Résolu - probleme aprés installation de TVAnts

nawshad · le 12 mars 2007

Salut bruce

Merci pour ces info. J'ai effectué ce que tu m'a demnadé. Et voici le log de avenger

Logfile of The Avenger version 1, by Swandog46

Running from registry key:

\Registry\Machine\System\CurrentControlSet\Services\vcyfyahl

*******************

Script file located at: \??\C:\Documents and Settings\omhwuuij.txt

Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Driver 6504935B unloaded successfully.

Registry key \Registry\Machine\System\CurrentControlSet\Services\779FBF52 not found!

Unload of driver 779FBF52 failed!

Could not process line:

779FBF52

Status: 0xc0000034

Registry key \Registry\Machine\System\CurrentControlSet\Services\ffpbek not found!

Unload of driver ffpbek failed!

Could not process line:

ffpbek

Status: 0xc0000034

Driver hidproc unloaded successfully.

Driver jsefusf unloaded successfully.

Driver rdnw_o unloaded successfully.

Driver yjbrndf unloaded successfully.

Registry key \Registry\Machine\System\CurrentControlSet\Services\Std dops Service not found!

Unload of driver Std dops Service failed!

Could not process line:

Std dops Service

Status: 0xc0000034

File C:\WINDOWS\system32\atsldr.dll not found!

Deletion of file C:\WINDOWS\system32\atsldr.dll failed!

Could not process line:

C:\WINDOWS\system32\atsldr.dll

Status: 0xc0000034

File C:\WINDOWS\SYSTEM32\YJBRNDF.DLL deleted successfully.

File C:\WINDOWS\system32\6504935B.EXE not found!

Deletion of file C:\WINDOWS\system32\6504935B.EXE failed!

Could not process line:

C:\WINDOWS\system32\6504935B.EXE

Status: 0xc0000034

File C:\WINDOWS\system32\779FBF52.EXE not found!

Deletion of file C:\WINDOWS\system32\779FBF52.EXE failed!

Could not process line:

C:\WINDOWS\system32\779FBF52.EXE

Status: 0xc0000034

Could not open file C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\y52Fe340wm.exe for deletion

Deletion of file C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\y52Fe340wm.exe failed!

Could not process line:

C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\y52Fe340wm.exe

Status: 0xc000003a

File C:\WINDOWS\system32\drivers\ffpbek.sys not found!

Deletion of file C:\WINDOWS\system32\drivers\ffpbek.sys failed!

Could not process line:

C:\WINDOWS\system32\drivers\ffpbek.sys

Status: 0xc0000034

File C:\WINDOWS\system32\drivers\hidproc.sys deleted successfully.

File C:\WINDOWS\system32\drivers\jsefusf.exe not found!

Deletion of file C:\WINDOWS\system32\drivers\jsefusf.exe failed!

Could not process line:

C:\WINDOWS\system32\drivers\jsefusf.exe

Status: 0xc0000034

File C:\WINDOWS\system32\drivers\rdnw_o.sys deleted successfully.

File C:\WINDOWS\system32\drivers\yjbrndf.sys deleted successfully.

File C:\Documents and Settings\All Users\Application Data\Microsoft\Office\NAVDATA\d9XFgO1E6awebnav_2013.dll deleted successfully.

Folder C:\Program Files\vghu deleted successfully.

Folder C:\Program Files\21cn deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Et les logs de HijackThis

StartupList report, 07-03-12, 23:52:12

StartupList version: 1.52.2

Started from : C:\Documents and Settings\nawshad\Bureau\HijackThis.EXE

Detected: Windows XP SP2 (WinNT 5.01.2600)

Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)

* Using default options

* Including empty and uninteresting sections

* Showing rarely important sections

==================================================

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe

C:\Program Files\ewido anti-spyware 4.0\guard.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\nawshad\Bureau\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:

[C:\Documents and Settings\nawshad\Menu Démarrer\Programmes\Démarrage]

*No files*

Shell folders AltStartup:

*Folder not found*

User shell folders Startup:

*Folder not found*

User shell folders AltStartup:

*Folder not found*

Shell folders Common Startup:

[C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]

Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

Shell folders Common AltStartup:

*Folder not found*

User shell folders Common Startup:

*Folder not found*

User shell folders Alternate Common Startup:

*Folder not found*

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

UserInit = C:\WINDOWS\system32\userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]

*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

IgfxTray = C:\WINDOWS\system32\igfxtray.exe

HotKeysCmds = C:\WINDOWS\system32\hkcmd.exe

AGRSMMSG = AGRSMMSG.exe

Zone Labs Client = "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

LVCOMSX = C:\WINDOWS\system32\LVCOMSX.EXE

SunJavaUpdateSched = "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"

QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime

PCSuiteTrayApplication = C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

TkBellExe = "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

AVP = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"

IMJPMIG8.1 = "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

IMEKRMIG6.1 = C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE

MSPY2002 = C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

PHIME2002ASync = C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

PHIME2002A = C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

SoundMan = SOUNDMAN.EXE

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*No values found*

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

msnmsgr = "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

swg = C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*No values found*

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[OptionalComponents]

*No values found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

File association entry for .EXE:

HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .COM:

HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .BAT:

HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .PIF:

HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .SCR:

HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

--------------------------------------------------

File association entry for .HTA:

HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINDOWS\system32\mshta.exe "%1" %*

--------------------------------------------------

File association entry for .TXT:

HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

--------------------------------------------------

Enumerating Active Setup stub paths:

HKLM\Software\Microsoft\Active Setup\Installed Components

(* = disabled by HKCU twin)

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]

StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *

StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *

StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *

StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *

StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *

StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *

StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *

StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *

StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *

StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *

StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *

StubPath = %SystemRoot%\system32\ie4uinit.exe

--------------------------------------------------

Enumerating ICQ Agent Autostart apps:

HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=*INI section not found*

run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*

HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*

HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*

HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*

HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*

HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*

HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*

HKCU\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*

HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*

SCRNSAVE.EXE=*INI section not found*

drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe

SCRNSAVE.EXE=*Registry value not found*

drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*

HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present

C:\WINDOWS\Explorer\Explorer.exe: not present

C:\WINDOWS\System\Explorer.exe: not present

C:\WINDOWS\System32\Explorer.exe: not present

C:\WINDOWS\Command\Explorer.exe: not present

C:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)

.pif: HIDDEN! (arrow overlay: yes)

.exe: not hidden

.com: not hidden

.bat: not hidden

.hta: not hidden

.scr: not hidden

.shs: HIDDEN!

.shb: HIDDEN!

.vbs: not hidden

.vbe: not hidden

.wsh: not hidden

.scf: HIDDEN! (arrow overlay: NO!)

.url: HIDDEN! (arrow overlay: yes)

.js: not hidden

.jse: not hidden

--------------------------------------------------

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINDOWS

- .reg open command is normal (regedit.exe %1)

- Regedit.exe has no CompanyName property! It is either missing or named something else.

- Regedit.exe has no OriginalFilename property! It is either missing or named something else.

- Regedit.exe has no FileDescription property! It is either missing or named something else.

Registry check failed!

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

(no name) - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}

(no name) - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll - {9030D464-4C02-4ABF-8ECC-5164760863C6}

(no name) - c:\program files\google\googletoolbar3.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}

(no name) - C:\Program Files\Windows Live Toolbar\msntb.dll - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}

(no name) - (no file) - {C14393E1-95FF-4DFF-9BE0-EA008D4EF930}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Check Updates for Windows Live Toolbar.job

Maintenance en 1 clic.job

--------------------------------------------------

Enumerating Download Program Files:

[Microsoft XML Parser for Java]

CODEBASE = file://C:\WINDOWS\Java\classes\xmldso.cab

OSD = C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd

[QuickTime Object]

InProcServer32 = C:\Program Files\QuickTime\QTPlugin.ocx

CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab

[shockwave ActiveX Control]

InProcServer32 = C:\WINDOWS\system32\macromed\Director\SwDir.dll

CODEBASE = http://download.macromedia.com/pub/shockwa...director/sw.cab

[Contrôleur de DownloadManager]

InProcServer32 = C:\WINDOWS\DOWNLO~1\DOWNLO~1.OCX

CODEBASE = http://dlm.tools.akamai.com/dlmanager/vers...vex-2.0.6.5.cab

[Office Update Installation Engine]

InProcServer32 = C:\WINDOWS\opuc.dll

CODEBASE = http://office.microsoft.com/officeupdate/content/opuc3.cab

[WUWebControl Class]

InProcServer32 = C:\WINDOWS\system32\wuweb.dll

CODEBASE = http://update.microsoft.com/windowsupdate/...b?1172787885713

[Microsoft RDP Client Control (redist)]

InProcServer32 = C:\WINDOWS\Downloaded Program Files\msrdp.ocx

CODEBASE = http://tsweb.epfl.ch/msrdp.cab

[Java Plug-in 1.5.0_11]

InProcServer32 = C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

CODEBASE = http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab

[Java Plug-in 1.5.0_08]

InProcServer32 = C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

CODEBASE = http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab

[Java Plug-in 1.5.0_09]

InProcServer32 = C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

CODEBASE = http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab

[Java Plug-in 1.5.0_10]

InProcServer32 = C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

CODEBASE = http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab

[Java Plug-in 1.5.0_11]

InProcServer32 = C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

CODEBASE = http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab

[Java Plug-in 1.5.0_11]

InProcServer32 = C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll

CODEBASE = http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab

[shockwave Flash Object]

InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx

CODEBASE = http://download.macromedia.com/pub/shockwa...ash/swflash.cab

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: C:\WINDOWS\System32\mswsock.dll

NameSpace #2: C:\WINDOWS\System32\winrnr.dll

NameSpace #3: C:\WINDOWS\System32\mswsock.dll

Protocol #1: C:\WINDOWS\system32\mswsock.dll

Protocol #2: C:\WINDOWS\system32\mswsock.dll

Protocol #3: C:\WINDOWS\system32\mswsock.dll

Protocol #4: C:\WINDOWS\system32\rsvpsp.dll

Protocol #5: C:\WINDOWS\system32\rsvpsp.dll

Protocol #6: C:\WINDOWS\system32\mswsock.dll

Protocol #7: C:\WINDOWS\system32\mswsock.dll

Protocol #8: C:\WINDOWS\system32\mswsock.dll

Protocol #9: C:\WINDOWS\system32\mswsock.dll

Protocol #10: C:\WINDOWS\system32\mswsock.dll

Protocol #11: C:\WINDOWS\system32\mswsock.dll

Protocol #12: C:\WINDOWS\system32\mswsock.dll

Protocol #13: C:\WINDOWS\system32\mswsock.dll

Protocol #14: C:\WINDOWS\system32\mswsock.dll

Protocol #15: C:\WINDOWS\system32\mswsock.dll

Protocol #16: C:\WINDOWS\system32\mswsock.dll

Protocol #17: C:\WINDOWS\system32\mswsock.dll

Protocol #18: C:\WINDOWS\system32\mswsock.dll

Protocol #19: C:\WINDOWS\system32\mswsock.dll

--------------------------------------------------

Enumerating Windows NT/2000/XP services

Pilote ACPI Microsoft: system32\DRIVERS\ACPI.sys (system)

Pilote de contrôleur intégré Microsoft: system32\DRIVERS\ACPIEC.sys (system)

Suppresseur d'écho acoustique (Noyau Microsoft): system32\drivers\aec.sys (manual start)

AFD: \SystemRoot\System32\drivers\afd.sys (system)

Agere Systems Soft Modem: system32\DRIVERS\AGRSM.sys (manual start)

Service for WDM 3D Audio Driver: system32\drivers\ALCXSENS.SYS (manual start)

Service for Realtek AC97 Audio (WDM): system32\drivers\ALCXWDM.SYS (manual start)

Avertissement: %SystemRoot%\system32\svchost.exe -k LocalService (disabled)

Service de la passerelle de la couche Application: %SystemRoot%\System32\alg.exe (manual start)

Gestion d'applications: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

Pilote de média asynchrone RAS: system32\DRIVERS\asyncmac.sys (manual start)

Contrôleur de disque dur IDE/ESDI standard: system32\DRIVERS\atapi.sys (system)

Protocole client ATM ARP: system32\DRIVERS\atmarpc.sys (manual start)

Audio Windows: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Pilote audio Stub: system32\DRIVERS\audstub.sys (manual start)

Kaspersky Anti-Virus 6.0: "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (autostart)

Service de transfert intelligent en arrière-plan: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

Explorateur d'ordinateur: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Décodeur sous-titre fermé: system32\DRIVERS\CCDECODE.sys (manual start)

Pilote de CD-ROM: system32\DRIVERS\cdrom.sys (system)

Indexing Service: %SystemRoot%\system32\cisvc.exe (manual start)

Gestionnaire de l'Album: %SystemRoot%\system32\clipsrv.exe (disabled)

Pilote pour Batterie à méthode de contrôle ACPI Microsoft: system32\DRIVERS\CmBatt.sys (manual start)

combofix: C:\WINDOWS\system32\cmd.exe /c start /i /dC:\ComboFix combofix.exe.bat /\c@ (manual start)

Pilote de batterie composite Microsoft: system32\DRIVERS\compbatt.sys (system)

Application système COM+: C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)

Services de cryptographie: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Lanceur de processus serveur DCOM: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)

Client DHCP: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Pilote de disque: system32\DRIVERS\disk.sys (system)

Service d'administration du Gestionnaire de disque logique: %SystemRoot%\System32\dmadmin.exe /com (manual start)

dmboot: System32\drivers\dmboot.sys (disabled)

Pilote de Gestionnaire de disque logique: system32\DRIVERS\dmio.sys (system)

Gestionnaire de disque logique: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Synthétiseur DLS du noyau Microsoft: system32\drivers\DMusic.sys (manual start)

Client DNS: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart)

Std dops Service: C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\vghu\itue.dll,Service -s (autostart)

Filtre de décodeur DRM (Noyau Microsoft): system32\drivers\drmkaud.sys (manual start)

Service de rapport d'erreurs: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Journal des événements: %SystemRoot%\system32\services.exe (autostart)

Système d'événements de COM+: C:\WINDOWS\system32\svchost.exe -k netsvcs (manual start)

ewido anti-spyware 4.0 driver: \??\C:\Program Files\ewido anti-spyware 4.0\guard.sys (system)

ewido anti-spyware 4.0 guard: C:\Program Files\ewido anti-spyware 4.0\guard.exe (autostart)

Compatibilité avec le Changement rapide d'utilisateur: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

FltMgr: system32\DRIVERS\fltMgr.sys (system)

Pilote du Gestionnaire de volume: system32\DRIVERS\ftdisk.sys (system)

gmer: System32\DRIVERS\gmer.sys (manual start)

Classificateur de paquets générique: system32\DRIVERS\msgpc.sys (manual start)

Google Updater Service: "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" (manual start)

Aide et support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Pilote de classe HID Microsoft: system32\DRIVERS\hidusb.sys (manual start)

HTTP: System32\Drivers\HTTP.sys (manual start)

HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)

Pilote pour clavier i8042 et souris sur port PS/2: system32\DRIVERS\i8042prt.sys (system)

ialm: system32\DRIVERS\ialmnt5.sys (manual start)

InstallDriver Table Manager: "C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe" (disabled)

Administration IIS: C:\WINDOWS\system32\inetsrv\inetinfo.exe (autostart)

Pilote de filtre de gravure CD: system32\DRIVERS\imapi.sys (system)

Service COM de gravage de CD IMAPI: C:\WINDOWS\system32\imapi.exe (manual start)

IntelIde: system32\DRIVERS\intelide.sys (system)

Pilote de processeur Intel: system32\DRIVERS\intelppm.sys (system)

Pilote du pare-feu Windows IPv6: system32\DRIVERS\Ip6Fw.sys (manual start)

Pilote de filtre de trafic IP: system32\DRIVERS\ipfltdrv.sys (manual start)

Pilote de tunnelage IP dans IP: system32\DRIVERS\ipinip.sys (manual start)

Traducteur d'adresses réseau IP: system32\DRIVERS\ipnat.sys (manual start)

Pilote IPSEC: system32\DRIVERS\ipsec.sys (system)

Service énumérateur IR: system32\DRIVERS\irenum.sys (manual start)

Pilote de bus Plug-and-Play ISA/EISA: system32\DRIVERS\isapnp.sys (system)

Pilote de la classe Clavier: system32\DRIVERS\kbdclass.sys (system)

Pilote HID de clavier: system32\DRIVERS\kbdhid.sys (system)

System Local Kernel Service: "C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\y52Fe340wm.exe" (autostart)

Kl1: system32\drivers\kl1.sys (system)

Klif: \??\C:\WINDOWS\system32\drivers\klif.sys (system)

Mélangeur audio Wave de noyau Microsoft: system32\drivers\kmixer.sys (manual start)

Serveur: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Station de travail: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Assistance TCP/IP NetBIOS: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)

Affichage des messages: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)

Partage de Bureau à distance NetMeeting: C:\WINDOWS\system32\mnmsrvc.exe (manual start)

Pilote de la classe Souris: system32\DRIVERS\mouclass.sys (system)

Pilote HID de souris: system32\DRIVERS\mouhid.sys (manual start)

Redirecteur client WebDav: system32\DRIVERS\mrxdav.sys (manual start)

MRXSMB: system32\DRIVERS\mrxsmb.sys (system)

Distributed Transaction Coordinator: C:\WINDOWS\system32\msdtc.exe (manual start)

Windows Installer: C:\WINDOWS\system32\msiexec.exe /V (manual start)

Proxy de service de répartition Microsoft: system32\drivers\MSKSSRV.sys (manual start)

Proxy d'horloge de répartition Microsoft: system32\drivers\MSPCLOCK.sys (manual start)

Proxy de gestion de qualité de répartition Microsoft: system32\drivers\MSPQM.sys (manual start)

Pilote BIOS de gestion de systèmes Microsoft: system32\DRIVERS\mssmbios.sys (manual start)

Convertisseur en T/site-à-site de répartition Microsoft: system32\drivers\MSTEE.sys (manual start)

Codec NABTS/FEC VBI: system32\DRIVERS\NABTSFEC.sys (manual start)

Connection TV/vidéo Microsoft: system32\DRIVERS\NdisIP.sys (manual start)

Pilote TAPI NDIS d'accès distant: system32\DRIVERS\ndistapi.sys (manual start)

NDIS mode utilisateur E/S Protocole: system32\DRIVERS\ndisuio.sys (manual start)

Pilote réseau étendu NDIS d'accès distant: system32\DRIVERS\ndiswan.sys (manual start)

Interface NetBIOS: system32\DRIVERS\netbios.sys (system)

NetBIOS sur TCP/IP: system32\DRIVERS\netbt.sys (system)

DDE réseau: %SystemRoot%\system32\netdde.exe (disabled)

DSDM DDE réseau: %SystemRoot%\system32\netdde.exe (disabled)

Ouverture de session réseau: %SystemRoot%\system32\lsass.exe (manual start)

Connexions réseau: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

NLA (Network Location Awareness): %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

Nokia USB Generic: system32\drivers\nmwcdc.sys (manual start)

Nokia USB Modem: system32\drivers\nmwcdcm.sys (manual start)

Nokia USB Phone Parent: system32\drivers\nmwcd.sys (manual start)

NetGroup Packet Filter Driver: system32\drivers\npf.sys (manual start)

Fournisseur de la prise en charge de sécurité LM NT: %SystemRoot%\system32\lsass.exe (manual start)

Stockage amovible: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

Pilote de filtre de trafic IPX: system32\DRIVERS\nwlnkflt.sys (manual start)

Pilote de transfert de trafic IPX: system32\DRIVERS\nwlnkfwd.sys (manual start)

OpenVPN Service: C:\Program Files\OpenVPN\bin\openvpnserv.exe (manual start)

Office Source Engine: "C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE" (manual start)

Pilote de bus PCI: system32\DRIVERS\pci.sys (system)

Pcmcia: system32\DRIVERS\pcmcia.sys (system)

VSO Software pcouffin: System32\Drivers\pcouffin.sys (manual start)

Logitech QuickCam Pro 3000(PID_08B0): system32\DRIVERS\CamDrL21.sys (manual start)

Plug-and-Play: %SystemRoot%\system32\services.exe (autostart)

Services IPSEC: %SystemRoot%\system32\lsass.exe (autostart)

Miniport réseau étendu (PPTP): system32\DRIVERS\raspptp.sys (manual start)

PRISM 802.11 Driver: system32\DRIVERS\PRISMA00.sys (manual start)

Emplacement protégé: %SystemRoot%\system32\lsass.exe (autostart)

Planificateur de paquets QoS: system32\DRIVERS\psched.sys (manual start)

Pilote de liaison parallèle directe: system32\DRIVERS\ptilink.sys (manual start)

PxHelp20: System32\Drivers\PxHelp20.sys (system)

Pilote de connexion automatique d'accès distant: system32\DRIVERS\rasacd.sys (system)

Gestionnaire de connexion automatique d'accès distant: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

Miniport réseau étendu (L2TP): system32\DRIVERS\rasl2tp.sys (manual start)

Gestionnaire de connexions d'accès distant: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

Pilote PPPOE d'accès à distance: system32\DRIVERS\raspppoe.sys (manual start)

Parallèle direct: system32\DRIVERS\raspti.sys (manual start)

Rdbss: system32\DRIVERS\rdbss.sys (system)

rdnw_o: system32\drivers\rdnw_o.sys (system)

RDPCDD: System32\DRIVERS\RDPCDD.sys (system)

Pilote de redirecteur de périphérique Terminal Server: system32\DRIVERS\rdpdr.sys (manual start)

Gestionnaire de session d'aide sur le Bureau à distance: C:\WINDOWS\system32\sessmgr.exe (manual start)

Pilote de filtre de lecture digitale de CD audio: system32\DRIVERS\redbook.sys (system)

Routage et accès distant: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)

Accès à distance au Registre: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)

Microsoft Legacy Modem Driver: System32\Drivers\RootMdm.sys (manual start)

Remote Packet Capture Protocol v.0 (experimental): "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" (manual start)

Localisateur d'appels de procédure distante (RPC): %SystemRoot%\system32\locator.exe (manual start)

Appel de procédure distante (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)

QoS RSVP: %SystemRoot%\system32\rsvp.exe (manual start)

Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C): system32\DRIVERS\RTL8139.SYS (manual start)

Gestionnaire de comptes de sécurité: %SystemRoot%\system32\lsass.exe (autostart)

Carte à puce: %SystemRoot%\System32\SCardSvr.exe (manual start)

Planificateur de tâches: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Secdrv: system32\DRIVERS\secdrv.sys (manual start)

Connexion secondaire: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Notification d'événement système: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

ServiceLayer: "C:\Program Files\PC Connectivity Solution\ServiceLayer.exe" (manual start)

Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Détection matériel noyau: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Détrameur décalage BDA: system32\DRIVERS\SLIP.sys (manual start)

Simple Mail Transfer Protocol (SMTP): C:\WINDOWS\system32\inetsrv\inetinfo.exe (autostart)

Splitter audio du noyau Microsoft: system32\drivers\splitter.sys (manual start)

Spouleur d'impression: %SystemRoot%\system32\spoolsv.exe (autostart)

Pilote de filtre de restauration système: system32\DRIVERS\sr.sys (system)

srescan: system32\ZoneLabs\srescan.sys (system)

Service de restauration système: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Srv: system32\DRIVERS\srv.sys (manual start)

Service de découvertes SSDP: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)

Acquisition d'image Windows (WIA): %SystemRoot%\system32\svchost.exe -k imgsvc (autostart)

BDA IPSink: system32\DRIVERS\StreamIP.sys (manual start)

Pilote de bus logiciel: system32\DRIVERS\swenum.sys (manual start)

Synthétiseur de table de sons GC noyau Microsoft: system32\drivers\swmidi.sys (manual start)

MS Software Shadow Copy Provider: C:\WINDOWS\system32\dllhost.exe /Processid:{FFB46127-4F2A-4FB7-868A-77D6D7A664E4} (manual start)

Périphérique audio système du noyau Microsoft: system32\drivers\sysaudio.sys (manual start)

Journaux et alertes de performance: %SystemRoot%\system32\smlogsvc.exe (manual start)

TAP-Win32 Adapter V8: system32\DRIVERS\tap0801.sys (manual start)

Téléphonie: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

Pilote du protocole TCP/IP: system32\DRIVERS\tcpip.sys (system)

Pilote de périphérique terminal: system32\DRIVERS\termdd.sys (system)

Services Terminal Server: %SystemRoot%\System32\svchost -k DComLaunch (manual start)

Thèmes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Telnet: C:\WINDOWS\system32\tlntsvr.exe (manual start)

tmcomm: \??\C:\WINDOWS\system32\drivers\tmcomm.sys (autostart)

Client de suivi de lien distribué: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

TSP: \??\C:\WINDOWS\system32\drivers\klif.sys (manual start)

Windows User Mode Driver Framework: C:\WINDOWS\system32\wdfmgr.exe (manual start)

Pilote de mise à jour microcode: system32\DRIVERS\update.sys (manual start)

Hôte de périphérique universel Plug-and-Play: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)

Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start)

Pilote USB audio (WDM): system32\drivers\usbaudio.sys (manual start)

Pilote parent générique USB Microsoft: system32\DRIVERS\usbccgp.sys (manual start)

Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0: system32\DRIVERS\usbehci.sys (manual start)

Concentrateur USB2: system32\DRIVERS\usbhub.sys (manual start)

Pilote de stockage de masse USB: system32\DRIVERS\USBSTOR.SYS (manual start)

Pilote miniport de contrôleur hôte universel USB Microsoft: system32\DRIVERS\usbuhci.sys (manual start)

Broadcom USB Remote NDIS Device Driver: system32\DRIVERS\usb8023.sys (manual start)

Service Messenger Sharing Folders USN Journal Reader: "C:\Program Files\MSN Messenger\usnsvc.exe" (manual start)

Extension de conception TuneUp: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

VgaSave: \SystemRoot\System32\drivers\vga.sys (system)

vsdatant: System32\vsdatant.sys (system)

TrueVector Internet Monitor: C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service (autostart)

Cliché instantané de volume: %SystemRoot%\System32\vssvc.exe (manual start)

Horloge Windows: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Publication World Wide Web: %SystemRoot%\system32\inetsrv\inetinfo.exe (autostart)

Sony Ericsson W810 Driver driver (WDM): system32\DRIVERS\w810bus.sys (manual start)

Sony Ericsson W810 USB WMC Modem Filter: system32\DRIVERS\w810mdfl.sys (manual start)

Sony Ericsson W810 USB WMC Modem Driver: system32\DRIVERS\w810mdm.sys (manual start)

Sony Ericsson W810 USB WMC Device Management Drivers (WDM): system32\DRIVERS\w810mgmt.sys (manual start)

Sony Ericsson W810 USB WMC OBEX Interface: system32\DRIVERS\w810obex.sys (manual start)

wampapache: "c:\wamp\apache2\bin\httpd.exe" -k runservice (manual start)

wampmysqld: c:\wamp\mysql\bin\mysqld-nt.exe --defaults-file=c:\wamp\mysql\my.ini wampmysqld (manual start)

Pilote ARP IP d'accès distant: system32\DRIVERS\wanarp.sys (manual start)

Pilote WINMM de compatibilité audio WDM Microsoft: system32\drivers\wdmaud.sys (manual start)

WebClient: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)

Infrastructure de gestion Windows: %systemroot%\system32\svchost.exe -k netsvcs (autostart)

Service de numéro de série du lecteur multimédia portable: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

Extensions du pilote WMI: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

Carte de performance WMI: C:\WINDOWS\system32\wbem\wmiapsrv.exe (manual start)

Centre de sécurité: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Codec Teletext standard: system32\DRIVERS\WSTCODEC.SYS (manual start)

Mises à jour automatiques: %systemroot%\system32\svchost.exe -k netsvcs (autostart)

Configuration automatique sans fil: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Service d'approvisionnement réseau: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

yjbrndf: system32\drivers\yjbrndf.sys (system)

--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:

*No scripts set to run*

Windows NT checkdisk command:

BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':

PendingFileRenameOperations: *Registry value not found*

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll

CDBurn: C:\WINDOWS\system32\SHELL32.dll

WebCheck: C:\WINDOWS\system32\webcheck.dll

SysTray: C:\WINDOWS\system32\stobject.dll

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*No values found*

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*No values found*

--------------------------------------------------

End of report, 38,141 bytes

Report generated in 0.150 seconds

Command line options:

/verbose - to add additional info on each section

/complete - to include empty sections and unsuspicious data

/full - to include several rarely-important sections

/force9x - to include Win9x-only startups even if running on WinNT

/forcent - to include WinNT-only startups even if running on Win9x

/forceall - to include all Win9x and WinNT startups, regardless of platform

/history - to list version history only

Voici voila:)

PS:Désolé de te répondre à chaque fois le soir. Je bosse la journée.

J'attends ta reponse. Merci pour ces info

bruce lee · le 13 mars 2007

Salut nawshad,

Poste un nouvau rapport Hijackthis.

La nouvelle startuplist ne va pas refais en une:

lances hijackthis et tu vas dans:

Open Misc Tools Section

Assure toi que les deux cases de droite sont bien cochées:

* List all minor sections(Full)

* List Empty Sections(Complete)

Clique sur Generate StartupList Log

Click sur "oui" lorsque l'on te le demande.

Cela va générer un rapport, tu me le copies dans son integralité.

P.S: pas de problemes, réponds quand tu peux

nawshad · le 13 mars 2007

Salut bruce

Voici le nouveau log de HijackThis

StartupList report, 07-03-13, 16:52:14

StartupList version: 1.52.2

Started from : C:\Documents and Settings\nawshad\Bureau\HijackThis.EXE

Detected: Windows XP SP2 (WinNT 5.01.2600)

Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)

* Using default options

* Including empty and uninteresting sections

* Showing rarely important sections

==================================================

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

C:\Program Files\ewido anti-spyware 4.0\guard.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

C:\WINDOWS\system32\wuauclt.exe