[Résolu] Rapport HijackThis

Théti-Chéri · le 25 septembre 2006

Bonjour,

Suite à la visite de blog, j'ai un truc qui c'est installer, alors que j'avais dit non

Et depuis deux jours, lorsque j'allume mon pc, une page d'internet explorer s'ouvre avec un arrière-plan bleu sans rien d'écris dessus mais j'ai cette adresse dans la barre URL : http://fr.winantivirus.com/download/2006/?...p;ax=1&ed=1 et comme je fais rien, elle se ferme automatiquement, mais reviens à chaque démarrage.

J'ai fais une analyse Ad-Aware et Spybot, mais apparement rien n'y fait !!!

Comment virer ce truc s'il voua plait, aidez-moi.

Merci d'avance.

Logfile of HijackThis v1.99.1

Scan saved at 17:03:42, on 25/09/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Keymaestro\Multimedia Keyboard\MMKeybd.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0C2.EXE

C:\Program Files\PLEBICOM\Assistant eBuyClub\eBuyClub.exe

C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe

C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe

C:\Program Files\Fichiers communs\Logitech\QCDriver\LVCOMS.EXE

C:\Program Files\GénéaTique2004\PdfDrv\Install\PDFSaver.exe

C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE

C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe

C:\Program Files\Keymaestro\Multimedia Keyboard\TrayMon.exe

C:\Program Files\Keymaestro\Onscreen Display\OSD.exe

C:\Program Files\Keymaestro\Multimedia Keyboard\nhksrv.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\Borland\InterBase\Bin\ibguard.exe

C:\WINDOWS\system32\drivers\KodakCCS.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Borland\InterBase\Bin\ibserver.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE

C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://genhit.com/in/0871/theticheri

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll

O2 - BHO: (no name) - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - (no file)

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Keymaestro\Multimedia Keyboard\MMKeybd.exe

O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0C2.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64"

O4 - HKLM\..\Run: [PLUGIN_EBUYCLUB] C:\Program Files\PLEBICOM\Assistant eBuyClub\eBuyClub.exe

O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe

O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"

O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver\LVCOMS.EXE

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [gwiz] C:\WINDOWS\system32\ntsystem.exe

O4 - HKCU\..\Run: [PDFSaver] C:\Program Files\GénéaTique2004\PdfDrv\Install\PDFSaver.exe

O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [POP Peeper] "C:\Program Files\POP Peeper\POPPeeper.exe" -min

O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe

O4 - Global Startup: PyGrenouille.lnk = C:\Program Files\PyGrenouille\pygrenouille.exe

O4 - Global Startup: Watch.lnk = ?

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab

O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/importer/MypixUploader.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://theti-cheri.spaces.msn.com//PhotoUpload/MsnPUpld.cab

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/282718758b9f3b...RdxIE601_fr.cab

O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.fr/downloads/BUM/B..._1/axofupld.cab

O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://fdata.over-blog.com/script/ImageUploader3.cab

O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/a...AdSignerADP.cab

O16 - DPF: {E53458D2-5A83-4BD1-8DE2-EEEBE73BAB77} - http://dinet.info/e/us049/e.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: InterBaseGuardian - Inprise Corporation - C:\Program Files\Borland\InterBase\Bin\ibguard.exe

O23 - Service: InterBaseServer - Inprise Corporation - C:\Program Files\Borland\InterBase\Bin\ibserver.exe

O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe

O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Keymaestro\Multimedia Keyboard\nhksrv.exe

Modifié le 29 septembre 2006 par Théti-Chéri

bruce lee · le 25 septembre 2006

bonjour Théti-Chéri,

Si durant la procedure ci bas, il y a des etapes que tu n'as pas reussi a faire, merci de

continuer la procedure jusqu'au bout et de les signaler dans ta prochaine reponse.

1/Télécharge la version d'évaluation d'Ewido:

http://www.ewido.net/en/download/

Installe la et mets à jour.

Démarre Ewido avec l'icône qui se trouve sur ton Bureau.

Clique sur Update Now,

attend la fin de cette mise à jour,

puis ferme le programme.

2/demarre en mode sans echec http://www.sosordi.net/Faq/Faq.2.html

3/lance hijackthis en cliquant sur do a scan system only coche ces lignes:

O2 - BHO: (no name) - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - (no file)

O4 - HKLM\..\Run: [gwiz] C:\WINDOWS\system32\ntsystem.exe

O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab

O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://fdata.over-blog.com/script/ImageUploader3.cab

O16 - DPF: {E53458D2-5A83-4BD1-8DE2-EEEBE73BAB77} - http://dinet.info/e/us049/e.cab

Ferme toutes les fenêtres ouvertes sauf Hijackthis et clique sur fix checked

4/pour supprimer les fichiers nefastes on va tous les afficher en faisant comme ceci:

Démarrer, Poste de travail ou autre dossier, Menu Outils, Option des dossiers, onglet Affichage :
Cocher la case : Afficher les fichiers et dossiers cachés

Décocher la case : Masquer les extensions des fichiers dont le type est connu

Décocher la case : Masquer les fichiers protégés du système d'exploitation

cliquer sur "Appliquer"

cliquer sur le bouton "Appliquer à tous les dossiers" / OK

5/supprime ce qui est en gras:

C:\WINDOWS\system32\ ntsystem.exe<== le fichier

6/ Relance Ewido et clique sur Scanner

Puis sur l'onglets Settings, pour How to Act sélèctionne Quarantine.

Reviens a l'onglet Scan cliques Complete system Scan.

Le scan démarre.

A la fin cliquer sur Apply all actions

Puis sur Save report et pour finir Save report as enregistrer sur le Bureau.

7/redemarre en mode normal

8/poste le rapport d'ewido ainsi qu'un nouveau log hijackthis.

bon courage, et si tu as la moindre question n'hesite surtout pas

@+

Théti-Chéri · le 28 septembre 2006

bonjour Théti-Chéri,

Si durant la procedure ci bas, il y a des etapes que tu n'as pas reussi a faire, merci de

continuer la procedure jusqu'au bout et de les signaler dans ta prochaine reponse.

1/Télécharge la version d'évaluation d'Ewido:

http://www.ewido.net/en/download/

Installe la et mets à jour.

Démarre Ewido avec l'icône qui se trouve sur ton Bureau.

Clique sur Update Now,

attend la fin de cette mise à jour,

puis ferme le programme.

2/demarre en mode sans echec http://www.sosordi.net/Faq/Faq.2.html

3/lance hijackthis en cliquant sur do a scan system only coche ces lignes:

O2 - BHO: (no name) - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - (no file) Celui-là n'y était plus !

O4 - HKLM\..\Run: [gwiz] C:\WINDOWS\system32\ntsystem.exe

O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab

O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://fdata.over-blog.com/script/ImageUploader3.cab

O16 - DPF: {E53458D2-5A83-4BD1-8DE2-EEEBE73BAB77} - http://dinet.info/e/us049/e.cab

Ferme toutes les fenêtres ouvertes sauf Hijackthis et clique sur fix checked

4/pour supprimer les fichiers nefastes on va tous les afficher en faisant comme ceci:

5/supprime ce qui est en gras:

C:\WINDOWS\system32\ ntsystem.exe<== le fichier

6/ Relance Ewido et clique sur Scanner

Puis sur l'onglets Settings, pour How to Act sélèctionne Quarantine.

Reviens a l'onglet Scan cliques Complete system Scan.

Le scan démarre.

A la fin cliquer sur Apply all actions

Puis sur Save report et pour finir Save report as enregistrer sur le Bureau.

7/redemarre en mode normal

8/poste le rapport d'ewido ainsi qu'un nouveau log hijackthis.

bon courage, et si tu as la moindre question n'hesite surtout pas

@+

Bonjour Bruce Lee,

Merci de ton aide, désolée, j'ai pas pu le faire plus tôt, mais je m'y suis atteler ce matin et voici le rapport d'Ewido :

---------------------------------------------------------

ewido anti-spyware - Scan Report

---------------------------------------------------------

+ Created at: 11:44:51 28/09/2006

+ Scan result:

C:\Documents and Settings\Théti-Chéri\Local Settings\Temp\SAISetup.exe -> Adware.180Solutions : Cleaned with backup (quarantined).

C:\WINDOWS\Downloaded Program Files\USDR6V_0001_D13M1007NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.l : Cleaned with backup (quarantined).

:mozilla.57:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined).

:mozilla.58:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined).

:mozilla.59:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-chéri@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined).

:mozilla.428:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).

:mozilla.53:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).

:mozilla.60:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).

:mozilla.61:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).

:mozilla.62:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).

:mozilla.63:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).

:mozilla.64:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).

:mozilla.65:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).

:mozilla.66:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).

:mozilla.67:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][2].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-chéri@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-chéri@aavalue[2].txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][1].txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-chéri@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][2].txt -> TrackingCookie.Adition : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][2].txt -> TrackingCookie.Adocean : Cleaned with backup (quarantined).

:mozilla.669:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup (quarantined).

:mozilla.670:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup (quarantined).

:mozilla.23:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined).

:mozilla.24:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-chéri@adtech[2].txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-chéri@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][1].txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][2].txt -> TrackingCookie.Bpath : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][1].txt -> TrackingCookie.Bpath : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][1].txt -> TrackingCookie.Burstbeacon : Cleaned with backup (quarantined).

:mozilla.159:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-chéri@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][1].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).

:mozilla.742:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Casinotropez : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][2].txt -> TrackingCookie.Clickzs : Cleaned with backup (quarantined).

:mozilla.179:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined).

:mozilla.180:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-chéri@com[1].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).

:mozilla.26:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Comclick : Cleaned with backup (quarantined).

:mozilla.27:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Comclick : Cleaned with backup (quarantined).

:mozilla.28:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Comclick : Cleaned with backup (quarantined).

:mozilla.29:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Comclick : Cleaned with backup (quarantined).

:mozilla.30:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Comclick : Cleaned with backup (quarantined).

:mozilla.31:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Comclick : Cleaned with backup (quarantined).

:mozilla.22:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][1].txt -> TrackingCookie.Enhance : Cleaned with backup (quarantined).

:mozilla.233:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Estat : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-chéri@estat[1].txt -> TrackingCookie.Estat : Cleaned with backup (quarantined).

:mozilla.87:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][1].txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).

:mozilla.128:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).

:mozilla.696:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][1].txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).

:mozilla.856:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup (quarantined).

:mozilla.857:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-chéri@hypertracker[2].txt -> TrackingCookie.Hypertracker : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-chéri@ivwbox[2].txt -> TrackingCookie.Ivwbox : Cleaned with backup (quarantined).

:mozilla.754:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).

:mozilla.755:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).

:mozilla.756:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][1].txt -> TrackingCookie.Masterstats : Cleaned with backup (quarantined).

:mozilla.20:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][2].txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).

:mozilla.759:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup (quarantined).

:mozilla.760:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup (quarantined).

:mozilla.434:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][2].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-chéri@overture[2].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][1].txt -> TrackingCookie.Planetactive : Cleaned with backup (quarantined).

:mozilla.90:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).

:mozilla.91:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).

:mozilla.92:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).

:mozilla.93:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).

:mozilla.763:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).

:mozilla.764:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).

:mozilla.765:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).

:mozilla.766:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).

:mozilla.767:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][2].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).

:mozilla.158:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).

:mozilla.499:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).

:mozilla.500:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).

:mozilla.501:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).

:mozilla.502:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).

:mozilla.503:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).

:mozilla.504:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-chéri@serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).

:mozilla.138:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup (quarantined).

:mozilla.258:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup (quarantined).

:mozilla.259:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup (quarantined).

:mozilla.299:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup (quarantined).

:mozilla.300:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup (quarantined).

:mozilla.42:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).

:mozilla.43:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).

:mozilla.44:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).

:mozilla.45:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-chéri@smartadserver[1].txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][2].txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][2].txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-chéri@starware[2].txt -> TrackingCookie.Starware : Cleaned with backup (quarantined).

:mozilla.517:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).

:mozilla.518:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).

:mozilla.519:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).

:mozilla.520:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-chéri@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).

:mozilla.524:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).

:mozilla.525:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-chéri@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).

:mozilla.543:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).

:mozilla.544:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).

:mozilla.545:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-chéri@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).

:mozilla.547:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).

:mozilla.466:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup (quarantined).

:mozilla.467:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup (quarantined).

:mozilla.468:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup (quarantined).

:mozilla.469:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup (quarantined).

:mozilla.470:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup (quarantined).

:mozilla.576:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned with backup (quarantined).

:mozilla.577:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned with backup (quarantined).

:mozilla.578:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned with backup (quarantined).

:mozilla.49:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).

:mozilla.50:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).

:mozilla.51:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).

:mozilla.52:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-chéri@weborama[2].txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).

:mozilla.657:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Yadro : Cleaned with backup (quarantined).

:mozilla.658:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Yadro : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-chéri@yadro[1].txt -> TrackingCookie.Yadro : Cleaned with backup (quarantined).

:mozilla.683:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).

:mozilla.684:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).

:mozilla.76:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).

:mozilla.77:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).

:mozilla.78:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).

:mozilla.79:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).

:mozilla.80:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).

C:\Documents and Settings\Théti-Chéri\Cookies\théti-ché[email protected][1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).

:mozilla.673:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).

:mozilla.674:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).

:mozilla.675:C:\Documents and Settings\Théti-Chéri\Application Data\Mozilla\Firefox\Profiles\aesh9sx1.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).

::Report end

Et voici le rapport HijackThis :

Logfile of HijackThis v1.99.1

Scan saved at 11:56:57, on 28/09/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Keymaestro\Multimedia Keyboard\MMKeybd.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0C2.EXE

C:\Program Files\PLEBICOM\Assistant eBuyClub\eBuyClub.exe

C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe

C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe

C:\Program Files\Fichiers communs\Logitech\QCDriver\LVCOMS.EXE

C:\Program Files\ewido anti-spyware 4.0\ewido.exe

C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE

C:\Program Files\GénéaTique2004\PdfDrv\Install\PDFSaver.exe

C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

C:\Program Files\Keymaestro\Multimedia Keyboard\TrayMon.exe

C:\Program Files\Keymaestro\Onscreen Display\OSD.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe

C:\Program Files\POP Peeper\POPPeeper.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\PyGrenouille\pygrenouille.exe

C:\Program Files\Keymaestro\Multimedia Keyboard\nhksrv.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\ewido anti-spyware 4.0\guard.exe

C:\WINDOWS\system32\drivers\KodakCCS.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Internet Explorer\iexplore.exe