tipi1

Et voila le rapport SpySeeper: 19:40: Removal process completed. Elapsed time 00:00:02 19:40: Quarantining All Traces: spywarestormer cookie 19:40: Quarantining All Traces: xiti cookie 19:40: Quarantining All Traces: reunion cookie 19:40: Quarantining All Traces: fe.lea.lycos.com cookie 19:40: Quarantining All Traces: hbmediapro cookie 19:40: Quarantining All Traces: go.com cookie 19:40: Quarantining All Traces: spyware quake 19:40: Quarantining All Traces: trojan agent winlogonhook 19:40: Removal process initiated 19:37: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE 18:37: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE 18:02: Traces Found: 9 18:02: Full Sweep has completed. Elapsed time 00:28:20 18:02: File Sweep Complete, Elapsed Time: 00:26:55 18:01: Warning: Access violation at address 00401D58 in module 'SpySweeper.exe'. Read of address 7E8C000C 18:01: Warning: Access violation at address 0058BE6A in module 'SpySweeper.exe'. Read of address 0000038C ----------------la meme ligne a été répetée plusieurs centaines de fois, j'ai coupé pour racourcir le post********************* 18:01: Warning: Access violation at address 0058BE6A in module 'SpySweeper.exe'. Read of address 0000038C Espace insuffisant pour traiter cette commande 18:00: Warning: Unable to sweep compressed file: System Error. Code: 8. 17:58: Warning: Failed to access drive O: 17:58: Warning: Failed to access drive M: 17:58: Warning: Failed to access drive L: 17:58: Warning: Failed to access drive K: 17:58: Warning: Failed to access drive J: 17:43: Warning: Failed to open file "c:\windows\temp\_avast4_\webshlock.txt". Opération réussie 17:43: Warning: Failed to open file "c:\documents and settings\piganeau thierry\application data\mozilla\firefox\profiles\bqw8d56k.default\parent.lock". Opération réussie 17:36: C:\System Volume Information\_restore{017ac6c9-d4dd-40f2-8869-8b8dba10ff1a}\RP402\A0078909.ini (ID = 298068) 17:36: Found Adware: spyware quake 17:36: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE 17:35: Starting File Sweep 17:35: Warning: Failed to access drive A: 17:35: Cookie Sweep Complete, Elapsed Time: 00:00:00 17:35: c:\documents and settings\marion\cookies\marion@xiti[1].txt (ID = 3717) 17:35: c:\documents and settings\marion\cookies\marion@spywarestormer[2].txt (ID = 3417) 17:35: Found Spy Cookie: spywarestormer cookie 17:35: c:\documents and settings\julie\cookies\julie@xiti[1].txt (ID = 3717) 17:35: Found Spy Cookie: xiti cookie 17:35: c:\documents and settings\julie\cookies\julie@reunion[1].txt (ID = 3255) 17:35: Found Spy Cookie: reunion cookie 17:35: c:\documents and settings\julie\cookies\[email protected][2].txt (ID = 2660) 17:35: Found Spy Cookie: fe.lea.lycos.com cookie 17:35: c:\documents and settings\julie\cookies\[email protected][2].txt (ID = 2768) 17:35: Found Spy Cookie: hbmediapro cookie 17:35: c:\documents and settings\lucas\cookies\lucas@go[1].txt (ID = 2728) 17:35: Found Spy Cookie: go.com cookie 17:35: Starting Cookie Sweep 17:35: Registry Sweep Complete, Elapsed Time:00:00:25 17:35: HKLM\software\microsoft\mssmgr\ (ID = 937101) 17:35: Found Trojan Horse: trojan agent winlogonhook 17:34: Starting Registry Sweep 17:34: Memory Sweep Complete, Elapsed Time: 00:00:52 17:33: Starting Memory Sweep 17:33: Sweep initiated using definitions version 691 17:33: Spy Sweeper 5.0.5.1286 started 17:33: | Start of Session, vendredi 13 octobre 2006 | ******** 17:33: | End of Session, vendredi 13 octobre 2006 | Keylogger Shield: On BHO Shield: On IE Security Shield: On Alternate Data Stream (ADS) Execution Shield: On Startup Shield: On Common Ad Sites Shield: Off Hosts File Shield: On Spy Communication Shield: On 17:30: Messenger service has been disabled. ActiveX Shield: On Windows Messenger Service Shield: On IE Favorites Shield: On Spy Installation Shield: On Memory Shield: On IE Hijack Shield: On IE Tracking Cookies Shield: Off 17:30: Shield States 17:30: Spyware Definitions: 691 17:30: Spy Sweeper 5.0.5.1286 started 17:30: Spy Sweeper 5.0.5.1286 started 17:30: | Start of Session, vendredi 13 octobre 2006 | ********

Merci encore Voici le rapport Combofix: Piganeau Thierry - 06-10-13 17:13:30,51 Service Pack 1 ComboFix 06.10.13 - Running from: "C:\Documents and Settings\Piganeau Thierry\Bureau" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\components C:\Program Files\Fichiers communs\{7C882EC2-0A26-1036-0820-030407200021} ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\QooBox\Purity\Program Files\SSTEM~1 C:\QooBox\Purity\Program Files\SSTEM~1\s?stem ((((((((((((((((((((((((((((((( Files Created from 2006-09-13 to 2006-10-13 )))))))))))))))))))))))))))))))))) 2006-10-13 10:23 90,112 --a------ C:\WINDOWS\system32\AVASTSS.scr 2006-10-13 10:23 87,424 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2006-10-13 10:23 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2006-10-13 10:23 666,240 --a------ C:\WINDOWS\system32\aswBoot.exe 2006-10-13 10:23 36,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2006-10-13 10:23 24,560 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2006-10-13 10:23 16,352 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2006-10-13 00:03 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2006-10-12 20:11 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2006-10-12 20:05 18,200 --a------ C:\WINDOWS\system32\wups2.dll 2006-10-12 19:38 53,248 --a------ C:\WINDOWS\system32\Process.exe 2006-10-12 19:38 40,960 --a------ C:\WINDOWS\system32\swsc.exe 2006-10-12 19:38 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2006-10-12 19:38 135,168 --a------ C:\WINDOWS\system32\swreg.exe 2006-10-11 13:06 2 --a------ C:\WINDOWS\system32\wnstssv.exe 2006-10-11 12:55 401,722 ---hs---- C:\WINDOWS\system32\rqstv.bak1 2006-10-08 11:53 4 --a------ C:\WINDOWS\VGA401A.SYS 2006-10-01 11:58 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2006-10-01 11:58 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2006-10-01 11:57 68,320 --a------ C:\WINDOWS\system32\drivers\Tpkd.sys 2006-09-30 14:47 638,353 --a------ C:\WINDOWS\system32\iowA.exe 2006-09-30 09:21 8,704 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2006-09-30 09:21 50,688 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2006-09-30 09:21 4,608 --a------ C:\WINDOWS\system32\nmwcdlog.dll 2006-09-30 09:21 30,720 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2006-09-30 09:21 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2006-09-30 09:21 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys 2006-09-30 09:21 127,488 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-10-13 17:14 -------- d-------- C:\Program Files\Fichiers communs 2006-10-13 17:10 -------- d-------- C:\Program Files\HighjackThis 2006-10-13 10:23 -------- d-------- C:\Program Files\Alwil Software 2006-10-13 00:03 -------- d-------- C:\Program Files\Grisoft 2006-10-13 00:02 -------- d-------- C:\Program Files\CCleaner 2006-10-11 23:59 -------- d-------- C:\Documents and Settings\Piganeau Thierry\Application Data\Lavasoft 2006-10-11 23:00 -------- d-------- C:\Program Files\SpywareHeal 2006-10-08 18:29 -------- d-------- C:\Documents and Settings\Piganeau Thierry\Application Data\Adobe 2006-10-08 13:53 -------- d-------- C:\Documents and Settings\Piganeau Thierry\Application Data\Nokia 2006-10-07 19:44 187303 --a------ C:\Documents and Settings\Piganeau Thierry\Application Data\NMM-MetaData.db 2006-10-07 19:41 -------- d-------- C:\Documents and Settings\Piganeau Thierry\Application Data\Nokia Multimedia Player 2006-10-07 19:34 -------- d-------- C:\Documents and Settings\Piganeau Thierry\Application Data\DataLayer 2006-10-07 14:40 -------- d-------- C:\Program Files\Fichiers communs\Nikon 2006-10-01 11:57 -------- d--h----- C:\Program Files\InstallShield Installation Information 2006-10-01 11:34 -------- d---s---- C:\Documents and Settings\Piganeau Thierry\Application Data\Microsoft 2006-09-30 14:30 268 -r-h----- C:\Documents and Settings\Piganeau Thierry\Application Data\Dialogs 2006-09-30 14:26 -------- d-------- C:\Documents and Settings\Piganeau Thierry\Application Data\Nikon 2006-09-30 13:20 -------- d-------- C:\Program Files\Yahoo! 2006-09-30 09:22 -------- d-------- C:\Documents and Settings\Piganeau Thierry\Application Data\PC Suite 2006-09-30 09:21 -------- d-------- C:\Program Files\Nokia 2006-09-30 09:21 -------- d-------- C:\Program Files\Fichiers communs\PCSuite 2006-09-30 09:21 -------- d-------- C:\Program Files\Fichiers communs\Nokia 2006-09-30 09:21 -------- d-------- C:\Program Files\DIFX 2006-09-30 08:57 -------- d-------- C:\Program Files\DxO Labs 2006-09-23 19:39 -------- d-ah----- C:\Program Files\WindowsUpdate 2006-09-22 13:39 -------- d-------- C:\Program Files\Outlook Express 2006-09-22 13:39 -------- d-------- C:\Program Files\Fichiers communs\System 2006-09-22 13:39 -------- d-------- C:\Program Files\Fichiers communs\Microsoft Shared 2006-09-22 13:39 -------- d-------- C:\Documents and Settings\Piganeau Thierry\Application Data\PACE Anti-Piracy 2006-09-06 16:37 -------- d-------- C:\Program Files\eMule 2006-09-01 21:07 -------- d-------- C:\Program Files\Disc2Phone 2006-08-31 13:54 -------- d-------- C:\Program Files\Maxis 2006-08-26 16:39 -------- d-------- C:\Program Files\Fichiers communs\Adobe 2006-08-26 16:38 -------- d-------- C:\Program Files\Clash N Slash 2006-08-26 16:35 -------- d-------- C:\Program Files\RegVac 2006-08-26 16:32 -------- d-------- C:\Program Files\Fichiers communs\Teleca Shared 2006-08-26 16:31 -------- d-------- C:\Program Files\Versailles 2006-08-20 21:03 869 --a------ C:\Documents and Settings\Piganeau Thierry\Application Data\AdobeDLM.log 2006-08-20 21:03 0 --a------ C:\Documents and Settings\Piganeau Thierry\Application Data\dm.ini 2006-08-20 20:39 -------- d-------- C:\Documents and Settings\Piganeau Thierry\Application Data\OpenOffice.org2 2006-07-26 13:27 3997696 --a------ C:\WINDOWS\system32\NkNEFPlugin.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SoundMAXPnP"="C:\\Program Files\\Analog Devices\\SoundMAX\\SMax4PNP.exe" "SoundMAX"="\"C:\\Program Files\\Analog Devices\\SoundMAX\\Smax4.exe\" /tray" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "HPDJ Taskbar Utility"="C:\\WINDOWS\\System32\\spool\\drivers\\w32x86\\3\\hpztsb09.exe" "PinnacleDriverCheck"="C:\\WINDOWS\\System32\\PSDrvCheck.exe -CheckReg" "SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_11\\bin\\jusched.exe" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvMcTray.dll,NvTaskbarInit" "OmniPage"="F:\\Program Files\\OmniPagePro10.0\\opware32.exe" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Ma page d'accueil" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,e4,03,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NVMCTRAY.DLL,NvTaskbarInit" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NVMCTRAY.DLL,NvTaskbarInit" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=hex:91,00,00,00 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=hex:91,00,00,00 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" "UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\SyncBack Bak thierry.job Completion time: 06-10-13 17:15:00.75 C:\ComboFix.txt ... 06-10-13 17:15

Et voila le rapport AVG Antispyware: --------------------------------------------------------- AVG Anti-Spyware - Rapport d'analyse --------------------------------------------------------- + Créé à: 16:21:48 13/10/2006 + Résultat de l'analyse: C:\System Volume Information\_restore{017AC6C9-D4DD-40F2-8869-8B8DBA10FF1A}\RP402\A0081677.dll -> Adware.Softomate : Nettoyé et sauvegardé (mise en quarantaine). C:\System Volume Information\_restore{017AC6C9-D4DD-40F2-8869-8B8DBA10FF1A}\RP402\A0081673.exe -> Downloader.Zlob.apc : Nettoyé et sauvegardé (mise en quarantaine). :mozilla.25:C:\Documents and Settings\Piganeau Thierry\Application Data\Mozilla\Firefox\Profiles\bqw8d56k.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé. :mozilla.26:C:\Documents and Settings\Piganeau Thierry\Application Data\Mozilla\Firefox\Profiles\bqw8d56k.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé. :mozilla.27:C:\Documents and Settings\Piganeau Thierry\Application Data\Mozilla\Firefox\Profiles\bqw8d56k.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé. :mozilla.30:C:\Documents and Settings\Piganeau Thierry\Application Data\Mozilla\Firefox\Profiles\bqw8d56k.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé. :mozilla.24:C:\Documents and Settings\Piganeau Thierry\Application Data\Mozilla\Firefox\Profiles\bqw8d56k.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé. :mozilla.31:C:\Documents and Settings\Piganeau Thierry\Application Data\Mozilla\Firefox\Profiles\bqw8d56k.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé. Fin du rapport Et le rapport HiJackThis: Logfile of HijackThis v1.99.1 Scan saved at 16:23:36, on 13/10/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\System32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\HighjackThis\bonjour.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.16.2.8:8000 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - {DB9B8511-49D0-3555-A0AD-601344AE6C95} - C:\WINDOWS\System32\niabcux.dll (file missing) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1FE6B8AA-968A-4C62-8760-5BBCD44D1999} - C:\WINDOWS\System32\awvvt.dll (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file) O2 - BHO: (no name) - {58220D89-0C36-A1A8-CD83-0A6F6534889F} - C:\WINDOWS\System32\ajmgeve.dll (file missing) O2 - BHO: (no name) - {849B9523-785F-4014-9CAF-079FB4A74C61} - C:\WINDOWS\System32\pmtwywjt.dll (file missing) O2 - BHO: (no name) - {DB9B8511-49D0-3555-A0AD-601344AE6C95} - C:\WINDOWS\System32\niabcux.dll (file missing) O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [soundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_11\bin\jusched.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [OmniPage] F:\Program Files\OmniPagePro10.0\opware32.exe O4 - HKLM\..\Run: [WindowsServicesStartup] C:\DOCUME~1\PIGANE~1\LOCALS~1\Temp\svchost.exe 1 O4 - HKLM\..\Run: [strsrg.dll] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\strsrg.dll,ksitdrf O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [Yosiggt] D:\Mes Documents\??pPatch\m?iexec.exe O4 - Startup: Moniteur & Configuration.lnk = ? O4 - Global Startup: ColorPlus Startup.lnk = C:\Program Files\PANTONE COLORVISION\ColorPlus\ColorPlus.exe O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: NkvMon.exe.lnk = F:\Program Files\Nikon\NkView6\NkvMon.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1160676245656 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab28177.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: vtsqr - C:\WINDOWS\System32\vtsqr.dll (file missing) O20 - Winlogon Notify: winrge32 - winrge32.dll (file missing) O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - (no file) O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\WINDOWS\wlancfg.exe Comment se porte mon PC, docteur Freeman ?

Merci Freeman Voici donc le rapport SmitFraudFix: SmitFraudFix v2.109 Rapport fait à 14:01:31,17, 13/10/2006 Executé à partir de C:\Documents and Settings\Piganeau Thierry\Bureau\SmitfraudFix OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT Fix executé en mode sans echec »»»»»»»»»»»»»»»»»»»»»»»» Avant SmitFraudFix !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "incestuously"="{03413bf7-e34c-445b-bfc0-a2b127255871}" »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés C:\WINDOWS\.protected supprimé C:\WINDOWS\system32\issearch.exe supprimé C:\WINDOWS\system32\ixt?.dll supprimé C:\WINDOWS\system32\ot.ico supprimé C:\DOCUME~1\PIGANE~1\Favoris\Antivirus Test Online.url supprimé C:\DOCUME~1\PIGANE~1\MENUDM~1\PROGRA~1\DMARRA~1\.protected supprimé C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1\.protected supprimé »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre Nettoyage terminé. »»»»»»»»»»»»»»»»»»»»»»»» Après SmitFraudFix !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "incestuously"="{03413bf7-e34c-445b-bfc0-a2b127255871}" »»»»»»»»»»»»»»»»»»»»»»»» Fin

Merci de ta réponse, je pense avoir fait tout ce que tu demandais. J'ai juste fait un truc avant tout ça, c'est passer un coup de Vundofix parce que AntiVir m'avait détecté un Virus Vundo qu'il ne pouvait éliminer. Voila donc le rapport Smitfraudfix: SmitFraudFix v2.109 Rapport fait à 19:38:32,14, 12/10/2006 Executé à partir de C:\Documents and Settings\Piganeau Thierry\Bureau\SmitfraudFix OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT Fix executé en mode sans echec »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS C:\WINDOWS\.protected PRESENT ! »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 C:\WINDOWS\system32\ismini.exe PRESENT ! C:\WINDOWS\system32\issearch.exe PRESENT ! C:\WINDOWS\system32\ixt?.dll PRESENT ! C:\WINDOWS\system32\ixt??.dll PRESENT ! C:\WINDOWS\system32\ot.ico PRESENT ! C:\WINDOWS\system32\ts.ico PRESENT ! C:\WINDOWS\system32\components\flx?.dll PRESENT ! C:\WINDOWS\system32\components\flx??.dll PRESENT ! C:\WINDOWS\system32\components\flx???.dll PRESENT ! »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Piganeau Thierry »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Piganeau Thierry\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer C:\DOCUME~1\PIGANE~1\MENUDM~1\PROGRA~1\DMARRA~1\.protected PRESENT ! C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1\.protected PRESENT ! »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\PIGANE~1\Favoris C:\DOCUME~1\PIGANE~1\Favoris\Antivirus Test Online.url PRESENT ! »»»»»»»»»»»»»»»»»»»»»»»» Bureau C:\DOCUME~1\ALLUSE~1\Bureau\Security Troubleshooting.url PRESENT ! »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files C:\Program Files\Safety Bar\ PRESENT ! »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "incestuously"="{03413bf7-e34c-445b-bfc0-a2b127255871}" »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32 »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll »»»»»»»»»»»»»»»»»»»»»»»» Fin Et le rapport HijackThis/bonjour: Logfile of HijackThis v1.99.1 Scan saved at 19:40:12, on 12/10/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\System32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\HighjackThis\bonjour.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.16.2.8:8000 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - {DB9B8511-49D0-3555-A0AD-601344AE6C95} - C:\WINDOWS\System32\niabcux.dll R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1FE6B8AA-968A-4C62-8760-5BBCD44D1999} - C:\WINDOWS\System32\awvvt.dll (file missing) O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file) O2 - BHO: (no name) - {58220D89-0C36-A1A8-CD83-0A6F6534889F} - C:\WINDOWS\System32\ajmgeve.dll (file missing) O2 - BHO: (no name) - {849B9523-785F-4014-9CAF-079FB4A74C61} - C:\WINDOWS\System32\pmtwywjt.dll (file missing) O2 - BHO: (no name) - {a43385f0-7113-496d-96d7-b9b550e3fcca} - C:\WINDOWS\System32\ixt0.dll O2 - BHO: (no name) - {DB9B8511-49D0-3555-A0AD-601344AE6C95} - C:\WINDOWS\System32\niabcux.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: (no name) - {052b12f7-86fa-4921-8482-26c42316b522} - (no file) O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [soundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_11\bin\jusched.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [OmniPage] F:\Program Files\OmniPagePro10.0\opware32.exe O4 - HKLM\..\Run: [WindowsServicesStartup] C:\DOCUME~1\PIGANE~1\LOCALS~1\Temp\svchost.exe 1 O4 - HKLM\..\Run: [strsrg.dll] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\strsrg.dll,ksitdrf O4 - HKLM\..\Run: [ultimate Defender] "C:\Program Files\Ultimate Defender\App.exe" hide O4 - HKCU\..\Run: [Yosiggt] D:\Mes Documents\??pPatch\m?iexec.exe O4 - Startup: .protected O4 - Startup: Moniteur & Configuration.lnk = ? O4 - Global Startup: .protected O4 - Global Startup: ColorPlus Startup.lnk = C:\Program Files\PANTONE COLORVISION\ColorPlus\ColorPlus.exe O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: NkvMon.exe.lnk = F:\Program Files\Nikon\NkView6\NkvMon.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab28177.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: vtsqr - C:\WINDOWS\System32\vtsqr.dll (file missing) O20 - Winlogon Notify: winrge32 - winrge32.dll (file missing) O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - C:\WINDOWS\System32\urroxtl.dll (file missing) O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\WINDOWS\wlancfg.exe Merci encore de ton aide !

Bonjour, après infection puis nettoyage préliminaire, voici le rapport de HijackThis. Pourriez vous m'aider et me dire si quelque chose cloche encore ? Merci de votre aide. Logfile of HijackThis v1.99.1 Scan saved at 01:54:39, on 12/10/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\System32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\wlancfg.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\issearch.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe C:\Program Files\Java\j2re1.4.2_11\bin\jusched.exe C:\WINDOWS\System32\RUNDLL32.EXE F:\Program Files\OmniPagePro10.0\opware32.exe C:\WINDOWS\System32\rundll32.exe D:\Mes Documents\??pPatch\m?iexec.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe F:\Program Files\Nikon\NkView6\NkvMon.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\PROGRA~1\Logitech\Video\AlbumDB2.exe C:\PROGRA~1\Logitech\Video\FxSvr2.exe C:\Hijack\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.16.2.8:8000 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - {DB9B8511-49D0-3555-A0AD-601344AE6C95} - C:\WINDOWS\System32\niabcux.dll R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: ToolBar888 - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Program Files\Fichiers communs\{3C882EC2-0A26-1036-0820-030407200021}\MyToolBar.dll (file missing) O3 - Toolbar: (no name) - {052b12f7-86fa-4921-8482-26c42316b522} - (no file) O3 - Toolbar: &VSToolBar - {821F87FF-8245-4972-9E28-732E92EC2F51} - C:\Program Files\VSToolbar\VSToolBar.dll O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [soundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_11\bin\jusched.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [OmniPage] F:\Program Files\OmniPagePro10.0\opware32.exe O4 - HKLM\..\Run: [WindowsServicesStartup] C:\DOCUME~1\PIGANE~1\LOCALS~1\Temp\svchost.exe 1 O4 - HKLM\..\Run: [strsrg.dll] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\strsrg.dll,ksitdrf O4 - HKLM\..\Run: [ultimate Defender] "C:\Program Files\Ultimate Defender\App.exe" hide O4 - HKCU\..\Run: [Yosiggt] D:\Mes Documents\??pPatch\m?iexec.exe O4 - Startup: .protected O4 - Startup: Moniteur & Configuration.lnk = ? O4 - Global Startup: .protected O4 - Global Startup: ColorPlus Startup.lnk = C:\Program Files\PANTONE COLORVISION\ColorPlus\ColorPlus.exe O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: NkvMon.exe.lnk = F:\Program Files\Nikon\NkView6\NkvMon.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab28177.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - C:\WINDOWS\System32\urroxtl.dll (file missing) O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\WINDOWS\wlancfg.exe