour Windows XP (KB916595) Mise à jour pour Windows XP (KB920342) Mise à jour pour Windows XP (KB920872) Mise à jour pour Windows XP (KB922582) Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA Monopoli-fr V2 (iltis-jp.com) Moorhuhn 2 V1.1 Moraff's Jiggler 3D 2.0 MP3 Player Utilities NATHAN Vacances CM2 V.1.00 (C:) Norton Internet Security NVIDIA Drivers Package de base Microsoft de service de chiffrement pour cartes à puce Pac-Manic Worlds ver 1.0 PC-Doctor pour Windows PS2 Python 2.2 combined Win32 extensions Python 2.2.1 QuickTime rayman2 Sabrina Scooby-Doo, Panique dans la Ville fantôme Serpik SimCity 3000 SiS VGA Utilities Snoopy 1.0 Sonic RecordNow! SP2 de compatibilité descendante du client Windows Rights Management SpywareBlaster v3.5.1 SpywareGuard v2.2 Street Tennis Super Mario Pac v1.1 Tarzan Jeu D'Action TONICT TrackMania Nations ESWC 0.1.7.5 VirtualDub-MPEG2 v1.6.15 b24458 Fr Voyage au Pays de la Lecture WebMediaPlayer Windows Installer 3.1 (KB893803) Windows Internet Explorer 7 Windows Live Messenger Windows Live Sign-in Assistant Windows Live Toolbar Windows Live Toolbar Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Format SDK Hotfix - KB891122 Windows Media Player 11 XviD 1.1 final uninstall ZoneAlarm

Après avoir installé la nouvelle console java, doit-je reposter les rapports hijackthis et L2mfix option 2 ? Pour info, toujours le même problème.

Voici les deux rapports. Pour info, j'ai toujours des fenetres Internet Explorer qui s'ouvrent toute seule avec de soi-disant antivirus, voyantes .... L2mfix 032106 Creating Account. La commande s'est termin‚e correctement. Adding Administrative privleges. Checking for L2MFix account(0=no 1=yes): 1 Granting SeDebugPrivilege to L2MFIX ... successful Running From: C:\WINDOWS\system32 Killing Processes! Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright© 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 600 'smss.exe' Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright© 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 692 'winlogon.exe' Killing PID 692 'winlogon.exe' Killing PID 692 'winlogon.exe' Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright© 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 1464 'explorer.exe' Killing PID 1464 'explorer.exe' Killing PID 1464 'explorer.exe' Killing PID 1464 'explorer.exe' Killing PID 1464 'explorer.exe' Killing PID 1464 'explorer.exe' Killing PID 1464 'explorer.exe' Killing PID 1464 'explorer.exe' Killing PID 1464 'explorer.exe' Killing PID 1464 'explorer.exe' Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright© 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 2552 'rundll32.exe' Killing PID 2552 'rundll32.exe' Killing PID 2552 'rundll32.exe' Restoring Sedebugprivilege: Granting SeDebugPrivilege to Administrateurs ... successful Scanning First Pass. Please Wait! First Pass Completed Second Pass Scanning Second pass Completed! Restoring Windows Update Certificates.: The following Is the Current Export of the Winlogon notify key: **************************************************************************** Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] @="" "DLLName"="igfxsrvc.dll" "Asynchronous"=dword:00000001 "Impersonate"=dword:00000001 "Unlock"="WinlogonUnlockEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 The following are the files found: **************************************************************************** Registry Entries that were Deleted: Please verify that the listing looks ok. If there was something deleted wrongly there are backups in the backreg folder. **************************************************************************** REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] REGEDIT4 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "SV1"="" **************************************************************************** Desktop.ini Contents: **************************************************************************** **************************************************************************** Checking for L2MFix account(0=no 1=yes): 0 Zipping up files for submission: zip warning: name not matched: dlls\*.* zip error: Nothing to do! (backup.zip) adding: backregs/notibac.reg (164 bytes security) (deflated 87%) adding: backregs/shell.reg (164 bytes security) (deflated 73%) Logfile of HijackThis v1.99.1 Scan saved at 19:26:06, on 28/12/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\windows\system\hpsysdrv.exe C:\HP\KBD\KBD.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\keyhook.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\PCHButton.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\HJT\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://aliceadsl.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [siS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\PCHButton.exe O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://abonnement.aliceadsl.fr/configurate...countHelper.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Bonjour Mykerinos, Après avoir suivi tes conseils, tu pourras trouver ci-dessous les rapports HijackThis et L2mfix Logfile of HijackThis v1.99.1 Scan saved at 20:50:28, on 27/12/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\windows\system\hpsysdrv.exe C:\HP\KBD\KBD.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\keyhook.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\PCHButton.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\HJT\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://aliceadsl.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843 O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [siS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\PCHButton.exe O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://abonnement.aliceadsl.fr/configurate...countHelper.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe L2MFIX find log 032106 These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] @="" "DLLName"="igfxsrvc.dll" "Asynchronous"=dword:00000001 "Impersonate"=dword:00000001 "Unlock"="WinlogonUnlockEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia" "{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM" "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS" "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile" "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage" "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension" "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration" "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage ?cran du Panneau de configuration" "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration" "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS" "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚" "{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement" "{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette" "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows" "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM" "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM" "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers" "{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web" "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI" "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage" "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents" "{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal" "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts" "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC" "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes" "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage" "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension" "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO" "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign" "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau" "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau" "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo" "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo" "{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo" "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo" "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo" "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension" "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows" "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft" "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler" "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension" "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es" "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults" "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension" "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer" "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher" "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support" "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support" "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..." "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet" "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique" "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices" "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration" "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Page de propri‚t‚s des versions pr‚c‚dentes" "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Versions pr‚c‚dentes" "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler" "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler" "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler" "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler" "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler" "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor" "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft" "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="?tat du t‚l‚chargement" "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu" "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚" "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy" "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft" "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="IE Search Band" "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche" "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web" "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre" "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse" "{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse" "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft" "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor" "{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU" "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU" "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible" "{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante" "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft" "{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft" "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft" "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes" "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp" "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau" "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite" "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur" "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global" "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band" "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service" "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer" "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture" "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut" "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service" "{FF393560-C2A7-11CF-BFF4-444553540000}"="History" "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook" "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4" "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook" "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC" "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC" "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet" "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space" "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band" "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder" "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck" "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr" "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder" "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler" "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent" "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent" "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent" "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent" "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent" "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler" "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement" "{0B124F8F-91F0-11D1-B8B5-006008059382}"="?num‚rateur d'applications install‚es" "{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin" "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs" "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory" "{00E7B358-F65B-4dcf-83DF-CD026B94BFD4}"="Autoplay for SlideShow" "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI" "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)" "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML" "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler" "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web" "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web" "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell" "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport" "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs" "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler" "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target" "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder" "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview" "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext" "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control" "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control" "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control" "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control" "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control" "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI" "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object" "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find" "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find" "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI" "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs" "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook" "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target" "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties" "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu" "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options" "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion" "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler" "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell" "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%" "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler" "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer" "{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..." "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler" "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler" "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler" "{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache" "{DEE12703-6333-4D4E-8F34-738C4DCC2E04}"="RecordNow! SendToExt" "{7F67036B-66F1-411A-AD85-759FB9C5B0DB}"="SampleView" "{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class" "{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer" "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu" "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu" "{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper" "{285EC065-CD3F-4B3F-A1EF-BE422A7AB83E}"="DMSI" "{472083B0-C522-11CF-8763-00608CC02F24}"="avast" "{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}"="Messenger Sharing Folders" "{07C45BB1-4A8C-4642-A1F5-237E7215FF66}"="IE Microsoft BrowserBand" "{1C1EDB47-CE22-4bbb-B608-77B48F83C823}"="IE Fade Task" "{205D7A97-F16D-4691-86EF-F3075DCCA57D}"="IE Menu Desk Bar" "{3028902F-6374-48b2-8DC6-9725E775B926}"="IE AutoComplete" "{43886CD5-6529-41c4-A707-7B3C92C05E68}"="IE Navigation Bar" "{44C76ECD-F7FA-411c-9929-1B77BA77F524}"="IE Menu Site" "{4B78D326-D922-44f9-AF2A-07805C2A3560}"="IE Menu Band" "{6038EF75-ABFC-4e59-AB6F-12D397F6568D}"="IE Microsoft History AutoComplete List" "{6B4ECC4F-16D1-4474-94AB-5A763F2A54AE}"="IE Tracking Shell Menu" "{6CF48EF8-44CD-45d2-8832-A16EA016311B}"="IE IShellFolderBand" "{73CFD649-CD48-4fd8-A272-2070EA56526B}"="IE BandProxy" "{98FF6D4B-6387-4b0a-8FBD-C5C4BB17B4F8}"="IE MRU AutoComplete List" "{9A096BB5-9DC3-4D1C-8526-C3CBF991EA4E}"="IE RSS Feeder Folder" "{9D958C62-3954-4b44-8FAB-C4670C1DB4C2}"="IE Microsoft Shell Folder AutoComplete List" "{B31C5FAE-961F-415b-BAF0-E697A5178B94}"="IE Microsoft Multiple AutoComplete List Container" "{BC476F4C-D9D7-4100-8D4E-E043F6DEC409}"="Microsoft Browser Architecture" "{BFAD62EE-9D54-4b2a-BF3B-76F90697BD2A}"="IE Shell Rebar BandSite" "{E6EE9AAC-F76B-4947-8260-A9F136138E11}"="IE Shell Band Site Menu" "{F2CF5485-4E02-4f68-819C-B92DE9277049}"="&Links" "{F83DAC1C-9BB9-4f2b-B619-09819DA81B0E}"="IE Registry Tree Options Utility" "{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75}"="IE User Assist" "{FDE7673D-2E19-4145-8376-BBD58C4BC7BA}"="IE Custom MRU AutoCompleted List" "{21569614-B795-46b1-85F4-E737A8DC09AD}"="Shell Search Band" "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"="Shell Extension for Malware scanning" ********************************************************************************** HKEY ROOT CLASSIDS: ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ admparse.dll Tue 7 Nov 2006 3:26:44 A.... 71 680 70,00 K advpack.dll Tue 7 Nov 2006 3:26:24 A.... 123 904 121,00 K browseui.dll Mon 23 Oct 2006 16:34:36 A.... 1 022 976 999,00 K cdfview.dll Mon 23 Oct 2006 16:34:36 A.... 152 064 148,50 K danim.dll Mon 23 Oct 2006 16:34:36 A.... 1 056 768 1,01 M dxtmsft.dll Tue 17 Oct 2006 11:58:06 A.... 346 624 338,50 K dxtrans.dll Tue 17 Oct 2006 11:57:50 A.... 214 528 209,50 K extmgr.dll Tue 7 Nov 2006 21:03:36 A.... 131 584 128,50 K icardie.dll Tue 17 Oct 2006 11:58:20 ..... 61 952 60,50 K ieakeng.dll Tue 7 Nov 2006 3:26:56 A.... 152 064 148,50 K ieaksie.dll Tue 7 Nov 2006 3:27:02 A.... 229 376 224,00 K ieakui.dll Tue 7 Nov 2006 3:25:14 A.... 161 792 158,00 K ieapfltr.dll Tue 17 Oct 2006 11:27:56 ..... 380 928 372,00 K iedkcs32.dll Tue 7 Nov 2006 3:27:10 A.... 382 976 374,00 K ieencode.dll Tue 17 Oct 2006 12:06:00 A.... 78 336 76,50 K ieframe.dll Tue 7 Nov 2006 21:03:36 ..... 6 049 280 5,77 M iepeers.dll Tue 7 Nov 2006 21:03:36 A.... 191 488 187,00 K iernonce.dll Tue 7 Nov 2006 3:26:28 A.... 43 008 42,00 K iertutil.dll Tue 17 Oct 2006 11:57:20 ..... 266 752 260,50 K iesetup.dll Tue 7 Nov 2006 3:26:42 A.... 55 296 54,00 K ieui.dll Tue 7 Nov 2006 21:03:36 ..... 180 736 176,50 K im64.dll Fri 15 Dec 2006 18:40:40 A.... 162 0,16 K imgutil.dll Tue 17 Oct 2006 11:57:58 A.... 36 352 35,50 K inetcomm.dll Wed 8 Nov 2006 6:07:30 A.... 679 424 663,50 K inseng.dll Tue 7 Nov 2006 3:26:24 A.... 92 672 90,50 K jscript.dll Tue 17 Oct 2006 12:00:00 A.... 491 520 480,00 K jsproxy.dll Tue 7 Nov 2006 21:03:36 A.... 27 136 26,50 K licmgr10.dll Tue 17 Oct 2006 12:05:10 A.... 40 960 40,00 K msfeeds.dll Tue 7 Nov 2006 21:03:36 ..... 458 752 448,00 K msfeed~1.dll Tue 7 Nov 2006 21:03:36 ..... 50 688 49,50 K mshtml.dll Tue 7 Nov 2006 21:03:36 A.... 3 577 856 3,41 M mshtmled.dll Tue 7 Nov 2006 21:03:36 A.... 475 648 464,50 K mshtmler.dll Tue 17 Oct 2006 11:28:56 A.... 48 128 47,00 K msls31.dll Tue 7 Nov 2006 21:03:36 A.... 156 160 152,50 K msrating.dll Tue 17 Oct 2006 12:05:10 A.... 192 000 187,50 K mstime.dll Tue 7 Nov 2006 21:03:36 A.... 670 720 655,00 K nwprovau.dll Fri 13 Oct 2006 13:36:56 A.... 145 920 142,50 K occache.dll Tue 17 Oct 2006 12:04:46 A.... 101 376 99,00 K pngfilt.dll Tue 17 Oct 2006 11:58:08 A.... 44 544 43,50 K shdocvw.dll Mon 23 Oct 2006 16:34:38 A.... 1 497 600 1,43 M shlwapi.dll Mon 23 Oct 2006 16:34:38 A.... 474 624 463,50 K svrapi.dll Thu 26 Oct 2006 16:24:00 A.... 13 312 13,00 K sxs.dll Fri 20 Oct 2006 2:38:44 A.... 716 800 700,00 K url.dll Tue 17 Oct 2006 12:05:22 A.... 105 984 103,50 K urlmon.dll Tue 7 Nov 2006 21:03:36 A.... 1 162 240 1,11 M vbscript.dll Tue 7 Nov 2006 21:03:36 A.... 413 696 404,00 K webcheck.dll Tue 7 Nov 2006 21:03:36 A.... 231 424 226,00 K wininet.dll Tue 7 Nov 2006 21:03:36 A.... 818 688 799,50 K wmvcore.dll Thu 7 Dec 2006 17:02:24 A.... 2 174 976 2,07 M xpsp3res.dll Mon 23 Oct 2006 12:43:08 A.... 265 216 259,00 K 50 items found: 50 files, 0 directories. Total of file sizes: 26 518 690 bytes 25,29 M Locate .tmp files: No matches found. ********************************************************************************** Directory Listing of system files: Le volume dans le lecteur C s'appelle PRESARIO Le num‚ro de s‚rie du volume est 442F-099B R‚pertoire de C:\WINDOWS\System32 17/12/2006 00:03 <REP> dllcache 10/12/2006 19:02 10ÿ022 KGyGaAvL.sys 10/12/2006 19:02 56 9B0C9A28BC.sys 01/01/2004 22:54 <REP> Microsoft 2 fichier(s) 10ÿ078 octets 2 R‚p(s) 99ÿ827ÿ081ÿ216 octets libres

Voici le rapport AVG ANTI-SPYWARE AINSI QUE LE NOUVEAU RAPPORT HIJACKTHIS Au passage, j'ai toujours des fenêtres EI qui s'ouvrent toute seule. Je me reconnecterais demain soir pour la suite Bonne nuit... --------------------------------------------------------- AVG Anti-Spyware - Rapport d'analyse --------------------------------------------------------- + Créé à: 00:08:54 27/12/2006 + Résultat de l'analyse: C:\Program Files\NewDotNet -> Adware.NewDotNet : Nettoyé. C:\Program Files\NewDotNet\readme.txt -> Adware.NewDotNet : Nettoyé. HKLM\SOFTWARE\Classes\CLSID\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} -> Adware.NewDotNet : Nettoyé. HKLM\SOFTWARE\Classes\Tldctl2.URLLink -> Adware.NewDotNet : Nettoyé. HKLM\SOFTWARE\Classes\Tldctl2.URLLink.1 -> Adware.NewDotNet : Nettoyé. HKLM\SOFTWARE\Classes\Tldctl2.URLLink\CLSID -> Adware.NewDotNet : Nettoyé. HKLM\SOFTWARE\Classes\Tldctl2.URLLink\CurVer -> Adware.NewDotNet : Nettoyé. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} -> Adware.NewDotNet : Nettoyé. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\New.net Startup -> Adware.NewDotNet : Nettoyé. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net -> Adware.NewDotNet : Nettoyé. HKLM\SOFTWARE\New.net -> Adware.NewDotNet : Nettoyé. HKU\S-1-5-21-2681134078-3130005967-3501437919-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} -> Adware.NewDotNet : Nettoyé. HKU\S-1-5-21-2681134078-3130005967-3501437919-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} -> Adware.NewDotNet : Nettoyé. HKLM\SOFTWARE\Classes\F1.Organizer -> Adware.VX2 : Nettoyé. HKLM\SOFTWARE\Classes\F1.Organizer.1 -> Adware.VX2 : Nettoyé. HKLM\SOFTWARE\Classes\F1.Organizer\CLSID -> Adware.VX2 : Nettoyé. HKLM\SOFTWARE\Classes\F1.Organizer\CurVer -> Adware.VX2 : Nettoyé. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DMO -> Adware.VX2 : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@2o7[1].txt -> TrackingCookie.2o7 : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@msnaccountservices.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@adbrite[2].txt -> TrackingCookie.Adbrite : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@adtech[2].txt -> TrackingCookie.Adtech : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@advertising[2].txt -> TrackingCookie.Advertising : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@adviva[2].txt -> TrackingCookie.Adviva : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@bluestreak[2].txt -> TrackingCookie.Bluestreak : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@burstnet[2].txt -> TrackingCookie.Burstnet : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@www.burstnet[1].txt -> TrackingCookie.Burstnet : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@data.coremetrics[1].txt -> TrackingCookie.Coremetrics : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@estat[1].txt -> TrackingCookie.Estat : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@www.etracker[2].txt -> TrackingCookie.Etracker : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@as1.falkag[1].txt -> TrackingCookie.Falkag : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@fastclick[2].txt -> TrackingCookie.Fastclick : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@ehg-nestlefr.hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@ehg-telecomitalia.hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@overture[2].txt -> TrackingCookie.Overture : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@weborama[2].txt -> TrackingCookie.Weborama : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Nettoyé. C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@zedo[2].txt -> TrackingCookie.Zedo : Nettoyé. Fin du rapport Logfile of HijackThis v1.99.1 Scan saved at 00:16:46, on 27/12/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\system32\wuauclt.exe C:\HP\KBD\KBD.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\keyhook.exe C:\WINDOWS\AGRSMMSG.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\PCHButton.exe C:\Program Files\SpywareGuard\sgmain.exe C:\HJT\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://aliceadsl.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843 O2 - BHO: F1 Organizer Class - {00000EF1-0786-4633-87C6-1AA7A44296DA} - C:\WINDOWS\system32\ATPART~1.DLL (file missing) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [siS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\PCHButton.exe O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://abonnement.aliceadsl.fr/configurate...countHelper.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Merci Mykerinos pour vous pancher sur le problème et Joyeux Noël aussi.

J'ai des fenetres d'internet explorer qui s'ouvrent toute seule ainsi que ma page de démarage internet explorer qui ne veux pas s'afficher. Après un prénettoyage et scan antivirus avec AVAST et AVG, Voici le log HijackThis Merci d'avance Logfile of HijackThis v1.99.1 Scan saved at 21:38:10, on 26/12/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe C:\WINDOWS\Explorer.EXE c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\windows\system\hpsysdrv.exe C:\HP\KBD\KBD.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\keyhook.exe C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe C:\WINDOWS\AGRSMMSG.exe C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\PCHButton.exe C:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\Program Files\Internet Explorer\iexplore.exe C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Répertoire temporaire 4 pour hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://aliceadsl.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843 O2 - BHO: F1 Organizer Class - {00000EF1-0786-4633-87C6-1AA7A44296DA} - C:\WINDOWS\system32\ATPART~1.DLL (file missing) O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet3_88.dll (file missing) O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - c:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [siS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\PCHButton.exe O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://abonnement.aliceadsl.fr/configurate...countHelper.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

Pour le moment, je n'ai plus de problème. Je te remercie vraiement beaucoup. A bientôt.

Après analyse en ligne KASPERSKY ci dessous le rapport ------------------------------------------------------------------------------- KASPERSKY ON-LINE SCANNER REPORT Thursday, October 26, 2006 11:13:20 AM Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky On-line Scanner version : 5.0.83.0 Dernière mise à jour de la base antivirus Kaspersky : 26/10/2006 Enregistrements dans la base antivirus Kaspersky : 221628 ------------------------------------------------------------------------------- Paramètres d'analyse: Analyser avec la base antivirus suivante: standard Analyser les archives: vrai Analyser les bases de messagerie: vrai Cible de l'analyse - Poste de travail: A:\ C:\ D:\ E:\ Z:\ Statistiques de l'analyse: Total d'objets analysés: 55024 Nombre de virus trouvés: 0 Nombre d'objets infectés: 0 / 0 Nombre d'objets suspects: 0 Durée de l'analyse: 00:37:07 Nom de l'objet infecté / Nom du virus / Dernière action C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat L'objet est verrouillé ignoré C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat L'objet est verrouillé ignoré C:\Documents and Settings\LocalService\Cookies\index.dat L'objet est verrouillé ignoré C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré C:\Documents and Settings\LocalService\NTUSER.DAT L'objet est verrouillé ignoré C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré C:\Documents and Settings\NetworkService\Cookies\index.dat L'objet est verrouillé ignoré C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré C:\Documents and Settings\NetworkService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré C:\Documents and Settings\NetworkService\NTUSER.DAT L'objet est verrouillé ignoré C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Cookies\index.dat L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\ApplicationHistory\hpqgalry.exe.cf8dd223.ini.inuse L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\administrativeInfo.dbf L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.cdx L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.dbf L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.cdx L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.dbf L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\CB_Server_Errors.txt L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.cdx L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.dbf L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.cdx L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.dbf L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.fpt L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.cdx L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.dbf L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.cdx L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.dbf L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\managedFolderTable.dbf L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.cdx L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.dbf L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.cdx L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.dbf L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.cdx L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.dbf L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\Identities\{3824E20A-87D3-4781-B474-87C157E4B941}\Microsoft\Outlook Express\Boîte de réception.dbx L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\Identities\{3824E20A-87D3-4781-B474-87C157E4B941}\Microsoft\Outlook Express\Folders.dbx L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\Identities\{3824E20A-87D3-4781-B474-87C157E4B941}\Microsoft\Outlook Express\Offline.dbx L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\Identities\{3824E20A-87D3-4781-B474-87C157E4B941}\Microsoft\Outlook Express\Pop3uidl.dbx L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Historique\History.IE5\MSHist012006102620061027\index.dat L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Temp\~DF1DD9.tmp L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Temp\~DF3344.tmp L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Temp\~DF3A73.tmp L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Temporary Internet Files\Content.IE5\GTWBGRKR\SG PARIS 11 PARMENTIER2.xls L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\NTUSER.DAT L'objet est verrouillé ignoré C:\Documents and Settings\technifroid\ntuser.dat.LOG L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\backweb\1044199\Users\Default\Data\cache.dat L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\backweb\1044199\Users\Default\Data\chandir.dat L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\backweb\1044199\Users\Default\Data\chandir.idx L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\backweb\1044199\Users\Default\Data\chn.dat L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\backweb\1044199\Users\Default\Data\chn.idx L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\backweb\1044199\Users\Default\Data\D0000000.FCS L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\backweb\1044199\Users\Default\Data\inuse.txt L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\backweb\1044199\Users\Default\Data\L0000030.FCS L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\backweb\1044199\Users\Default\Data\main.log L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\backweb\1044199\Users\Default\Data\prs.dat L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\backweb\1044199\Users\Default\Data\prs.idx L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\backweb\1044199\Users\Default\Data\prs_die.dat L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\backweb\1044199\Users\Default\Data\prs_die.idx L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\backweb\1044199\Users\Default\Data\prs_dnd.dat L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\backweb\1044199\Users\Default\Data\prs_dnd.idx L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\backweb\1044199\Users\Default\Data\prs_ext.dat L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\backweb\1044199\Users\Default\Data\prs_ext.idx L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\backweb\1044199\Users\Default\Data\prs_rcv.dat L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\backweb\1044199\Users\Default\Data\prs_rcv.idx L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\backweb\1044199\Users\Default\Data\storydb.dat L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\backweb\1044199\Users\Default\Data\storydb.idx L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\Common\admin.pub L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\Common\policy.bpf L'objet est verrouillé ignoré C:\Program Files\Securitoo\av_fw\Common\policy.ipf L'objet est verrouillé ignoré C:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré C:\System Volume Information\_restore{E952FEF2-34EC-4995-B90A-D88FDDB9C2BA}\RP281\change.log L'objet est verrouillé ignoré C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré C:\WINDOWS\SchedLgU.Txt L'objet est verrouillé ignoré C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré E:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré E:\System Volume Information\_restore{E952FEF2-34EC-4995-B90A-D88FDDB9C2BA}\RP281\change.log L'objet est verrouillé ignoré Z:\Gescom\TECHNIFROID1200.gcm L'objet est verrouillé ignoré Z:\Gescom\TECHNIFROID1200.mae L'objet est verrouillé ignoré Analyse terminée.

Bonjour bruce lee ci-dessous le nouveau log hijackthis Logfile of HijackThis v1.99.1 Scan saved at 08:24:52, on 26/10/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\HijackThis\cgombert.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pagesjaunes.fr/pj.cgi? R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Accélérateur de démarrage AutoCAD.lnk = C:\Program Files\Fichiers communs\Autodesk Shared\acstart16.exe O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: EPSON SMART PANEL for Scanner.lnk = C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\espmain.exe O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE O4 - Global Startup: EPSON Status Monitor 3 Environment Check(3).lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O12 - Plugin for .tif: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O16 - DPF: {09CC593B-E8A9-4491-927D-A3E33534DDD4} (InstallerObj Class) - http://m6video.m6.fr/1click/install/files/installer2.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1F831FA7-42FC-11D4-95A6-0080AD30DCE1} (InstaFred) - file://C:\Program Files\AutoCAD LT 2002 Fra\InstFred.ocx O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (Contrôle d'AcDcToday) - file://C:\Program Files\AutoCAD LT 2002 Fra\AcDcToday.ocx O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.2) - https://www.achatpublic.com/sdm/cgapc/jar/i...indows-i586.cab O16 - DPF: {AE563727-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD LT 2002 Fra\InstBanr.ocx O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (Gestion d'AcPreview) - file://C:\Program Files\AutoCAD LT 2002 Fra\AcPreview.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{8FA51164-B334-40AD-ADA4-9E9DD0CF1C24}: NameServer = 80.10.246.2,80.10.246.129 O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Securitoo AntiVirus Firewall (BackWeb Client - 1044199) - Unknown owner - C:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXE O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\Securitoo\av_fw\Common\FSAA.EXE (file missing) O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exe O23 - Service: F-Secure Distributed Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\fswsclds.exe

Ci-dessous le rapport Black light 10/25/06 15:25:28 [info]: BlackLight Engine 1.0.47 initialized 10/25/06 15:25:28 [info]: OS: 5.1 build 2600 (Service Pack 2) 10/25/06 15:25:29 [Note]: 7019 4 10/25/06 15:25:29 [Note]: 7005 0 10/25/06 15:25:31 [Note]: 7006 0 10/25/06 15:25:31 [Note]: 7011 2188 10/25/06 15:25:31 [Note]: 7026 0 10/25/06 15:25:31 [Note]: 7026 0 10/25/06 15:25:31 [Note]: 7024 3 10/25/06 15:25:31 [info]: Hidden process: C:\windows\system32\rfhsejugsd.exe 10/25/06 15:25:31 [Note]: FSRAW library version 1.7.1020 10/25/06 15:27:04 [info]: Hidden file: c:\WINDOWS\system32\rfhsejugsd_nav.dat 10/25/06 15:27:04 [Note]: 10002 1 10/25/06 15:27:04 [info]: Hidden file: c:\WINDOWS\system32\rfhsejugsd.dat 10/25/06 15:27:04 [Note]: 10002 1 10/25/06 15:27:05 [info]: Hidden file: C:\windows\system32\rfhsejugsd.exe 10/25/06 15:27:05 [Note]: 10002 1 10/25/06 15:27:05 [info]: Hidden file: c:\WINDOWS\system32\rfhsejugsd_navps.dat 10/25/06 15:27:05 [Note]: 10002 1 10/25/06 15:27:46 [Note]: 7007 0

Je me permet de réécrire car en ce moment même, des fenêtres internet s'ouvrent encore avec de soi-disant antivurus!!!

Bonjour bruce lee J'ai effectué ta procédure. Les fichier udru.dll et w32.exe n'étaient pas présents sur ma machine. Ci dessous le rapport AVG ainsi que le nouveau log hijackthis. --------------------------------------------------------- AVG Anti-Spyware - Rapport d'analyse --------------------------------------------------------- + Créé à: 09:13:27 25/10/2006 + Résultat de l'analyse: C:\Documents and Settings\technifroid\Local Settings\Temp\Cookies\technifroid@atdmt[1].txt -> TrackingCookie.Atdmt : Nettoyé. C:\Documents and Settings\technifroid\Cookies\technifroid@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé. C:\Documents and Settings\technifroid\Local Settings\Temp\Cookies\technifroid@banner.clubdicecasino[2].txt -> TrackingCookie.Clubdicecasino : Nettoyé. C:\Documents and Settings\technifroid\Local Settings\Temp\Cookies\technifroid@clubdicecasino[1].txt -> TrackingCookie.Clubdicecasino : Nettoyé. C:\Documents and Settings\technifroid\Cookies\technifroid@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé. C:\Documents and Settings\technifroid\Local Settings\Temp\Cookies\technifroid@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé. C:\Documents and Settings\technifroid\Cookies\technifroid@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé. C:\Documents and Settings\technifroid\Cookies\technifroid@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Nettoyé. C:\Documents and Settings\technifroid\Cookies\technifroid@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé. C:\Documents and Settings\technifroid\Local Settings\Temp\Cookies\technifroid@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé. C:\Documents and Settings\technifroid\Cookies\technifroid@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Nettoyé. Fin du rapport Logfile of HijackThis v1.99.1 Scan saved at 09:14:46, on 25/10/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\HijackThis\cgombert.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pagesjaunes.fr/pj.cgi? R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [rfhsejugsd] c:\windows\system32\rfhsejugsd.exe rfhsejugsd O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Accélérateur de démarrage AutoCAD.lnk = C:\Program Files\Fichiers communs\Autodesk Shared\acstart16.exe O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: EPSON SMART PANEL for Scanner.lnk = C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\espmain.exe O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE O4 - Global Startup: EPSON Status Monitor 3 Environment Check(3).lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O12 - Plugin for .tif: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O16 - DPF: {09CC593B-E8A9-4491-927D-A3E33534DDD4} (InstallerObj Class) - http://m6video.m6.fr/1click/install/files/installer2.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1F831FA7-42FC-11D4-95A6-0080AD30DCE1} (InstaFred) - file://C:\Program Files\AutoCAD LT 2002 Fra\InstFred.ocx O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (Contrôle d'AcDcToday) - file://C:\Program Files\AutoCAD LT 2002 Fra\AcDcToday.ocx O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.2) - https://www.achatpublic.com/sdm/cgapc/jar/i...indows-i586.cab O16 - DPF: {AE563727-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD LT 2002 Fra\InstBanr.ocx O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (Gestion d'AcPreview) - file://C:\Program Files\AutoCAD LT 2002 Fra\AcPreview.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{8FA51164-B334-40AD-ADA4-9E9DD0CF1C24}: NameServer = 80.10.246.2,80.10.246.129 O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Securitoo AntiVirus Firewall (BackWeb Client - 1044199) - Unknown owner - C:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXE O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\Securitoo\av_fw\Common\FSAA.EXE (file missing) O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exe O23 - Service: F-Secure Distributed Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\fswsclds.exe