Pub pour nettoyer mon PC

Dgyles · le 27 mars 2007

Bonjour à tous.

J'ai consulter pas mal de post avant de venir sur ce forum qui me semble être le meilleure...

Comme nombre d'entre nous, je suis infecté par ces fenêtre - onglet qui s'ouvre sans me demander mon avis pour installer WinAntiVirus, DriveCleaner et j'en passe.

Apparemment, il faut régler les cas au cas par cas justement. Alors voici mes logs HiJack et Navilog:

Logfile of HijackThis v1.99.1

Scan saved at 09:03:40, on 27.03.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\brsvc01a.exe

C:\WINDOWS\System32\brss01a.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\Program Files\Fichiers communs\EPSON\eEBAPI\eEBSVC.exe

C:\PROGRA~1\APC\POWERC~1\agent\pbeagent.exe

C:\Program Files\EpsonNet\common\bin\ensrvmgr.exe

C:\Program Files\EpsonNet\common\bin\emwchsrv.exe

C:\Program Files\FolderSize\FolderSizeSvc.exe

C:\Program Files\EpsonNet\EpsonNet SOAP Server\bin\emsoaprr.exe

C:\Program Files\EpsonNet\EpsonNet Web Pages Service\bin\ewpsrr.exe

C:\Program Files\EpsonNet\common\bin\emalmmon.exe

C:\Program Files\EpsonNet\EpsonNet Information Center\bin\emntfsrv.exe

C:\Program Files\EpsonNet\EpsonNet HTTP Server\bin\apache.exe

C:\Program Files\Network Associates\VirusScan\Mcshield.exe

C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

C:\Program Files\EpsonNet\EpsonNet HTTP Server\bin\apache.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\PostgreSQL4Tiny ERP Demo\bin\pg_ctl.exe

C:\Program Files\Dell\OpenManage\Drac\client\RacAddrs.exe

C:\Program Files\PostgreSQL4Tiny ERP Demo\bin\postmaster.exe

C:\Program Files\Spyware Doctor\sdhelp.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Rainbow Technologies\SPN Combo Installer\1.0.5\Server\WinNT\spnsrvnt.exe

C:\WINDOWS\System32\wdfmgr.exe

C:\WINDOWS\system32\NWTRAY.EXE

C:\Program Files\Logitech\iTouch\iTouch.exe

C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE

C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe

C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

C:\Program Files\GFI\FAXmaker Client\fmstart.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\PostgreSQL4Tiny ERP Demo\bin\postgres.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\WINDOWS\wt\updater\wcmdmgr.exe

C:\Program Files\PostgreSQL4Tiny ERP Demo\bin\postgres.exe

C:\Program Files\Microsoft Firewall Client\ISATRAY.EXE

C:\Program Files\PostgreSQL4Tiny ERP Demo\bin\postgres.exe

C:\Corel\Graphics8\Programs\MFIndexer.exe

C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\W32MKDE.EXE

C:\WINDOWS\System32\wbem\wmiapsrv.exe

C:\WINDOWS\Explorer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\PROGRA~1\MICROS~3\OFFICE11\OUTLOOK.EXE

C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat.exe

C:\WINDOWS\system32\rundll32.exe

J:\Utilitaire\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/ch/des/gen/default.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/ch/des/gen/default.htm

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/ch/des/gen/default.htm

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.trendmicro-europe.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = serverisa:8080

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE

O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe

O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"

O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [FMStart] "C:\Program Files\GFI\FAXmaker Client\fmstart.exe"

O4 - HKLM\..\Run: [soundService] rundll32.exe "C:\WINDOWS\system32\wjtsgugr.dll",setvm

O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Analyseur de connectivité de client de pare-feu.LNK = C:\Program Files\Microsoft Firewall Client\ISATRAY.EXE

O4 - Global Startup: Corel MEDIA FOLDERS INDEXER 8.LNK = C:\Corel\Graphics8\Programs\MFIndexer.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Ouvrir l'image dans &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~3\Office\1036\phdintl.dll/phdContext.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\Program Files\Copernic Agent\CopernicAgent.exe (file missing)

O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\Program Files\Copernic Agent\CopernicAgent.exe (file missing)

O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\Program Files\Copernic Agent\CopernicAgent.exe (file missing)

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB

O16 - DPF: {1F831FA7-42FC-11D4-95A6-0080AD30DCE1} - file://C:\Program Files\AutoCAD LT 2002 Fra\InstFred.ocx

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab

O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/fr/big/1.1....g/GoogleNav.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/76808a0...all/xscan53.cab

O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} - http://support.euro.dell.com/global/apps/s...er/PROFILER.CAB

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - http://www.pandasoftware.com/activescan/as5/asinst.cab

O16 - DPF: {AE563727-B4F5-11D4-A415-00108302FDFD} - file://C:\Program Files\AutoCAD LT 2002 Fra\InstBanr.ocx

O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} - file://C:\Program Files\AutoCAD LT 2002 Fra\AcPreview.ocx

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = safed.ch

O17 - HKLM\Software\..\Telephony: DomainName = safed.ch

O17 - HKLM\System\CCS\Services\Tcpip\..\{1E1F01FB-376E-4327-8CC7-D01D394A98F6}: Domain = safed.ch

O17 - HKLM\System\CCS\Services\Tcpip\..\{1E1F01FB-376E-4327-8CC7-D01D394A98F6}: NameServer = 192.0.4.100

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = safed.ch

O23 - Service: Active Task Manager - Unknown owner - C:\Program Files\Active Task Manager\atmsrv95.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: APC PBE Agent (APCPBEAgent) - APC - C:\PROGRA~1\APC\POWERC~1\agent\pbeagent.exe

O23 - Service: AutoComplete Service (Autocomplete) - Unknown owner - C:\PROGRA~1\INTERN~2\autocomp.exe (file missing)

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe

O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINDOWS\System32\cusrvc.exe

O23 - Service: EpsonBidirectionalService - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\eEBAPI\eEBSVC.exe

O23 - Service: EpsonNet Primitive Service (EpsonNet_Primitive_Service) - Unknown owner - C:\Program Files\EpsonNet\common\bin\ensrvmgr.exe

O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe

O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PostgreSQL Database Server 8.1 (pgsql-8.1) - Unknown owner - C:\Program Files\PostgreSQL4Tiny ERP Demo\bin\pg_ctl.exe" runservice -N "pgsql-8.1" -D "C:\Program Files\PostgreSQL4Tiny ERP Demo\data\ (file missing)

O23 - Service: DRAC AddressBook Server (RacAddrBook) - American Megatrends Inc. - C:\Program Files\Dell\OpenManage\Drac\client\RacAddrs.exe

O23 - Service: DRAC CardObject Server (RacObject) - American Megatrends Inc. - C:\Program Files\Dell\OpenManage\Drac\client\MStation.exe

O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\Sptisrv.exe

O23 - Service: SuperProServer - Unknown owner - C:\Program Files\Rainbow Technologies\SPN Combo Installer\1.0.5\Server\WinNT\spnsrvnt.exe

Search Navipromo version 1.0.8 commencé le 27.03.2007 à 9:07:27.63

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!

!!! Poster ce rapport sur le forum pour le faire analyser !!!

!!! Ne pas lancer la partie désinfection sans l'avis d'un spécialiste !!!

Fix lancé depuis J:\Utilitaire\HiJackThis

Mise a jour le 26.03.2007 a 08h00 by IL-MAFIOSO

Executé en mode normal

*** Recherche Programmes installes ***

*** Recherche dossiers dans C:\WINDOWS ***

*** Recherche dossiers dans C:\Program Files ***

*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***

*** Recherche dossiers dans C:\Documents and Settings\GM\Application Data ***

*** Recherche avec BlackLight Engine/F-secure ***

BlackLight Engine est un produit de F-secure, pour + d'infos :

http://www.f-secure.com/blacklight/blacklight_help.html

F-SECURE BLACKLIGHT ROOTKIT ELIMINATOR

======================================

This is a beta version. It will expire on 1st of April, 2007.

Version information: 2.2.1055.

[+] Started on 03/27/07 at 09:07:35.

[+] Initializing ...

[+] Starting scan, press Ctrl-C to abort.

[+] Scanning for hidden items ..................................................................................................................................................................................................................................

[+] Scan complete.

[+] Summary: 0 hidden item(s) found, 0 scheduled for renaming.

[+] Exited on 03/27/07 at 09:36:29 (return code = 0).

*** Recherche fichiers ***

*** Recherche cles registre ***

Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs]

Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage]

Recherche Clé Magic Control

*** Module de recherche complémentaire ***

(recherche fichiers spécifiques)

1)Recherche fichiers connus:

C:\WINDOWS\system32\wycdd.bak1 trouvé ! infection Vundo possible non traité par cet outil !

C:\WINDOWS\system32\wycdd.bak2 trouvé ! infection Vundo possible non traité par cet outil !

2)Recherche Heuristique :

*

**

***

****

*****

******

*******

********

*** Analyse Terminé le 27.03.2007 à 9:38:55.52 ***

Merci d'avance de votre aide.

Malekal_morte · le 27 mars 2007

Bonjour !

- Télécharge Vundoxfix de Atribune - mirror si le lien ne fonctionne pas : http://www.softpedia.com/get/Antivirus/VundoFix.shtml

- Double-clique VundoFix.exe afin de le lancer.

- Clique sur le bouton Scan for Vundo.

- Lorsque le scan est complété, clique sur le bouton Remove Vundo.

- Une invite te demandera si tu veux supprimer les fichiers, clique YES

- Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.

- Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown") ; clique OK

- Démarre ton PC à nouveau.

- Copie/colle le contenu du rapport situé dans C:\vundofix.txt

ET :

J:\Utilitaire\HiJackThis\HijackThis.exe <-- renomme le en scanner.exe

double-clic sur scanner.exe

Poste un nouveau rapport aveC.

Dgyles · le 27 mars 2007

ET :
J:\Utilitaire\HiJackThis\HijackThis.exe <-- renomme le en scanner.exe

double-clic sur scanner.exe

Poste un nouveau rapport aveC.

Je fais la 1ère partie dès maintenant. Pour ce qui est de ce point cité J: est juste un lecteur réseaux où a été télécharger HiJack.

Merci.

Dgyles · le 27 mars 2007

Rapport 1:

VundoFix V6.3.18

Checking Java version...

Scan started at 14:58:16 27.03.2007

Listing files found while scanning....

C:\WINDOWS\system32\bgmxmync.dll

C:\WINDOWS\system32\ddcyw.dll

C:\WINDOWS\SYSTEM32\inusnfuw.dll

C:\WINDOWS\SYSTEM32\jkkljih.dll

C:\WINDOWS\SYSTEM32\rgugstjw.ini

C:\WINDOWS\SYSTEM32\wjtsgugr.dll

C:\WINDOWS\SYSTEM32\wycdd.bak1

C:\WINDOWS\SYSTEM32\wycdd.bak2

C:\WINDOWS\SYSTEM32\wycdd.ini

Beginning removal...

Attempting to delete C:\WINDOWS\system32\bgmxmync.dll

C:\WINDOWS\system32\bgmxmync.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ddcyw.dll

C:\WINDOWS\system32\ddcyw.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\inusnfuw.dll

C:\WINDOWS\SYSTEM32\inusnfuw.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\jkkljih.dll

C:\WINDOWS\SYSTEM32\jkkljih.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\rgugstjw.ini

C:\WINDOWS\SYSTEM32\rgugstjw.ini Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\wjtsgugr.dll

C:\WINDOWS\SYSTEM32\wjtsgugr.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\wycdd.bak1

C:\WINDOWS\SYSTEM32\wycdd.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\wycdd.bak2

C:\WINDOWS\SYSTEM32\wycdd.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\wycdd.ini

C:\WINDOWS\SYSTEM32\wycdd.ini Has been deleted!

Performing Repairs to the registry.

Done!

Rapport 2:

Logfile of HijackThis v1.99.1

Scan saved at 16:07:03, on 27.03.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\brsvc01a.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\System32\brss01a.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\Program Files\Fichiers communs\EPSON\eEBAPI\eEBSVC.exe

C:\PROGRA~1\APC\POWERC~1\agent\pbeagent.exe

C:\Program Files\EpsonNet\common\bin\ensrvmgr.exe

C:\Program Files\FolderSize\FolderSizeSvc.exe

C:\Program Files\EpsonNet\common\bin\emwchsrv.exe

C:\Program Files\Network Associates\VirusScan\Mcshield.exe

C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\EpsonNet\EpsonNet SOAP Server\bin\emsoaprr.exe

C:\Program Files\PostgreSQL4Tiny ERP Demo\bin\pg_ctl.exe

C:\Program Files\EpsonNet\EpsonNet Web Pages Service\bin\ewpsrr.exe

C:\Program Files\EpsonNet\common\bin\emalmmon.exe

C:\Program Files\EpsonNet\EpsonNet Information Center\bin\emntfsrv.exe

C:\Program Files\EpsonNet\EpsonNet HTTP Server\bin\apache.exe

C:\Program Files\Dell\OpenManage\Drac\client\RacAddrs.exe

C:\Program Files\Spyware Doctor\sdhelp.exe

C:\Program Files\PostgreSQL4Tiny ERP Demo\bin\postmaster.exe

C:\Program Files\EpsonNet\EpsonNet HTTP Server\bin\apache.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Rainbow Technologies\SPN Combo Installer\1.0.5\Server\WinNT\spnsrvnt.exe

C:\WINDOWS\System32\wdfmgr.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\Program Files\PostgreSQL4Tiny ERP Demo\bin\postgres.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\NWTRAY.EXE

C:\Program Files\Logitech\iTouch\iTouch.exe

C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE

C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe

C:\WINDOWS\wt\updater\wcmdmgr.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\GFI\FAXmaker Client\fmstart.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe

C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe

C:\Program Files\Microsoft Firewall Client\ISATRAY.EXE

C:\Corel\Graphics8\Programs\MFIndexer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\System32\msiexec.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Adobe\Acrobat 7.0\Distillr\acrotray.exe

C:\WINDOWS\System32\wbem\wmiapsrv.exe

C:\WINDOWS\System32\wbem\wmiprvse.exe

C:\WINDOWS\system32\NOTEPAD.EXE

J:\Utilitaire\HiJackThis\scanner.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/ch/des/gen/default.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/ch/des/gen/default.htm

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/ch/des/gen/default.htm

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.trendmicro-europe.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = serverisa:8080

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {14461717-708E-4A7F-AB45-D7A9083FD215} - C:\WINDOWS\system32\yuwaobbw.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: (no name) - {53F696C2-5343-A380-B8DC-C2A63785AE45} - (no file)

O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)

O2 - BHO: (no name) - {5F26E72A-7EE7-444D-8153-3EE05108CEC9} - C:\WINDOWS\system32\ddcyw.dll (file missing)

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: WebSpy Reports Browser Helper Object - {C68F45EB-A501-46AB-8165-BC042CD27136} - C:\PROGRA~1\FICHIE~1\WebSpy\WSREPO~1.DLL

O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE

O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe

O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"

O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [FMStart] "C:\Program Files\GFI\FAXmaker Client\fmstart.exe"

O4 - HKLM\..\Run: [soundService] rundll32.exe "C:\WINDOWS\system32\wjtsgugr.dll",setvm

O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe AcPro7_0_0 -reboot 1