Votre question

Cheval de troie : Trojan-Proxy.Win32.Agent.id

Tags :
  • Trojan
  • Sécurité
Dernière réponse : dans Sécurité et virus
27 Janvier 2006 21:21:09

Bonjour à tous!
J'aurais besoin de votre aide please pour enlever des chevaux de troie :-( j'ai constamment des fenetres de pub qui me dérangent à cause de ça...

Voici mon rapport de scan sur Kaspersky

Total d'objets analysés : 25112
Nombre de virus trouvés 3
Nombre d'objets infectés 5
Nombre d'objets suspects 0
Durée de l'analyse 00:18:12

Nom de l'objet infecté Nom du virus Dernière action
C:\DM.0XE Infecté: Trojan-Proxy.Win32.Agent.id ignoré
C:\System Volume Information\_restore{25C01656-E941-49F6-88AA-570636AEEE04}\RP8\A0000869.exe/data0002/data0006 Infecté: Trojan-Dropper.Win32.VB.kk ignoré
C:\System Volume Information\_restore{25C01656-E941-49F6-88AA-570636AEEE04}\RP8\A0000869.exe/data0002 Infecté: Trojan-Dropper.Win32.VB.kk ignoré
C:\System Volume Information\_restore{25C01656-E941-49F6-88AA-570636AEEE04}\RP8\A0000869.exe NSIS: infecté - 2 ignoré
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\638T6BYL\!update-3120[1].0000 Infecté: Trojan-Downloader.Win32.PurityScan.be ignoré
Analyse terminée.

Merci d'avance :-)

Autres pages sur : cheval troie trojan proxy win32 agent

27 Janvier 2006 21:44:08

Voici le hijack

Logfile of HijackThis v1.99.1
Scan saved at 21:41:18, on 27/01/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program Files\Network Monitor\netmon.exe
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ULi5287\ULi5287.exe
C:\Program Files\Network\network.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\Program Files\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\Program Files\F-Secure Internet Security\FSGUI\ispnews.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Winamp\winampa.exe
D:\Programme\QuickTime\qttask.exe
D:\Programme\MSN plus\MsgPlus.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Lulu\Bureau\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.exactsearch.net/sidesearch
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.ad-w-a-r-e.com/cgi-bin/PopupV3?ID={C32C1165-92B2-FE22-A12F-832CB9C98103}&type=normal&mSkip=1&rnd=17408
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ULiRaid] C:\Program Files\ULi5287\ULi5287.exe
O4 - HKLM\..\Run: [Application Layer Gateway Service] C:\WINDOWS\System32\algs.exe
O4 - HKLM\..\Run: [taskbar.exe] C:\dm.exe
O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd2.exe
O4 - HKLM\..\Run: [Windowsz] rwnt.exe
O4 - HKLM\..\Run: [winsysban] C:\windows\winsysban2.exe
O4 - HKLM\..\Run: [myupdates] c:\windows\myupdates.exe
O4 - HKLM\..\Run: [Microsoft Internet Explorer] C:\WINDOWS\System32\iexplore.exe
O4 - HKLM\..\Run: [Network] C:\Program Files\Network\network.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Program Files\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\F-Secure Internet Security\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "D:\Programme\MSN plus\MsgPlus.exe"
O4 - HKLM\..\RunServices: [Windowsz] rwnt.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MessengerPlus3] "D:\Programme\MSN plus\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Documents and Settings\Lulu\Bureau\HijackThis.exe /startupscan
O4 - Startup: PPControl.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: F-Secure 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Filtre Web - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Filtre Web - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
O10 - Broken Internet access because of LSP provider 'winsflt.dll' missing
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Controls Folder - C:\WINDOWS\system32\en88l1lu1.dll
O20 - Winlogon Notify: SideBySide - C:\WINDOWS\system32\s0pu0a79ed.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: F-Secure 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSPC\fshttps\fshttps.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe

Je ne sais vraiment pas comment enlever ces chevaux de troie... :-?
27 Janvier 2006 22:30:53

Bonsoir

Plusieurs infections. On commence.

Télécharge L2mfix (de Shadowwar) de l'un de ces liens :
http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Sauvegarde-le sur ton Bureau et double-clique l2mfix.exe. Clique sur le bouton Install pour en extraire le contenu et suis les directives, puis ouvre le nouveau dossier "l2mfix" qui se trouve sur le Bureau. Double-clique l2mfix.bat et choisis l'option #1 pour Run Find Log en tapant 1 et ensuite Entrée. Le scan débutera sans générer d'indications, puis, après une minute ou deux, un fichier texte apparaîtra. Copie/colle le contenu de ce rapport ("report.txt") dans ta prochaine réponse.

Par contre, si une erreur s'affiche en lançant l'option #1, similaire à ceci : ''C:\windows\system32\cmd.exe
C:\windows\system32\autoexec.nt the system file is not suitable for running ms-dos and microsoft windows applications. Choose close to terminate the application.."...alors utilise l'option #5 ou le lien web fourni dans le dossier "l2mfix" afin de résoudre cette erreur. Ne pas lancer d'autres options avant d'avoir réglé ce pépin.


Ensuite.


Ferme toutes les applications en cours, car cette étape nécessite un redémarrage.

Du dossier l2mfix situé sur ton Bureau, double-clique l2mfix.bat et choisis l'option #2 pour Run Fix en tapant 2 et ensuite "Entrée". Les icônes du Bureau vont disparaître (tout à fait normal). L2mfix poursuivra le scan et lorsque terminé, il sera prêt à redémarrer le PC. Appuie sur n'importe quelle touche pour redémarrer. Après le redémarrage, un fichier texte devrait apparaître. Copie/colle le contenu de ce rapport dans ta prochaine réponse, et poste un nouveau rapport HijackThis! également.

MPORTANT: NE PAS lancer d'autres fichiers situés dans le dossier "l2mfix" sans l'avis d'un conseiller ! Ne pas lancer cet outil en mode Sans Échec !!
**Si le fichier texte (rapport) n'apparaît pas au redémarrage, double-clique sur le fichier texte ("log.txt") situé dans le dossier "l2mfix".
Contenus similaires
27 Janvier 2006 22:42:13

voila la 1ere étape :) 
c super long le rapport :s
L2MFIX find log 010406
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Controls Folder]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\en88l1lu1.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SideBySide]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\s0pu0a79ed.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{C32C1165-92B2-FE22-A12F-832CB9C98103}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"
"{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Extension de la page de propri‚t‚s de mise … jour automatique"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Dossiers Web"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{DA951395-51C9-4981-93A0-40FBF73A2E4C}"=""
"{E9E1CF59-B58A-4FF8-A2EC-286131E0DE7A}"=""
"{AE298A12-80CE-4A4F-8548-5C7252FFA657}"=""
"{881541C1-2865-4CE7-B79A-5F45DD86F4C8}"=""
"{8A798553-3C69-413D-8672-4E772CEBD91D}"=""
"{9B5400F6-D062-4B51-8BB2-DD67A20D1A7E}"=""
"{0BF0703C-2E52-4B70-B2E8-23768F0EE517}"=""
"{9F8DB9D7-790F-499A-86B0-1E41683898E5}"=""
"{88450D96-931B-4134-8D44-B4E8FBE2D94D}"=""
"{950FF917-7A57-46BC-8017-59D9BF474000}"="Shell Extension for CDRW"
"{B327765E-D724-4347-8B16-78AE18552FC3}"="NeroDigitalIconHandler"
"{7F1CF152-04F8-453A-B34C-E609530A9DC8}"="NeroDigitalPropSheetHandler"
"{F9B0ED31-452E-425E-948C-E3F0A2205BA0}"=""
"{400CFEE2-39D0-46DC-96DF-E0BB5A4324B3}"="My Logitech Pictures"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{A5110426-177D-4e08-AB3F-785F10B4439C}"="Sony Ericsson Gestionnaire de fichiers"

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{DA951395-51C9-4981-93A0-40FBF73A2E4C}]
@=""
"IDEx"="ADDR"

[HKEY_CLASSES_ROOT\CLSID\{DA951395-51C9-4981-93A0-40FBF73A2E4C}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DA951395-51C9-4981-93A0-40FBF73A2E4C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DA951395-51C9-4981-93A0-40FBF73A2E4C}\InprocServer32]
@="C:\\WINDOWS\\system32\\EgnClass.Dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{E9E1CF59-B58A-4FF8-A2EC-286131E0DE7A}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E9E1CF59-B58A-4FF8-A2EC-286131E0DE7A}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E9E1CF59-B58A-4FF8-A2EC-286131E0DE7A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E9E1CF59-B58A-4FF8-A2EC-286131E0DE7A}\InprocServer32]
@="C:\\WINDOWS\\system32\\mjvcrt40.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{AE298A12-80CE-4A4F-8548-5C7252FFA657}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AE298A12-80CE-4A4F-8548-5C7252FFA657}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AE298A12-80CE-4A4F-8548-5C7252FFA657}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AE298A12-80CE-4A4F-8548-5C7252FFA657}\InprocServer32]
@="C:\\WINDOWS\\system32\\ooeacc.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{881541C1-2865-4CE7-B79A-5F45DD86F4C8}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{881541C1-2865-4CE7-B79A-5F45DD86F4C8}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{881541C1-2865-4CE7-B79A-5F45DD86F4C8}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{881541C1-2865-4CE7-B79A-5F45DD86F4C8}\InprocServer32]
@="C:\\WINDOWS\\system32\\deutil.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{8A798553-3C69-413D-8672-4E772CEBD91D}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8A798553-3C69-413D-8672-4E772CEBD91D}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8A798553-3C69-413D-8672-4E772CEBD91D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8A798553-3C69-413D-8672-4E772CEBD91D}\InprocServer32]
@="C:\\WINDOWS\\system32\\onbccp32.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{9B5400F6-D062-4B51-8BB2-DD67A20D1A7E}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9B5400F6-D062-4B51-8BB2-DD67A20D1A7E}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9B5400F6-D062-4B51-8BB2-DD67A20D1A7E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9B5400F6-D062-4B51-8BB2-DD67A20D1A7E}\InprocServer32]
@="C:\\WINDOWS\\system32\\ndevent.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{0BF0703C-2E52-4B70-B2E8-23768F0EE517}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0BF0703C-2E52-4B70-B2E8-23768F0EE517}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0BF0703C-2E52-4B70-B2E8-23768F0EE517}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0BF0703C-2E52-4B70-B2E8-23768F0EE517}\InprocServer32]
@="C:\\WINDOWS\\system32\\omcache.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{9F8DB9D7-790F-499A-86B0-1E41683898E5}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9F8DB9D7-790F-499A-86B0-1E41683898E5}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9F8DB9D7-790F-499A-86B0-1E41683898E5}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9F8DB9D7-790F-499A-86B0-1E41683898E5}\InprocServer32]
@="C:\\WINDOWS\\system32\\mvgsvc.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{88450D96-931B-4134-8D44-B4E8FBE2D94D}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{88450D96-931B-4134-8D44-B4E8FBE2D94D}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{88450D96-931B-4134-8D44-B4E8FBE2D94D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{88450D96-931B-4134-8D44-B4E8FBE2D94D}\InprocServer32]
@="C:\\WINDOWS\\system32\\mvwebdvd.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F9B0ED31-452E-425E-948C-E3F0A2205BA0}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F9B0ED31-452E-425E-948C-E3F0A2205BA0}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F9B0ED31-452E-425E-948C-E3F0A2205BA0}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F9B0ED31-452E-425E-948C-E3F0A2205BA0}\InprocServer32]
@="C:\\WINDOWS\\system32\\krdest.dll"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
atmtd.dll Wed 25 Jan 2006 13:31:00 A.... 687 592 671,48 K
cbl3dv2.dll Thu 26 Jan 2006 11:46:40 ..S.R 237 195 231,63 K
cfgmig32.dll Tue 8 Nov 2005 5:46:40 A.... 1 236 992 1,18 M
deutil.dll Wed 25 Jan 2006 14:07:32 ..S.R 235 734 230,21 K
en88l1~1.dll Thu 26 Jan 2006 23:08:30 ..S.R 233 414 227,94 K
f82mli~1.dll Thu 26 Jan 2006 21:30:04 ..S.R 234 542 229,04 K
gqmf32.dll Wed 25 Jan 2006 16:26:54 ..S.R 236 637 231,09 K
krdest.dll Fri 27 Jan 2006 14:56:14 ..S.R 233 414 227,94 K
l4n4le~1.dll Wed 25 Jan 2006 15:48:00 ..S.R 236 220 230,68 K
m046la~1.dll Wed 25 Jan 2006 16:01:12 ..S.R 236 637 231,09 K
mjvcrt40.dll Wed 25 Jan 2006 13:40:26 ..S.R 235 734 230,21 K
mvgsvc.dll Wed 25 Jan 2006 15:30:40 ..S.R 236 637 231,09 K
mvwebdvd.dll Wed 25 Jan 2006 15:37:00 ..S.R 236 220 230,68 K
ndevent.dll Wed 25 Jan 2006 14:33:30 ..S.R 235 734 230,21 K
omcache.dll Wed 25 Jan 2006 14:39:02 ..S.R 234 855 229,35 K
onbccp32.dll Wed 25 Jan 2006 14:21:56 ..S.R 234 180 228,69 K
ooeacc.dll Wed 25 Jan 2006 13:58:16 ..S.R 235 740 230,21 K
p44ule~1.dll Fri 27 Jan 2006 10:22:40 ..S.R 234 858 229,35 K
p4p6le~1.dll Thu 26 Jan 2006 21:08:06 ..S.R 237 195 231,63 K
px.dll Mon 5 Dec 2005 6:12:26 ..... 339 968 332,00 K
pxdrv.dll Mon 5 Dec 2005 6:12:26 ..... 405 504 396,00 K
pxmas.dll Mon 5 Dec 2005 6:12:26 ..... 172 032 168,00 K
pxwave.dll Mon 5 Dec 2005 6:12:26 ..... 339 968 332,00 K
ssjrvfka.dll Tue 17 Jan 2006 17:08:40 A.... 139 264 136,00 K
vxblock.dll Mon 5 Dec 2005 6:12:26 ..... 28 672 28,00 K
winsflt.dll Wed 25 Jan 2006 14:44:42 A.... 1 187 840 1,13 M
winsflte.dll Tue 8 Nov 2005 5:47:04 A.... 1 716 224 1,64 M

27 items found: 27 files (17 H/S), 0 directories.
Total of file sizes: 10 259 002 bytes 9,78 M
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 1C8E-8C62

R‚pertoire de C:\WINDOWS\System32

27/01/2006 14:56 233ÿ414 krdest.dll
27/01/2006 10:22 234ÿ858 p44uleh91h4.dll
26/01/2006 23:08 233ÿ414 en88l1lu1.dll
26/01/2006 21:30 234ÿ542 f82mlif1182.dll
26/01/2006 21:08 237ÿ195 p4p6le7s1h.dll
26/01/2006 11:46 237ÿ195 cbl3dv2.dll
25/01/2006 17:23 <REP> dllcache
25/01/2006 16:26 236ÿ637 gqmf32.dll
25/01/2006 16:01 236ÿ637 m046lahs1d46.dll
25/01/2006 15:47 236ÿ220 l4n4le5q1h.dll
25/01/2006 15:36 236ÿ220 mvwebdvd.dll
25/01/2006 15:30 236ÿ637 mvgsvc.dll
25/01/2006 14:39 234ÿ855 omcache.dll
25/01/2006 14:33 235ÿ734 ndevent.dll
25/01/2006 14:21 234ÿ180 onbccp32.dll
25/01/2006 14:07 235ÿ734 deutil.dll
25/01/2006 13:58 235ÿ740 ooeacc.dll
25/01/2006 13:40 235ÿ734 mjvcrt40.dll
25/01/2006 13:31 <REP> Microsoft
17/01/2006 17:09 405ÿ504 n?tdde.exe
18 fichier(s) 4ÿ410ÿ450 octets
2 R‚p(s) 6ÿ033ÿ178ÿ624 octets libres

bon je continue la 2ème étape ^^
merci pour ton aide !

27 Janvier 2006 22:54:50

De retour !

L2mfix 010406
Creating Account.
La commande s'est termin‚e correctement.

Adding Administrative privleges.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful

Running From:
C:\WINDOWS\system32

Killing Processes!

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 580 'smss.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 660 'winlogon.exe'
Killing PID 660 'winlogon.exe'
Killing PID 660 'winlogon.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1260 'explorer.exe'
Killing PID 1260 'explorer.exe'
Killing PID 1260 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1584 'rundll32.exe'
Killing PID 1584 'rundll32.exe'
Killing PID 1584 'rundll32.exe'
Killing PID 1584 'rundll32.exe'
Killing PID 1584 'rundll32.exe'
Killing PID 1584 'rundll32.exe'
Killing PID 1584 'rundll32.exe'
Killing PID 1584 'rundll32.exe'
Killing PID 1584 'rundll32.exe'
Killing PID 1584 'rundll32.exe'
Killing PID 1584 'rundll32.exe'
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrateurs ... successful

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
Deleting: C:\WINDOWS\system32\cbl3dv2.dll
Successfully Deleted: C:\WINDOWS\system32\cbl3dv2.dll
Deleting: C:\WINDOWS\system32\deutil.dll
Successfully Deleted: C:\WINDOWS\system32\deutil.dll
Deleting: C:\WINDOWS\system32\en88l1lu1.dll
Successfully Deleted: C:\WINDOWS\system32\en88l1lu1.dll
Deleting: C:\WINDOWS\system32\f82mlif1182.dll
Successfully Deleted: C:\WINDOWS\system32\f82mlif1182.dll
Deleting: C:\WINDOWS\system32\gqmf32.dll
Successfully Deleted: C:\WINDOWS\system32\gqmf32.dll
Deleting: C:\WINDOWS\system32\krdest.dll
Successfully Deleted: C:\WINDOWS\system32\krdest.dll
Deleting: C:\WINDOWS\system32\l4n4le5q1h.dll
Successfully Deleted: C:\WINDOWS\system32\l4n4le5q1h.dll
Deleting: C:\WINDOWS\system32\m046lahs1d46.dll
Successfully Deleted: C:\WINDOWS\system32\m046lahs1d46.dll
Deleting: C:\WINDOWS\system32\mjvcrt40.dll
Successfully Deleted: C:\WINDOWS\system32\mjvcrt40.dll
Deleting: C:\WINDOWS\system32\mvgsvc.dll
Successfully Deleted: C:\WINDOWS\system32\mvgsvc.dll
Deleting: C:\WINDOWS\system32\mvwebdvd.dll
Successfully Deleted: C:\WINDOWS\system32\mvwebdvd.dll
Deleting: C:\WINDOWS\system32\ndevent.dll
Successfully Deleted: C:\WINDOWS\system32\ndevent.dll
Deleting: C:\WINDOWS\system32\omcache.dll
Successfully Deleted: C:\WINDOWS\system32\omcache.dll
Deleting: C:\WINDOWS\system32\onbccp32.dll
Successfully Deleted: C:\WINDOWS\system32\onbccp32.dll
Deleting: C:\WINDOWS\system32\ooeacc.dll
Successfully Deleted: C:\WINDOWS\system32\ooeacc.dll
Deleting: C:\WINDOWS\system32\p44uleh91h4.dll
Successfully Deleted: C:\WINDOWS\system32\p44uleh91h4.dll
Deleting: C:\WINDOWS\system32\p4p6le7s1h.dll
Successfully Deleted: C:\WINDOWS\system32\p4p6le7s1h.dll

msg11?.dll
0 fichier(s) copi‚(s).



Restoring Windows Update Certificates.:

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Controls Folder]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\en88l1lu1.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SideBySide]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\s0pu0a79ed.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\cbl3dv2.dll
C:\WINDOWS\system32\deutil.dll
C:\WINDOWS\system32\en88l1lu1.dll
C:\WINDOWS\system32\f82mlif1182.dll
C:\WINDOWS\system32\gqmf32.dll
C:\WINDOWS\system32\krdest.dll
C:\WINDOWS\system32\l4n4le5q1h.dll
C:\WINDOWS\system32\m046lahs1d46.dll
C:\WINDOWS\system32\mjvcrt40.dll
C:\WINDOWS\system32\mvgsvc.dll
C:\WINDOWS\system32\mvwebdvd.dll
C:\WINDOWS\system32\ndevent.dll
C:\WINDOWS\system32\omcache.dll
C:\WINDOWS\system32\onbccp32.dll
C:\WINDOWS\system32\ooeacc.dll
C:\WINDOWS\system32\p44uleh91h4.dll
C:\WINDOWS\system32\p4p6le7s1h.dll

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{DA951395-51C9-4981-93A0-40FBF73A2E4C}]
@=""
"IDEx"="ADDR"

[HKEY_CLASSES_ROOT\CLSID\{DA951395-51C9-4981-93A0-40FBF73A2E4C}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DA951395-51C9-4981-93A0-40FBF73A2E4C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DA951395-51C9-4981-93A0-40FBF73A2E4C}\InprocServer32]
@="C:\\WINDOWS\\system32\\EgnClass.Dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{E9E1CF59-B58A-4FF8-A2EC-286131E0DE7A}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E9E1CF59-B58A-4FF8-A2EC-286131E0DE7A}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E9E1CF59-B58A-4FF8-A2EC-286131E0DE7A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E9E1CF59-B58A-4FF8-A2EC-286131E0DE7A}\InprocServer32]
@="C:\\WINDOWS\\system32\\mjvcrt40.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{AE298A12-80CE-4A4F-8548-5C7252FFA657}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AE298A12-80CE-4A4F-8548-5C7252FFA657}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AE298A12-80CE-4A4F-8548-5C7252FFA657}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AE298A12-80CE-4A4F-8548-5C7252FFA657}\InprocServer32]
@="C:\\WINDOWS\\system32\\ooeacc.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{881541C1-2865-4CE7-B79A-5F45DD86F4C8}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{881541C1-2865-4CE7-B79A-5F45DD86F4C8}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{881541C1-2865-4CE7-B79A-5F45DD86F4C8}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{881541C1-2865-4CE7-B79A-5F45DD86F4C8}\InprocServer32]
@="C:\\WINDOWS\\system32\\deutil.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{8A798553-3C69-413D-8672-4E772CEBD91D}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8A798553-3C69-413D-8672-4E772CEBD91D}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8A798553-3C69-413D-8672-4E772CEBD91D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8A798553-3C69-413D-8672-4E772CEBD91D}\InprocServer32]
@="C:\\WINDOWS\\system32\\onbccp32.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{9B5400F6-D062-4B51-8BB2-DD67A20D1A7E}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9B5400F6-D062-4B51-8BB2-DD67A20D1A7E}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9B5400F6-D062-4B51-8BB2-DD67A20D1A7E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9B5400F6-D062-4B51-8BB2-DD67A20D1A7E}\InprocServer32]
@="C:\\WINDOWS\\system32\\ndevent.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{0BF0703C-2E52-4B70-B2E8-23768F0EE517}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0BF0703C-2E52-4B70-B2E8-23768F0EE517}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0BF0703C-2E52-4B70-B2E8-23768F0EE517}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0BF0703C-2E52-4B70-B2E8-23768F0EE517}\InprocServer32]
@="C:\\WINDOWS\\system32\\omcache.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{9F8DB9D7-790F-499A-86B0-1E41683898E5}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9F8DB9D7-790F-499A-86B0-1E41683898E5}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9F8DB9D7-790F-499A-86B0-1E41683898E5}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9F8DB9D7-790F-499A-86B0-1E41683898E5}\InprocServer32]
@="C:\\WINDOWS\\system32\\mvgsvc.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{88450D96-931B-4134-8D44-B4E8FBE2D94D}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{88450D96-931B-4134-8D44-B4E8FBE2D94D}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{88450D96-931B-4134-8D44-B4E8FBE2D94D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{88450D96-931B-4134-8D44-B4E8FBE2D94D}\InprocServer32]
@="C:\\WINDOWS\\system32\\mvwebdvd.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F9B0ED31-452E-425E-948C-E3F0A2205BA0}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F9B0ED31-452E-425E-948C-E3F0A2205BA0}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F9B0ED31-452E-425E-948C-E3F0A2205BA0}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F9B0ED31-452E-425E-948C-E3F0A2205BA0}\InprocServer32]
@="C:\\WINDOWS\\system32\\krdest.dll"
"ThreadingModel"="Apartment"

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{DA951395-51C9-4981-93A0-40FBF73A2E4C}"=-
"{E9E1CF59-B58A-4FF8-A2EC-286131E0DE7A}"=-
"{AE298A12-80CE-4A4F-8548-5C7252FFA657}"=-
"{881541C1-2865-4CE7-B79A-5F45DD86F4C8}"=-
"{8A798553-3C69-413D-8672-4E772CEBD91D}"=-
"{9B5400F6-D062-4B51-8BB2-DD67A20D1A7E}"=-
"{0BF0703C-2E52-4B70-B2E8-23768F0EE517}"=-
"{9F8DB9D7-790F-499A-86B0-1E41683898E5}"=-
"{88450D96-931B-4134-8D44-B4E8FBE2D94D}"=-
"{F9B0ED31-452E-425E-948C-E3F0A2205BA0}"=-
[-HKEY_CLASSES_ROOT\CLSID\{DA951395-51C9-4981-93A0-40FBF73A2E4C}]
[-HKEY_CLASSES_ROOT\CLSID\{E9E1CF59-B58A-4FF8-A2EC-286131E0DE7A}]
[-HKEY_CLASSES_ROOT\CLSID\{AE298A12-80CE-4A4F-8548-5C7252FFA657}]
[-HKEY_CLASSES_ROOT\CLSID\{881541C1-2865-4CE7-B79A-5F45DD86F4C8}]
[-HKEY_CLASSES_ROOT\CLSID\{8A798553-3C69-413D-8672-4E772CEBD91D}]
[-HKEY_CLASSES_ROOT\CLSID\{9B5400F6-D062-4B51-8BB2-DD67A20D1A7E}]
[-HKEY_CLASSES_ROOT\CLSID\{0BF0703C-2E52-4B70-B2E8-23768F0EE517}]
[-HKEY_CLASSES_ROOT\CLSID\{9F8DB9D7-790F-499A-86B0-1E41683898E5}]
[-HKEY_CLASSES_ROOT\CLSID\{88450D96-931B-4134-8D44-B4E8FBE2D94D}]
[-HKEY_CLASSES_ROOT\CLSID\{F9B0ED31-452E-425E-948C-E3F0A2205BA0}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
****************************************************************************
Desktop.ini Contents:
****************************************************************************

****************************************************************************
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
adding: dlls/cbl3dv2.dll (164 bytes security) (deflated 6%)
adding: dlls/deutil.dll (164 bytes security) (deflated 5%)
adding: dlls/en88l1lu1.dll (164 bytes security) (deflated 4%)
adding: dlls/f82mlif1182.dll (164 bytes security) (deflated 5%)
adding: dlls/gqmf32.dll (164 bytes security) (deflated 5%)
adding: dlls/krdest.dll (164 bytes security) (deflated 4%)
adding: dlls/l4n4le5q1h.dll (164 bytes security) (deflated 5%)
adding: dlls/m046lahs1d46.dll (164 bytes security) (deflated 5%)
adding: dlls/mjvcrt40.dll (164 bytes security) (deflated 5%)
adding: dlls/mvgsvc.dll (164 bytes security) (deflated 5%)
adding: dlls/mvwebdvd.dll (164 bytes security) (deflated 5%)
adding: dlls/ndevent.dll (164 bytes security) (deflated 5%)
adding: dlls/omcache.dll (164 bytes security) (deflated 5%)
adding: dlls/onbccp32.dll (164 bytes security) (deflated 4%)
adding: dlls/ooeacc.dll (164 bytes security) (deflated 5%)
adding: dlls/p44uleh91h4.dll (164 bytes security) (deflated 5%)
adding: dlls/p4p6le7s1h.dll (164 bytes security) (deflated 6%)
adding: backregs/0BF0703C-2E52-4B70-B2E8-23768F0EE517.reg (212 bytes security) (deflated 70%)
adding: backregs/881541C1-2865-4CE7-B79A-5F45DD86F4C8.reg (212 bytes security) (deflated 70%)
adding: backregs/88450D96-931B-4134-8D44-B4E8FBE2D94D.reg (212 bytes security) (deflated 70%)
adding: backregs/8A798553-3C69-413D-8672-4E772CEBD91D.reg (212 bytes security) (deflated 70%)
adding: backregs/9B5400F6-D062-4B51-8BB2-DD67A20D1A7E.reg (212 bytes security) (deflated 70%)
adding: backregs/9F8DB9D7-790F-499A-86B0-1E41683898E5.reg (212 bytes security) (deflated 70%)
adding: backregs/AE298A12-80CE-4A4F-8548-5C7252FFA657.reg (212 bytes security) (deflated 70%)
adding: backregs/DA951395-51C9-4981-93A0-40FBF73A2E4C.reg (212 bytes security) (deflated 69%)
adding: backregs/E9E1CF59-B58A-4FF8-A2EC-286131E0DE7A.reg (212 bytes security) (deflated 70%)
adding: backregs/F9B0ED31-452E-425E-948C-E3F0A2205BA0.reg (212 bytes security) (deflated 70%)
adding: backregs/notibac.reg (164 bytes security) (deflated 88%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)

et voici le nouveau rapport HijackThis:

Logfile of HijackThis v1.99.1
Scan saved at 22:51:08, on 27/01/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\notepad.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ULi5287\ULi5287.exe
C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
C:\Program Files\Network\network.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program Files\Network Monitor\netmon.exe
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE
C:\Program Files\F-Secure Internet Security\FSGUI\ispnews.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
D:\Programme\QuickTime\qttask.exe
D:\Programme\MSN plus\MsgPlus.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exe
C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Documents and Settings\Lulu\Bureau\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.exactsearch.net/sidesearch
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.ad-w-a-r-e.com/cgi-bin/PopupV3?ID={C32C1165-92B2-FE22-A12F-832CB9C98103}&type=normal&mSkip=1&rnd=17408
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ULiRaid] C:\Program Files\ULi5287\ULi5287.exe
O4 - HKLM\..\Run: [Application Layer Gateway Service] C:\WINDOWS\System32\algs.exe
O4 - HKLM\..\Run: [taskbar.exe] C:\dm.exe
O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd2.exe
O4 - HKLM\..\Run: [Windowsz] rwnt.exe
O4 - HKLM\..\Run: [winsysban] C:\windows\winsysban2.exe
O4 - HKLM\..\Run: [myupdates] c:\windows\myupdates.exe
O4 - HKLM\..\Run: [Microsoft Internet Explorer] C:\WINDOWS\System32\iexplore.exe
O4 - HKLM\..\Run: [Network] C:\Program Files\Network\network.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Program Files\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\F-Secure Internet Security\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "D:\Programme\MSN plus\MsgPlus.exe"
O4 - HKLM\..\RunServices: [Windowsz] rwnt.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MessengerPlus3] "D:\Programme\MSN plus\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Documents and Settings\Lulu\Bureau\HijackThis.exe /startupscan
O4 - Startup: PPControl.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: F-Secure 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Filtre Web - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Filtre Web - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
O10 - Broken Internet access because of LSP provider 'winsflt.dll' missing
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Controls Folder - C:\WINDOWS\system32\en88l1lu1.dll (file missing)
O20 - Winlogon Notify: SideBySide - C:\WINDOWS\system32\s0pu0a79ed.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: F-Secure 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSPC\fshttps\fshttps.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe

Que dois-je faire ensuite? ils sont partis les saletés?


:oops: 
27 Janvier 2006 23:04:12

Re

Il en reste.

* Télécharge LSPfix
http://www.cexx.org/LSPFix.exe
Installes le sur le Bureau

* Lances LSPfix et agrandis la fenêtre qui, par défaut, est trop petite et fait apparaître les ascenseurs horizontaux et verticaux, masquant un bouton.
Déconnecte toi d'Internet et ferme toutes les instances (fenêtres) Internet Explorer.
Coche la case "I know what I'm doing" ("Je sais ce que je fais").
Sélectionne toutes les instances des dll suivantes

winsflt.dll

et fais les glisser du panneau de gauche, appelé "keep" au panneau de droite, appelé "Remove".
Clique sur le bouton "Finish".

* Redémarre le PC.

* Télécharge Ewido
http://www.ewido.net/fr/download/
Tu l'installes et tu le mets à jour.
Pendant l'installation, sur la page "Additional Options" décoche les deux options "Install background guard" et "Install scan via context menu".

Fais un scan et poste son rapport avec un nouveau rapport HijackThis.
27 Janvier 2006 23:38:39

Dans LSP-Fix, le fichier winsflt.dll était déjà dans le panneau Remove, je n'avais plus qu'à appuyer sur Finish. il en est sorti un Repair Summary
Repairs complete
0 nameSpace provider entries removed
0 nameSpace provider entries renumbered
6 Protocol provider entries removed
13 Protocol provider entries renumbered

voila le rapport d'Ewido
---------------------------------------------------------
ewido anti-malware - Rapport de scan
---------------------------------------------------------

+ Créé le: 23:33:49, 27/01/2006
+ Somme de contrôle: D08482D1

+ Résultats du scan:

[152] C:\Program Files\Network Monitor\netmon.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Ignoré
C:\DM.0XE -> Proxy.Agent.id : Nettoyer et sauvegarder
:mozilla.32:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Doubleclick : Nettoyer et sauvegarder
:mozilla.34:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Smartadserver : Nettoyer et sauvegarder
:mozilla.35:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Smartadserver : Nettoyer et sauvegarder
:mozilla.36:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Smartadserver : Nettoyer et sauvegarder
:mozilla.48:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Nettoyer et sauvegarder
:mozilla.49:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Nettoyer et sauvegarder
:mozilla.50:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Nettoyer et sauvegarder
:mozilla.51:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Nettoyer et sauvegarder
:mozilla.52:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Nettoyer et sauvegarder
:mozilla.53:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Nettoyer et sauvegarder
:mozilla.54:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Nettoyer et sauvegarder
:mozilla.55:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Nettoyer et sauvegarder
:mozilla.56:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Nettoyer et sauvegarder
:mozilla.57:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Nettoyer et sauvegarder
:mozilla.58:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Nettoyer et sauvegarder
:mozilla.59:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Nettoyer et sauvegarder
:mozilla.60:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Nettoyer et sauvegarder
:mozilla.63:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Nettoyer et sauvegarder
:mozilla.64:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Nettoyer et sauvegarder
:mozilla.65:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Nettoyer et sauvegarder
:mozilla.66:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Nettoyer et sauvegarder
:mozilla.72:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Bluestreak : Nettoyer et sauvegarder
:mozilla.82:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Paypopup : Nettoyer et sauvegarder
:mozilla.83:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Paypopup : Nettoyer et sauvegarder
:mozilla.84:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Paypopup : Nettoyer et sauvegarder
:mozilla.85:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Paypopup : Nettoyer et sauvegarder
:mozilla.86:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Paypopup : Nettoyer et sauvegarder
:mozilla.87:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Paypopup : Nettoyer et sauvegarder
:mozilla.88:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Paypopup : Nettoyer et sauvegarder
:mozilla.89:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Paypopup : Nettoyer et sauvegarder
:mozilla.90:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Paypopup : Nettoyer et sauvegarder
:mozilla.91:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Paypopup : Nettoyer et sauvegarder
:mozilla.97:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Comclick : Nettoyer et sauvegarder
:mozilla.98:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Comclick : Nettoyer et sauvegarder
:mozilla.99:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Comclick : Nettoyer et sauvegarder
:mozilla.108:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Estat : Nettoyer et sauvegarder
:mozilla.109:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Weborama : Nettoyer et sauvegarder
:mozilla.110:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Weborama : Nettoyer et sauvegarder
:mozilla.111:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Weborama : Nettoyer et sauvegarder
:mozilla.112:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Weborama : Nettoyer et sauvegarder
:mozilla.117:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Atdmt : Nettoyer et sauvegarder
:mozilla.120:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Falkag : Nettoyer et sauvegarder
:mozilla.121:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Falkag : Nettoyer et sauvegarder
:mozilla.122:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Falkag : Nettoyer et sauvegarder
:mozilla.123:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Falkag : Nettoyer et sauvegarder
:mozilla.124:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Falkag : Nettoyer et sauvegarder
:mozilla.127:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Findwhat : Nettoyer et sauvegarder
:mozilla.137:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Nettoyer et sauvegarder
:mozilla.138:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Nettoyer et sauvegarder
:mozilla.139:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Mediaplex : Nettoyer et sauvegarder
:mozilla.147:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Googleadservices : Nettoyer et sauvegarder
:mozilla.217:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Advertising : Nettoyer et sauvegarder
:mozilla.218:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Advertising : Nettoyer et sauvegarder
:mozilla.219:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Advertising : Nettoyer et sauvegarder
:mozilla.220:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Valueclick : Nettoyer et sauvegarder
:mozilla.221:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Valueclick : Nettoyer et sauvegarder
:mozilla.255:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.247realmedia : Nettoyer et sauvegarder
:mozilla.257:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.2o7 : Nettoyer et sauvegarder
:mozilla.269:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Googleadservices : Nettoyer et sauvegarder
:mozilla.270:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Serving-sys : Nettoyer et sauvegarder
:mozilla.271:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Serving-sys : Nettoyer et sauvegarder
:mozilla.272:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Serving-sys : Nettoyer et sauvegarder
:mozilla.273:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Serving-sys : Nettoyer et sauvegarder
:mozilla.275:C:\Documents and Settings\Lulu\Application Data\Mozilla\Firefox\Profiles\cysmuvs7.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Cookies\lulu@ad.yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Cookies\lulu@paypopup[2].txt -> Spyware.Cookie.Paypopup : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Local Settings\Temporary Internet Files\Content.IE5\638T6BYL\freeprodtb[1].exe -> Spyware.Maxifiles : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Local Settings\Temporary Internet Files\Content.IE5\638T6BYL\launcher[1].exe -> Spyware.Maxifiles : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Local Settings\Temporary Internet Files\Content.IE5\638T6BYL\stubNsbg[1].exe -> Spyware.Maxifiles : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Local Settings\Temporary Internet Files\Content.IE5\E30JERUJ\AppWrap[1].exe -> Spyware.AdURL : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Local Settings\Temporary Internet Files\Content.IE5\M9APMJCL\AppWrap[1].exe -> Spyware.AdURL : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Local Settings\Temporary Internet Files\Content.IE5\M9APMJCL\AppWrap[2].exe -> Spyware.Zestyfind : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\backup.zip/dlls/cbl3dv2.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\backup.zip/dlls/deutil.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\backup.zip/dlls/en88l1lu1.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\backup.zip/dlls/f82mlif1182.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\backup.zip/dlls/gqmf32.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\backup.zip/dlls/krdest.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\backup.zip/dlls/l4n4le5q1h.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\backup.zip/dlls/m046lahs1d46.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\backup.zip/dlls/mjvcrt40.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\backup.zip/dlls/mvgsvc.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\backup.zip/dlls/mvwebdvd.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\backup.zip/dlls/ndevent.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\backup.zip/dlls/omcache.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\backup.zip/dlls/onbccp32.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\backup.zip/dlls/ooeacc.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\backup.zip/dlls/p44uleh91h4.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\backup.zip/dlls/p4p6le7s1h.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\dlls\cbl3dv2.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\dlls\deutil.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\dlls\en88l1lu1.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\dlls\f82mlif1182.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\dlls\gqmf32.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\dlls\krdest.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\dlls\l4n4le5q1h.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\dlls\m046lahs1d46.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\dlls\mjvcrt40.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\dlls\mvgsvc.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\dlls\mvwebdvd.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\dlls\ndevent.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\dlls\omcache.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\dlls\onbccp32.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\dlls\ooeacc.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\dlls\p44uleh91h4.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\Lulu\Mes documents\l2mfix\dlls\p4p6le7s1h.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Program Files\Network Monitor\netmon.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Nettoyer et sauvegarder
C:\RECYCLER\S-1-5-21-484763869-1085031214-725345543-1003\Dc11.exe/UCMTSAIE.DLL -> Spyware.UCmore : Nettoyer et sauvegarder
C:\RECYCLER\S-1-5-21-484763869-1085031214-725345543-1003\Dc11.exe/IUCMORE.DLL -> Spyware.UCmore : Nettoyer et sauvegarder
C:\WINDOWS\icont.exe -> Spyware.AdURL : Nettoyer et sauvegarder
C:\WINDOWS\iconu.exe -> Spyware.Zestyfind : Nettoyer et sauvegarder
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\638T6BYL\!update-3120[1].0000 -> Downloader.PurityScan.be : Nettoyer et sauvegarder
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\638T6BYL\Installer[1].exe -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\638T6BYL\launcher[1].exe -> Spyware.Maxifiles : Nettoyer et sauvegarder
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\M1WJGDK3\freeprodtb[1].exe -> Spyware.Maxifiles : Nettoyer et sauvegarder
C:\WINDOWS\system32\freeprodtb.exe -> Spyware.Maxifiles : Nettoyer et sauvegarder
C:\WINDOWS\Temp\bw2.com -> Spyware.Zestyfind : Nettoyer et sauvegarder
C:\WINDOWS\THVjaWU\asappsrv.dll.bak -> Spyware.CommAd : Nettoyer et sauvegarder
C:\WINDOWS\THVjaWU\command.exe.bak -> Adware.CommAd : Nettoyer et sauvegarder


::Fin du rapport



et enfin nouveau rapport hijack :


Logfile of HijackThis v1.99.1
Scan saved at 23:38:14, on 27/01/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ULi5287\ULi5287.exe
C:\Program Files\Network\network.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\Program Files\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\svchost.exe
D:\Programme\QuickTime\qttask.exe
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
D:\Programme\MSN plus\MsgPlus.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exe
C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\SecuritySuite.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Lulu\Bureau\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.exactsearch.net/sidesearch
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.ad-w-a-r-e.com/cgi-bin/PopupV3?ID={C32C1165-92B2-FE22-A12F-832CB9C98103}&type=normal&mSkip=1&rnd=17408
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ULiRaid] C:\Program Files\ULi5287\ULi5287.exe
O4 - HKLM\..\Run: [Application Layer Gateway Service] C:\WINDOWS\System32\algs.exe
O4 - HKLM\..\Run: [taskbar.exe] C:\dm.exe
O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd2.exe
O4 - HKLM\..\Run: [Windowsz] rwnt.exe
O4 - HKLM\..\Run: [winsysban] C:\windows\winsysban2.exe
O4 - HKLM\..\Run: [myupdates] c:\windows\myupdates.exe
O4 - HKLM\..\Run: [Microsoft Internet Explorer] C:\WINDOWS\System32\iexplore.exe
O4 - HKLM\..\Run: [Network] C:\Program Files\Network\network.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Program Files\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\F-Secure Internet Security\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "D:\Programme\MSN plus\MsgPlus.exe"
O4 - HKLM\..\RunServices: [Windowsz] rwnt.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MessengerPlus3] "D:\Programme\MSN plus\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Documents and Settings\Lulu\Bureau\HijackThis.exe /startupscan
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: PPControl.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: F-Secure 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Filtre Web - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Filtre Web - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Controls Folder - C:\WINDOWS\system32\en88l1lu1.dll (file missing)
O20 - Winlogon Notify: SideBySide - C:\WINDOWS\system32\s0pu0a79ed.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: F-Secure 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSPC\fshttps\fshttps.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)

voili voilou ...
28 Janvier 2006 00:46:06

Re

1 Télécharge CCleaner.
http://www.filehippo.com/download_ccleaner.html
Installe le dans un répertoire dédié.

2 Redémarre en mode sans echec. Attention, tu n'as pas accès à internet dans ce mode, note bien ce que tu as à faire.
Démarre l'ordinateur.
Une fois le chargement du BIOS terminé, il y a un écran noir. Appuye sur la touche F8 jusqu'à l'affichage du menu des options avancées de Windows.
En utilisant les touches du curseur, sélectionne le mode sans échec approprié et appuye sur Entrée.

3 Désinstalle ces applications (si tu les trouves) dans Ajout-Suppression de programmes :

Network Monitor
Network

4 Relance un scan HijackThis et coche les lignes ci-dessous :

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.exactsearch.net/sidesearch
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.ad-w-a-r-e.com/cgi-bin/PopupV3?ID={C32C1165-92B2-FE22-A12F-832CB9C98103}&type=normal&mSkip=1&rnd=17408
O4 - HKLM\..\Run: [Application Layer Gateway Service] C:\WINDOWS\System32\algs.exe
O4 - HKLM\..\Run: [taskbar.exe] C:\dm.exe
O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd2.exe
O4 - HKLM\..\Run: [Windowsz] rwnt.exe
O4 - HKLM\..\Run: [winsysban] C:\windows\winsysban2.exe
O4 - HKLM\..\Run: [myupdates] c:\windows\myupdates.exe
O4 - HKLM\..\Run: [Microsoft Internet Explorer] C:\WINDOWS\System32\iexplore.exe
O4 - HKLM\..\Run: [Network] C:\Program Files\Network\network.exe
O4 - HKLM\..\RunServices: [Windowsz] rwnt.exe
O20 - Winlogon Notify: Controls Folder - C:\WINDOWS\system32\en88l1lu1.dll (file missing)
O20 - Winlogon Notify: SideBySide - C:\WINDOWS\system32\s0pu0a79ed.dll (file missing)
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)

Ferme toutes les fenêtres Windows, Internet explorer, Outlook,sauf le logiciel Hijackthis et clique sur « Fix checked »

5 Assure toi d'avoir accés à tous les fichiers.
Démarrer, Poste de travail ou autre dossier, Menu Outils, Option des dossiers, onglet Affichage :
Activer la case : Afficher les fichiers et dossiers cachés
Désactiver la case : Masquer les extensions des fichiers dont le type est connu
Désactiver la case : Masquer les fichiers protégés du système d'exploitation
Puis Appliquer

6 Supprime les fichiers/dossiers incriminés (s'ils existent encore) :

C:\Program Files\Network
C:\Program Files\Network Monitor
C:\Documents and Settings\Lulu\Mes documents\l2mfix
C:\windows\winsysupd2.exe
C:\windows\winsysban2.exe
c:\windows\myupdates.exe
C:\WINDOWS\System32\algs.exe
C:\dm.exe
rwnt.exe
--> Probablement dans C:\WINDOWS\System32 ou C:\WINDOWS

7 Lance le nettoyage avec CCleaner.

Recache les fichiers systeme afin de ne pas faire d'erreur à l'avenir en sélectionnant ne pas afficher les fichiers cachés ou les fichiers système.

8 Redémarre normalement

9 Va sur ce site
http://virusscan.jotti.org/
Clique sur Parcourir et cherche ce fichier.
C:\Program Files\ULi5287\ULi5287.exe
Ensuite clique sur Submit.

Colle le rapport ici avec un nouveau log HijackThis.
1 Février 2006 18:18:48

Dsl de te répondre si tard, j'étais malade :-?

Bon, j'ai continué ce que tu m'as demandé de faire, par contre, je n'ai pas réussi à désinstaller le programme Network Monitor, " An error has occured romoving Network Monitor. It has not been removed" .
En ce qui concerne le fichier C:\WINDOWS\system32\algs.exe, je ne l'ai pas trouvé mais j'ai trouvé un fichier alg.exe, est-ce le même?? je n'ai pas osé le toucher.

Voici le rapport de virusscan pour le fichier ULi5287.exe ( ndrl : en fait ce fichier appartient à ma carte mère )

File: ULi5287.exe
Status:
OK
MD5 d79c902cf467c9f384463499b26b8115
Packers detected:
-
Scanner results
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
UNA
Found nothing
VBA32
Found nothing

et voila aussi un nouveau rapport Hijack

Logfile of HijackThis v1.99.1
Scan saved at 18:17:44, on 01/02/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ULi5287\ULi5287.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\Program Files\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
C:\Program Files\F-Secure Internet Security\FSGUI\ispnews.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe
C:\Program Files\Winamp\winampa.exe
D:\Programme\QuickTime\qttask.exe
D:\Programme\MSN plus\MsgPlus.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Lulu\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ULiRaid] C:\Program Files\ULi5287\ULi5287.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Program Files\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\F-Secure Internet Security\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "D:\Programme\MSN plus\MsgPlus.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MessengerPlus3] "D:\Programme\MSN plus\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Documents and Settings\Lulu\Bureau\HijackThis.exe /startupscan
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: PPControl.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: F-Secure 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Filtre Web - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Filtre Web - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: F-Secure 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSPC\fshttps\fshttps.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe

que dois-je faire d'autre encore ?

Merci pour ton aide en tout cas ! ^^


a b 8 Sécurité
1 Février 2006 18:30:43

Plus rien d'infectieux ;-)
Fix ces lignes inutiles

O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programme\QuickTime\qttask.exe" -atboottime
1 Février 2006 18:44:05

Merci bien! c super ! ^^
au fait, j'ai remarqué un nouveau fichier sur mon bureau, je me demande qu'est ce que c'est : Backups avec 18 fichiers de 1ko dedans, je peux le supprimer?
Tom's guide dans le monde
  • Allemagne
  • Italie
  • Irlande
  • Royaume Uni
  • Etats Unis
Suivre Tom's Guide
Inscrivez-vous à la Newsletter
  • ajouter à twitter
  • ajouter à facebook
  • ajouter un flux RSS