lecteur-graveur DVD plus reconnu !

rolmic · le 30 octobre 2007

Et voici j'en suis sûr, un mal/spyware qui refait des siennes sur ma machine !

Mon lecteur-graveur DVD n'est plus reconnu et la machine est ralentie !

AVG AS n'a rien trouvé.

Spybot : RAS

AdAware : 2 Cookies de niveau moyen corrigés.

Help please !

Voici la log hiJack

Logfile of HijackThis v1.99.1

Scan saved at 18:33:47, on 30/10/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\svchost.exe

D:\Program Files\Windows Defender\MsMpEng.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\system32\spoolsv.exe

D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

D:\WINDOWS\Explorer.EXE

D:\Program Files\AOL\Active Virus Shield\avp.exe

D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

D:\WINDOWS\System32\NMSSvc.exe

D:\WINDOWS\system32\nvsvc32.exe

D:\WINDOWS\System32\svchost.exe

D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

D:\WINDOWS\SOUNDMAN.EXE

D:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe

D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

D:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe

D:\Program Files\Windows Defender\MSASCui.exe

D:\WINDOWS\system32\RUNDLL32.EXE

D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

D:\Program Files\AOL\Active Virus Shield\avp.exe

D:\Program Files\SPAMfighter\SFAgent.exe

D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

D:\WINDOWS\system32\ctfmon.exe

D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

D:\Program Files\Logitech\SetPoint\SetPoint.exe

D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

D:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE

D:\Documents and Settings\Rolland\Bureau\Scanner.exe

D:\Program Files\Internet Explorer\iexplore.exe

D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.meteofrance.com/FR/index.jsp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar4.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar4.dll

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [PinnacleDriverCheck] D:\WINDOWS\system32\PSDrvCheck.exe -CheckReg

O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [uSB2Check] RUNDLL32.EXE "D:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController

O4 - HKLM\..\Run: [uSBToolTip] "D:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe"

O4 - HKLM\..\Run: [pdfw] D:\Program Files\Amic Utilities\PDF Writer Pro\pdfwload.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [OpwareSE2] "D:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"

O4 - HKLM\..\Run: [Windows Defender] "D:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [aol] "D:\Program Files\AOL\Active Virus Shield\avp.exe"

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [sPAMfighter Agent] "D:\Program Files\SPAMfighter\SFAgent.exe" update delay 60

O4 - HKLM\..\Run: [Vade Retro Outlook Express] "D:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"

O4 - HKLM\..\Run: [unlockerAssistant] "D:\Program Files\Unlocker\UnlockerAssistant.exe"

O4 - HKLM\..\Run: [Google Desktop Search] "D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [LDM] D:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - Global Startup: Logitech SetPoint.lnk = D:\Program Files\Logitech\SetPoint\SetPoint.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - D:\WINDOWS\System32\Shdocvw.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O15 - Trusted Zone: http://www.arcabit.com

O16 - DPF: teleir_cert -

O16 - DPF: {01347765-1965-426B-91A4-AA6BB342B9A3} -

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} -

O16 - DPF: {104B0A37-AB99-4F06-8032-8BBDC3B77DDB} (Telechargement Control) - http://www8.photoweb.fr/telechargement/Photoweb_uploader.cab

O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab

O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://arcaonline.arcabit.com/ArcaOnline.cab

O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP...l_v1-0-3-18.cab

O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - http://www.nanoscan.com/as/v1/cabs/ascstubie.cab

O16 - DPF: {68C1822F-F5C7-4404-A73F-03C10E0E94DA} (telechargement-photoweb) - http://www4.photoweb.fr/telechargement/Photoweb_uploader.cab

O16 - DPF: {6DB731A3-B074-4118-8B1C-32511C65D836} (FotovistaPhotoUploader.ctrFpu) - http://www.mypixmania.com/fr/fr/tools/activex/fpu.cab

O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab

O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab

O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://karesuando.axiscam.net:81/activex/AMC.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab

O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} -

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} -

O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/...tiveXPlugin.cab

O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab

O16 - DPF: {C20EB175-0DD0-4979-A994-1F0DBA69F627} -

O16 - DPF: {CDD8BADE-B4C8-4E97-84B4-1DC9ABAD3EF3} -

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {D28C3640-A6D7-4668-A53C-07A9CF67D157} (CFnacComposantCtrl Object) - http://www.fnacmusic.com/telechargementFna...acComposant.cab

O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://livekuva.suomi.net/activex/AMC.cab

O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.fnacphoto.com/ectelechargement/...oad/XUpload.ocx

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O20 - AppInit_DLLs: D:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

O20 - Winlogon Notify: klogon - D:\WINDOWS\system32\klogon.dll

O20 - Winlogon Notify: WgaLogon - D:\WINDOWS\SYSTEM32\WgaLogon.dll

O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Active Virus Shield (AVP) - Unknown owner - D:\Program Files\AOL\Active Virus Shield\avp.exe" -r (file missing)

O23 - Service: GoogleDesktopManager - Google - D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - D:\WINDOWS\System32\NMSSvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - D:\PROGRA~1\FICHIE~1\SONYSH~1\AVLib\Sptisrv.exe

Gothic_Ted · le 30 octobre 2007

Salut,

quand tu dis qu'il est plus reconnu, tu veux dire qu'il y a un souci dans ton gestionnaire de périphérique ? point d'exclamation jaune ?

si c'est le cas:

- Supprimer les valeurs Upperfilters et Lowerfilters de la clé suivante de la base de registre :

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}

puis reboot et le probleme sera résolu.

Cordialement.

rolmic · le 31 octobre 2007

Salut,

quand je dis plus reconnnu, c'est que le raccourci sur le bureau affiche une icône de type Disque dur avec un point d'interrogation rouge.

Dans le gestionnaire de périph, il n'apparaît carrément pas !

Il apparaît au boot de la machine, dans le bios, comme d'hab.

J'ai fait ce que tu m'as dit, mais ça n'a rien changé.

Et j'ai passé Antivir en mode sans échec.

HELP ! Je ne peux plus graver et ma machine est d'une lenteur phénoménale !!

Voici le rapport Antivir et une nouvelle log Hijackthis en dessous :

AntiVir PersonalEdition Classic

Report file date: mercredi 31 octobre 2007 09:07

Scanning for 910788 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Username: Rolland

Computer name: POSTE-ROLLAND

Version information:

BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00

AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:30

AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:52

LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:48

LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:22

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:16

ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 14:26:56

ANTIVIR2.VDF : 7.0.0.140 940544 Bytes 26/10/2007 18:18:10

ANTIVIR3.VDF : 7.0.0.155 93696 Bytes 30/10/2007 18:18:10

AVEWIN32.DLL : 7.6.0.30 3056128 Bytes 30/10/2007 18:18:10

AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:28

AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:18

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24

AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 08:46:02

AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:08

AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:34

AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:20

NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:44

RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:14

RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:38

SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:22

Configuration settings for the scan:

Jobname..........................: Manual Selection

Configuration file...............: D:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\folder.avp

Logging..........................: low

Primary action...................: repair

Secondary action.................: delete

Scan master boot sector..........: off

Scan boot sector.................: on

Boot sectors.....................: D:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

Start of the scan: mercredi 31 octobre 2007 09:07

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'Explorer.EXE' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'guard.exe' - '1' Module(s) have been scanned

Scan process 'MsMpEng.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

13 processes with 13 modules were scanned

Start scanning boot sectors:

Boot sector 'D:\'

[NOTE] No virus was found!

Starting to scan the registry.

The registry was scanned ( '36' files ).

Starting the file scan:

Begin scan in 'D:\'

D:\pagefile.sys

[WARNING] The file could not be opened!

D:\Program Files\Panda Security\TotalScan\pskavs.dll

[DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738

[iNFO] A backup was created as '47934098.qua' ( QUARANTINE )

[iNFO] The file was deleted!

D:\Program Files\Panda Security\NanoScan\Engine\psnflg.dll

[DETECTION] Is the Trojan horse TR/Agent.bux.1

[iNFO] A backup was created as '4796409b.qua' ( QUARANTINE )

[iNFO] The file was deleted!

D:\Documents and Settings\Rolland\Mes documents\_ROLLAND TRAVAIL\Prep CE2\Sciences-Techno\onemanquepad'r\cerf volant\Plan commenté d'un cerf-volant d'initiation pour jeunes enfants.mht

[0] Archive type: MIME

--> http://membres.lycos.fr/constrcv/initcv.html

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] A backup was created as '47894c74.qua' ( QUARANTINE )

[iNFO] The file was deleted!

D:\System Volume Information\_restore{045A144F-313A-4026-AEF2-1BADCC371DBE}\RP353\A0050805.dll

[DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738

[iNFO] A backup was created as '475854fa.qua' ( QUARANTINE )

[iNFO] The file was deleted!

D:\System Volume Information\_restore{045A144F-313A-4026-AEF2-1BADCC371DBE}\RP353\A0050806.dll

[DETECTION] Is the Trojan horse TR/Agent.bux.1

[iNFO] A backup was created as '475854fb.qua' ( QUARANTINE )

[iNFO] The file was deleted!

End of the scan: mercredi 31 octobre 2007 11:11

Used time: 2:03:43 min

The scan has been done completely.

12149 Scanning directories

491296 Files were scanned

5 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

5 files were deleted

0 files were repaired

5 files were moved to quarantine

0 files were renamed

1 Files cannot be scanned

491291 Files not concerned

8163 Archives were scanned

1 Warnings

14 Notes

LOG HIJACKTHIS :

Logfile of HijackThis v1.99.1

Scan saved at 12:09:11, on 31/10/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\svchost.exe

D:\Program Files\Windows Defender\MsMpEng.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\system32\spoolsv.exe

D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

D:\Program Files\AOL\Active Virus Shield\avp.exe

D:\WINDOWS\System32\imapi.exe

D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

D:\WINDOWS\System32\NMSSvc.exe

D:\WINDOWS\system32\nvsvc32.exe

D:\WINDOWS\Explorer.EXE

D:\WINDOWS\System32\svchost.exe

D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

D:\WINDOWS\SOUNDMAN.EXE

D:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe

D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

D:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe

D:\Program Files\Windows Defender\MSASCui.exe

D:\WINDOWS\system32\RUNDLL32.EXE

D:\Program Files\AOL\Active Virus Shield\avp.exe

D:\Program Files\SPAMfighter\SFAgent.exe

D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

D:\WINDOWS\system32\ctfmon.exe

D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

D:\Program Files\Logitech\SetPoint\SetPoint.exe

D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

D:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE

D:\Program Files\Internet Explorer\iexplore.exe

D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe

D:\WINDOWS\system32\notepad.exe