Aide pour enlever winfixer 2005! tres coriace

Résolu
sarah.c Messages postés 15 Statut Membre -  
sarah.c Messages postés 15 Statut Membre -
Bonjour,

Depuis quelques semaines je suis infecté par le fameux trojan winfixer, j'ai fait le tour de quelques forums, j'ai essayer de faire les manips mais winfixer persiste.
j'ai nettoyer avec spybot, adaware,avast.
j'ai essayé des solutions avec processxp, killbox mais tjs meme pb.
j'ai aussi utilisé hijackthis mais je n'arrive pas a l'interpréter. je ne sais quel sont les fichiers qui a enlever.
voici le resultat de hijack this :

Logfile of HijackThis v1.99.1
Scan saved at 21:02:40, on 11/08/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\htpatch.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\Program Files\Wanadoo\EspaceWanadoo.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\Program Files\Wanadoo\Watch.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{37731BE1-9D4B-4B31-8578-A071F9245E10}: NameServer = 80.10.246.130 80.10.246.3
O17 - HKLM\System\CS1\Services\Tcpip\..\{37731BE1-9D4B-4B31-8578-A071F9245E10}: NameServer = 80.10.246.130 80.10.246.3
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: Setup - C:\WINDOWS\system32\fsntext.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

est ce que quelqu'un peut m'aider?? franchement ce serait sympa.
merci de votre aide

Sarah
Configuration: win xp sp2
amd athlon  processor 1.24 ghz 512mo de ram

19 réponses

  1. valérie
     
    salut sarah!

    en fait je ne peux pas réellemnt d'apporter d'aide parce que j'ai le même problème que toi et que j'attends aussi de l'aide. je t'écris simplement pour te soutenir et j'espère que tu vas en sortir.
    0
  2. sarah.c Messages postés 15 Statut Membre
     
    merci valerie c'est gentille de ta part.
    bon courage a toi aussi. il est un peu difficile a enlever ce trojan!!!
    0
  3. balltrap34 Messages postés 16241 Statut Contributeur sécurité 332
     
    salut
    qui te dit que tu la je vois rien dans ton log
    0
  4. sarah.c Messages postés 15 Statut Membre
     
    salut

    je sais que je l'ai parce que quand je surfe, y'a une fenetre qui s'ouvre me demandant de telecharger winfixer 2005.
    j'ai fait bcp de nettoyage c'est pourquoi le log est leger.
    a un moment winfixer s'etait meme installé sur le pc avec un icone sur le bureau mais grace aux infos que j'ai lu sur les forums j'ai reussi a l'enlever mais les pop up apparaissent toujours (winfixer.com et autres sites)
    j'ai vraiment besoin d'aide car je ne sais plus quoi faire pour ces fenetres demandant d'installer winfixer n'apparaissent plus.

    voili voilou
    merci
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. balltrap34 Messages postés 16241 Statut Contributeur sécurité 332
     
    oki
    Télécharge ce fichier. http://www.niksoft.at/php/dl.php?f=startdreck.zip
    Startdreck.exe
    decompresse le et execute le
    paramettre le comme ceci
    - clik "Config" -> "Unmark all"
    - Coche:
    Registry -> Run Keys
    System/drivers -> Running processes
    - clik "Ok".

    - clik sur "Save" et donne nous le rapport stp
    0
  7. sarah.c Messages postés 15 Statut Membre
     
    merci balltrap34, je vais faire la manip et je te dis ce que ca donne.
    0
  8. sarah.c Messages postés 15 Statut Membre
     
    j'ai un probleme. j'ai bien telecharger startdreck.zip , je l'ai decompressé, il y'a plusieurs fichiers dans le dossier, je lance le fichier Startdreck.exe mais quand je veux cliquer sur config, ca plante. j'ai essayer en mode sans echec et c'est le meme resultat; je comprends pas trop la...
    0
  9. sarah.c Messages postés 15 Statut Membre
     
    ca marche finalement. je n'etais pas assez patiente.
    voici le rapport de Startdreck.exe avec la config donnée :

    StartDreck (build 2.1.7 public stable) - 2005-08-11 @ 22:41:38 (GMT +02:00)
    Platform: Windows XP (Win NT 5.1.2600 Service Pack 2)
    Internet Explorer: 6.0.2900.2180
    Logged in as sarah at COMPPER-QEM7IC2

    »Registry
    »Run Keys
    »Current User
    »Run
    *msnmsgr="C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    *MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background
    »RunOnce
    »Default User
    »Run
    *CTFMON.EXE=C:\WINDOWS\System32\CTFMON.EXE
    *ALUAlert=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe
    »RunOnce
    »Local Machine
    »Run
    *HTpatch=C:\WINDOWS\htpatch.exe
    *TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
    *ISUSPM Startup=C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    *ISUSScheduler="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
    *NeroFilterCheck=C:\WINDOWS\system32\NeroCheck.exe
    *QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
    *avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    +OptionalComponents
    +MSFS
    *Installed=1
    +MAPI
    *Installed=1
    *NoChange=1
    +MAPI
    *Installed=1
    *NoChange=1
    »RunOnce
    »RunServices
    »RunServicesOnce
    »RunOnceEx
    »RunServicesOnceEx
    »Files
    »System/Drivers
    »Running Processes
    +0=<idle>
    +4=<system>
    +464=\SystemRoot\System32\smss.exe
    +512=<unkown>
    +536=\??\C:\WINDOWS\system32\winlogon.exe
    +580=C:\WINDOWS\system32\services.exe
    +592=C:\WINDOWS\system32\lsass.exe
    +752=C:\WINDOWS\system32\svchost.exe
    +800=<unkown>
    +836=C:\WINDOWS\System32\svchost.exe
    +884=<unkown>
    +932=<unkown>
    +1084=C:\WINDOWS\system32\spoolsv.exe
    +1212=C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    +1228=C:\Program Files\Alwil Software\Avast4\ashServ.exe
    +1256=C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    +1296=C:\Program Files\ewido\security suite\ewidoctrl.exe
    +1308=C:\Program Files\ewido\security suite\ewidoguard.exe
    +1372=C:\WINDOWS\system32\nvsvc32.exe
    +1424=C:\WINDOWS\System32\svchost.exe
    +1468=<unkown>
    +1488=C:\WINDOWS\system32\rundll32.exe
    +1540=C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    +1816=C:\WINDOWS\Explorer.EXE
    +1852=C:\WINDOWS\system32\fxssvc.exe
    +480=C:\WINDOWS\htpatch.exe
    +496=C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
    +912=C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
    +968=C:\Program Files\QuickTime\qttask.exe
    +1016=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    +1740=C:\Program Files\MSN Messenger\msnmsgr.exe
    +2140=C:\Program Files\Messenger\msmsgs.exe
    +2156=<unkown>
    +2252=C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
    +2268=C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
    +2572=C:\Program Files\Wanadoo\EspaceWanadoo.exe
    +2584=C:\Program Files\Wanadoo\ComComp.exe
    +2696=C:\Program Files\Wanadoo\Watch.exe
    +2900=C:\Program Files\Internet Explorer\iexplore.exe
    +3180=C:\Program Files\Internet Explorer\iexplore.exe
    +3352=C:\Program Files\Outlook Express\msimn.exe
    +3600=C:\Documents and Settings\sarah\Bureau\startdreck217\StartDreck.exe
    »Application specific

    que dois je faire maintenant?
    0
  11. sarah.c Messages postés 15 Statut Membre
     
    voici le resultat de silentrunners (je t'ai mis le resultat de startdreck dans ma reponse precedente ) :

    "Silent Runners.vbs", revision 39, http://www.silentrunners.org/
    Operating System: Windows XP SP2
    Output limited to non-default values, except where indicated by "{++}"

    Startup items buried in registry:
    ---------------------------------

    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
    "msnmsgr" = ""C:\Program Files\MSN Messenger\msnmsgr.exe" /background" [MS]
    "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
    "HTpatch" = "C:\WINDOWS\htpatch.exe" [null data]
    "TkBellExe" = ""C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
    "ISUSPM Startup" = "C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup" ["InstallShield Software Corporation"]
    "ISUSScheduler" = ""C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start" ["InstallShield Software Corporation"]
    "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
    "QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
    "avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data]

    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
    {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]
    {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
    -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]

    HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
    "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"
    -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
    "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
    "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
    "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
    "{5E44E225-A408-11CF-B581-008029601108}" = "Adaptec DirectCD Shell Extension"
    -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Roxio\EASYCD~1\DirectCD\Shellex.dll" ["Roxio"]
    "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]
    "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]
    "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
    "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
    "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
    "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
    "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
    "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
    "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
    "{2B7D88B3-65B3-4FF1-B014-3921AC6D234D}" = (no title provided)
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\oafox32.dll" [file not found]
    "{1AFBEFAF-C020-4576-A753-40ECA1F0C749}" = (no title provided)
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieuv_32.dll" [file not found]
    "{EE279440-EBFE-44D8-90DB-54AC6FF63A22}" = (no title provided)
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\kedycc.dll" [file not found]
    "{A5B029CC-5A31-46F5-9AD2-E3CF415ED212}" = (no title provided)
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ihwphbk.dll" [file not found]
    "{DEE12703-6333-4D4E-8F34-738C4DCC2E04}" = "RecordNow! SendToExt"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Sonic\RecordNow Deluxe\RecordNow! Deluxe\shlext.dll" [null data]
    "{83DFD2FE-00E2-4962-B83F-D13449BAC0E9}" = (no title provided)
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\camaddin.dll" [file not found]
    "{14CDFCCD-4A92-4F18-9981-E11D99AA9304}" = (no title provided)
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\khdbene.dll" [null data]
    "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
    "{AB77609F-2178-4E6F-9C4B-44AC179D937A}" = "a² Context Menu Shell Extension"
    -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\A2FREE~1\A2CONT~1.DLL" [null data]

    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
    INFECTION WARNING! "{54D9498B-CF93-414F-8984-8CE7FDE0D391}" = "ewido shell guard"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido\security suite\shellhook.dll" ["TODO: <Firmenname>"]

    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\
    INFECTION WARNING! "AppInit_DLLs" = "MsgPlusLoader.dll" ["Patchou"]

    HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
    INFECTION WARNING! Hints\DLLName = "C:\WINDOWS\system32\fsntext.dll" [null data]

    HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
    avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
    ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido\security suite\context.dll" ["ewido networks"]
    WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

    HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
    ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido\security suite\context.dll" ["ewido networks"]
    WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

    HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
    a2ContMenu\(Default) = "{AB77609F-2178-4E6F-9C4B-44AC179D937A}"
    -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\A2FREE~1\A2CONT~1.DLL" [null data]
    avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
    WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

    Active Desktop and Wallpaper:
    -----------------------------

    Active Desktop is disabled at this entry:
    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

    HKCU\Control Panel\Desktop\
    "Wallpaper" = "C:\WINDOWS\web\wallpaper\Colline verdoyante.bmp"

    Enabled Screen Saver:
    ---------------------

    HKCU\Control Panel\Desktop\
    "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]

    Startup items in "sarah" & "All Users" startup folders:
    -------------------------------------------------------

    C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
    "DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W" [empty string]
    "ZoneAlarm" -> shortcut to: "C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe" ["Zone Labs Inc."]

    Enabled Scheduled Tasks:
    ------------------------

    "AC57CC8291887F22" -> launches: "c:\progra~1\medias~1\IdleTimeGreat.exe" [file not found]
    "AC5EA4DF9181574F" -> launches: "c:\progra~1\medias~1\IdleTimeGreat.exe" [file not found]
    "Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]

    Winsock2 Service Provider DLLs:
    -------------------------------

    Namespace Service Providers

    HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
    000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
    000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
    000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

    Transport Service Providers

    HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
    0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
    %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17
    %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

    Toolbars, Explorer Bars, Extensions:
    ------------------------------------

    Toolbars

    HKLM\Software\Microsoft\Internet Explorer\Toolbar\
    "{327C2873-E90D-4C37-AA9D-10AC9BABA46C}" = "Easy-WebPrint"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Canon\Easy-WebPrint\Toolband.dll" [empty string]

    Extensions (Tools menu items, main toolbar menu buttons)

    HKLM\Software\Microsoft\Internet Explorer\Extensions\
    {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
    "MenuText" = "Console Java (Sun)"
    "CLSIDExtension" = "{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll" ["Sun Microsystems, Inc."]

    {FB5F1910-F110-11D2-BB9E-00C04F795683}\
    "ButtonText" = "Messenger"
    "MenuText" = "Windows Messenger"
    "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]

    Miscellaneous IE Hijack Points
    ------------------------------

    C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

    Added lines (compared with English-language version):
    [Strings]: SAFESITE_VALUE="http://home.microsoft.com/intl/fr/"

    Missing lines (compared with English-language version):
    [Strings]: 1 line

    Running Services (Display Name, Service Name, Path {Service DLL}):
    ------------------------------------------------------------------

    avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" [null data]
    avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" [null data]
    C-DillaCdaC11BA, C-DillaCdaC11BA, "C:\WINDOWS\system32\drivers\CDAC11BA.EXE" ["Macrovision"]
    ewido security suite control, ewido security suite control, "C:\Program Files\ewido\security suite\ewidoctrl.exe" ["ewido networks"]
    ewido security suite guard, ewido security suite guard, "C:\Program Files\ewido\security suite\ewidoguard.exe" ["ewido networks"]
    Fax, Fax, "C:\WINDOWS\system32\fxssvc.exe" [MS]
    NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
    TrueVector Internet Monitor, vsmon, "C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs Inc."]
    Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]

    ----------
    + This report excludes default entries except where indicated.
    + To see *everywhere* the script checks and *everything* it finds,
    launch it from a command prompt or a shortcut with the -all parameter.
    + To search all directories of local fixed drives for DESKTOP.INI
    DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
    use the -supp parameter or answer "Yes" at the first message box.
    ---------- (total run time: 57 seconds, including 18 seconds for message boxes)
    0
  12. balltrap34 Messages postés 16241 Statut Contributeur sécurité 332
     
    re cela vas etre un peu long
    verifie tous ces fichier ici
    23 editeur d anti virus
    http://www.virustotal.com/xhtml/virustotal_en.html
    clik sur parcourir localise le fichier et clik sur send attend le rapport
    ouvre le bloc note et copie les rapport dedans et tu nous le donnerat stp

    C:\WINDOWS\system32\oafox32.dll
    C:\WINDOWS\system32\ieuv_32.dll
    C:\WINDOWS\system32\kedycc.dll
    C:\WINDOWS\system32\ihwphbk.dll
    C:\WINDOWS\system32\camaddin.dll
    C:\WINDOWS\system32\khdbene.dll
    C:\WINDOWS\system32\fsntext.dll
    c:\progra~1\medias~1\IdleTimeGreat.exe
    0
  13. sarah.c Messages postés 15 Statut Membre
     
    je ne trouve aucun de ces fichiers sur mon disque dur. c'est bizarre
    0
  14. balltrap34 Messages postés 16241 Statut Contributeur sécurité 332
     
    fait ceci pour les voir
    Affiche tous les fichiers et dossiers :
    cliquer sur démarrer/panneau de configuration/option des dossiers/affichage
    Cocher afficher les dossiers cacher

    Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"

    Décocher masquer les extensions dont le type est connu
    Puis fais "Ok" pour valider les changements.

    Et appliquer
    0
  15. sarah.c Messages postés 15 Statut Membre
     
    finalement j'ai analyser :

    C:\WINDOWS\system32\khdbene.dll
    C:\WINDOWS\system32\fsntext.dll

    mais j'ai bien verifié et je ne trouve pas les autres fichiers sur mon disque dur c

    POUR khdbene.dll, le resultat est :

    This is a report processed by VirusTotal on 08/11/2005 at 23:47:35 (CET) after scanning the file "khdbene.dll" file.
    Antivirus Version Update Result
    AntiVir 6.31.1.0 08.11.2005 ADSPY/Look2Me.ag.6
    Avast 4.6.695.0 08.11.2005 no virus found
    AVG 718 08.11.2005 Generic.JV
    Avira 6.31.1.0 08.11.2005 ADSPY/Look2Me.ag.6
    BitDefender 7.0 08.11.2005 Application.Adware.Look2Me.AG
    CAT-QuickHeal 7.03 08.11.2005 AdWare.Look2Me.ag (Not a Virus)
    ClamAV devel-20050725 08.09.2005 Adware.Lookme-2
    DrWeb 4.32b 08.11.2005 no virus found
    eTrust-Iris 7.1.194.0 08.11.2005 Win32/Canbede.J!Trojan
    eTrust-Vet 11.9.1.0 08.11.2005 Win32.Canbede.J
    Fortinet 2.36.0.0 08.11.2005 W32/VeryLince.A-tr
    F-Prot 3.16c 08.11.2005 no virus found
    Ikarus 0.2.59.0 08.11.2005 no virus found
    Kaspersky 4.0.2.24 08.11.2005 not-a-virus:AdWare.Look2Me.ag
    McAfee 4556 08.11.2005 VeryLince
    NOD32v2 1.1192 08.11.2005 Win32/Adware.Look2Me
    Norman 5.70.10 08.11.2005 no virus found
    Panda 8.02.00 08.11.2005 Adware/Look2Me
    Sophos 3.96.0 08.11.2005 no virus found
    Sybari 7.5.1314 08.11.2005 VeryLince
    Symantec 8.0 08.10.2005 no virus found
    TheHacker 5.8.2.085 08.11.2005 Adware/Look2Me.ag
    VBA32 3.10.4 08.11.2005 AdWare.Look2Me.ag

    VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.> Go to: Home Contact En español
    --------------------------------------------------------------------------------
    www.virustotal.com :: @ Hispasec Sistemas 2004 :: e-mail info@virustotal.com

    ET POUR fsntext.dll , le resultat est :
    File size can't be more than 2 Megabytes.
    You can't try compressing it.

    t'en pense quoi balltrap34 ???
    0
  16. sarah.c Messages postés 15 Statut Membre
     
    J AVAIS DEJA CONFIGURER POUR QU il AFFICHE LES DOSSIERS CACHES ET LES 2 AUTRES MANIP;

    mais je ne trouve plus ces fichiers
    C:\WINDOWS\system32\oafox32.dll
    C:\WINDOWS\system32\ieuv_32.dll
    C:\WINDOWS\system32\kedycc.dll
    C:\WINDOWS\system32\ihwphbk.dll
    C:\WINDOWS\system32\camaddin.dll
    c:\progra~1\medias~1\IdleTimeGreat.exe

    je ne trouve que
    C:\WINDOWS\system32\khdbene.dll
    C:\WINDOWS\system32\fsntext.dll

    je t'ai mis les rapports au dessus
    t'en pense quoi?
    0
  17. balltrap34 Messages postés 16241 Statut Contributeur sécurité 332
     
    apparament une vx2 est la source de ton soucis
    telecharge ceci
    http://www.downloads.subratam.org/l2mfix.exe
    decompresse le double clik sur l2mfix.bat appuie sur n importe quelle touche et ensuite choisi l option 1
    attend il vas faire un rapport fait un copier coller de celui ci
    ne fait surtout rien d autres
    0
    1. sarah.c Messages postés 15 Statut Membre
       
      salut a tous!!!

      voici le rapport de l2mfix:

      L2MFIX find log 1.03
      These are the registry keys present
      **********************************************************************************
      Winlogon/notify:
      Windows Registry Editor Version 5.00

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
      "Asynchronous"=dword:00000000
      "DllName"=""
      "Impersonate"=dword:00000000
      "Logon"="WinLogon"
      "Logoff"="WinLogoff"
      "Shutdown"="WinShutdown"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\App Paths]
      "Asynchronous"=dword:00000000
      "DllName"="C:\\WINDOWS\\system32\\mmdxmlc.dll"
      "Impersonate"=dword:00000000
      "Logon"="WinLogon"
      "Logoff"="WinLogoff"
      "Shutdown"="WinShutdown"

      **********************************************************************************
      useragent:
      Windows Registry Editor Version 5.00

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
      "{226F8E03-0019-895F-D39C-DA93CA5273DC}"=""

      **********************************************************************************
      Shell Extension key:
      Windows Registry Editor Version 5.00

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
      "{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"
      "{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"
      "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"
      "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"
      "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
      "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
      "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"
      "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration"
      "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"
      "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"
      "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚"
      "{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement"
      "{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"
      "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows"
      "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"
      "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"
      "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers"
      "{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web"
      "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
      "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"
      "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"
      "{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal"
      "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
      "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
      "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"
      "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
      "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
      "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"
      "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"
      "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau"
      "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau"
      "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo"
      "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo"
      "{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo"
      "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo"
      "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo"
      "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
      "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows"
      "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft"
      "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
      "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
      "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"
      "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer"
      "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher"
      "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
      "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
      "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..."
      "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
      "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique"
      "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices"
      "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration"
      "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
      "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
      "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
      "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
      "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
      "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
      "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"
      "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement"
      "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"
      "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"
      "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
      "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"
      "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche"
      "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
      "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"
      "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"
      "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"
      "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
      "{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"
      "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"
      "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
      "{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"
      "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"
      "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
      "{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"
      "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses"
      "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"
      "{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"
      "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"
      "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"
      "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
      "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"
      "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
      "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"
      "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"
      "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
      "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
      "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
      "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
      "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
      "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
      "{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique"
      "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
      "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
      "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
      "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"
      "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
      "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
      "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
      "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
      "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
      "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
      "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
      "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
      "{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache"
      "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
      "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
      "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription"
      "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
      "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
      "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
      "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
      "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
      "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
      "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
      "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement"
      "{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es"
      "{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin"
      "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
      "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
      "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI"
      "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)"
      "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML"
      "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
      "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web"
      "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web"
      "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell"
      "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport"
      "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs"
      "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
      "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
      "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne"
      "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne"
      "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
      "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
      "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
      "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
      "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
      "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
      "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
      "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
      "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
      "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
      "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
      "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
      "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
      "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
      "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
      "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
      "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
      "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
      "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
      "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
      "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
      "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"
      "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
      "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
      "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
      "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
      "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
      "{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."
      "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
      "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
      "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
      "{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer"
      "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
      "{5E44E225-A408-11CF-B581-008029601108}"="Adaptec DirectCD Shell Extension"
      "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Dossiers Web"
      "{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
      "{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
      "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
      "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
      "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
      "{FED7043D-346A-414D-ACD7-550D052499A7}"="dBpowerAMP Music Converter 1"
      "{2C49B5D0-ACE7-4D17-9DF0-A254A6C5A0C5}"="dBpowerAMP Music Converter"
      "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
      "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
      "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
      "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
      "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
      "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
      "{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"
      "{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper"
      "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu"
      "{2B7D88B3-65B3-4FF1-B014-3921AC6D234D}"=""
      "{1AFBEFAF-C020-4576-A753-40ECA1F0C749}"=""
      "{EE279440-EBFE-44D8-90DB-54AC6FF63A22}"=""
      "{A5B029CC-5A31-46F5-9AD2-E3CF415ED212}"=""
      "{DEE12703-6333-4D4E-8F34-738C4DCC2E04}"="RecordNow! SendToExt"
      "{83DFD2FE-00E2-4962-B83F-D13449BAC0E9}"=""
      "{14CDFCCD-4A92-4F18-9981-E11D99AA9304}"=""
      "{472083B0-C522-11CF-8763-00608CC02F24}"="avast"
      "{AB77609F-2178-4E6F-9C4B-44AC179D937A}"="aý Context Menu Shell Extension"

      **********************************************************************************
      HKEY ROOT CLASSIDS:
      Windows Registry Editor Version 5.00

      [HKEY_CLASSES_ROOT\CLSID\{2B7D88B3-65B3-4FF1-B014-3921AC6D234D}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{2B7D88B3-65B3-4FF1-B014-3921AC6D234D}\Implemented Categories]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{2B7D88B3-65B3-4FF1-B014-3921AC6D234D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{2B7D88B3-65B3-4FF1-B014-3921AC6D234D}\InprocServer32]
      @="C:\\WINDOWS\\system32\\oafox32.dll"
      "ThreadingModel"="Apartment"

      Windows Registry Editor Version 5.00

      [HKEY_CLASSES_ROOT\CLSID\{1AFBEFAF-C020-4576-A753-40ECA1F0C749}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{1AFBEFAF-C020-4576-A753-40ECA1F0C749}\Implemented Categories]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{1AFBEFAF-C020-4576-A753-40ECA1F0C749}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{1AFBEFAF-C020-4576-A753-40ECA1F0C749}\InprocServer32]
      @="C:\\WINDOWS\\system32\\ieuv_32.dll"
      "ThreadingModel"="Apartment"

      Windows Registry Editor Version 5.00

      [HKEY_CLASSES_ROOT\CLSID\{EE279440-EBFE-44D8-90DB-54AC6FF63A22}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{EE279440-EBFE-44D8-90DB-54AC6FF63A22}\Implemented Categories]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{EE279440-EBFE-44D8-90DB-54AC6FF63A22}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{EE279440-EBFE-44D8-90DB-54AC6FF63A22}\InprocServer32]
      @="C:\\WINDOWS\\system32\\kedycc.dll"
      "ThreadingModel"="Apartment"

      Windows Registry Editor Version 5.00

      [HKEY_CLASSES_ROOT\CLSID\{A5B029CC-5A31-46F5-9AD2-E3CF415ED212}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{A5B029CC-5A31-46F5-9AD2-E3CF415ED212}\Implemented Categories]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{A5B029CC-5A31-46F5-9AD2-E3CF415ED212}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{A5B029CC-5A31-46F5-9AD2-E3CF415ED212}\InprocServer32]
      @="C:\\WINDOWS\\system32\\ihwphbk.dll"
      "ThreadingModel"="Apartment"

      Windows Registry Editor Version 5.00

      [HKEY_CLASSES_ROOT\CLSID\{83DFD2FE-00E2-4962-B83F-D13449BAC0E9}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{83DFD2FE-00E2-4962-B83F-D13449BAC0E9}\Implemented Categories]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{83DFD2FE-00E2-4962-B83F-D13449BAC0E9}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{83DFD2FE-00E2-4962-B83F-D13449BAC0E9}\InprocServer32]
      @="C:\\WINDOWS\\system32\\camaddin.dll"
      "ThreadingModel"="Apartment"

      Windows Registry Editor Version 5.00

      [HKEY_CLASSES_ROOT\CLSID\{14CDFCCD-4A92-4F18-9981-E11D99AA9304}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{14CDFCCD-4A92-4F18-9981-E11D99AA9304}\Implemented Categories]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{14CDFCCD-4A92-4F18-9981-E11D99AA9304}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{14CDFCCD-4A92-4F18-9981-E11D99AA9304}\InprocServer32]
      @="C:\\WINDOWS\\system32\\wjnshfhc.dll"
      "ThreadingModel"="Apartment"

      **********************************************************************************
      Files Found are not all bad files:

      C:\WINDOWS\SYSTEM32\
      cdm.dll Thu 26 May 2005 4:16:24 A.... 75 544 73,77 K
      ckmres.dll Thu 11 Aug 2005 11:30:00 ..S.R 417 792 408,00 K
      damodemx.dll Thu 11 Aug 2005 22:12:16 ..S.R 417 792 408,00 K
      fsntext.dll Mon 8 Aug 2005 6:27:54 ..S.R 417 792 408,00 K
      hhsetup.dll Fri 27 May 2005 4:08:06 A.... 41 472 40,50 K
      icm32.dll Wed 29 Jun 2005 3:49:42 A.... 254 976 249,00 K
      iggutil.dll Thu 11 Aug 2005 23:35:34 ..S.R 417 792 408,00 K
      ismui.dll Fri 12 Aug 2005 14:35:52 ..S.R 417 792 408,00 K
      itircl.dll Fri 27 May 2005 4:08:06 A.... 155 136 151,50 K
      itss.dll Fri 27 May 2005 4:08:06 A.... 137 216 134,00 K
      iuengine.dll Thu 26 May 2005 4:16:24 A.... 198 424 193,77 K
      khdbene.dll Thu 11 Aug 2005 22:27:08 ..S.R 417 792 408,00 K
      mdjeto~1.dll Thu 11 Aug 2005 16:26:12 ..S.R 417 792 408,00 K
      mmdxmlc.dll Fri 12 Aug 2005 10:18:30 ..S.R 417 792 408,00 K
      mscms.dll Wed 29 Jun 2005 3:49:42 A.... 74 240 72,50 K
      mvgsvc.dll Thu 11 Aug 2005 17:48:18 ..S.R 417 792 408,00 K
      sdlogcfg.dll Thu 11 Aug 2005 20:17:18 ..S.R 417 792 408,00 K
      wjnshfhc.dll Fri 12 Aug 2005 18:29:36 ..S.R 417 792 408,00 K
      wodap32.dll Thu 11 Aug 2005 23:26:08 ..S.R 417 792 408,00 K
      wuapi.dll Thu 26 May 2005 4:16:30 A.... 467 224 456,27 K
      wuaueng.dll Thu 26 May 2005 4:16:30 A.... 1 343 768 1,28 M
      wuaueng1.dll Thu 26 May 2005 4:16:32 A.... 195 352 190,77 K
      wucltui.dll Thu 26 May 2005 4:16:32 A.... 128 792 125,77 K
      wups.dll Thu 26 May 2005 4:16:30 A.... 41 240 40,27 K
      wups2.dll Thu 26 May 2005 4:16:30 A.... 18 200 17,77 K
      wuweb.dll Thu 26 May 2005 4:16:30 A.... 173 536 169,47 K
      xpsp3res.dll Tue 17 May 2005 2:42:14 ..... 16 896 16,50 K

      27 items found: 27 files (12 H/S), 0 directories.
      Total of file sizes: 8 335 520 bytes 7,95 M
      Locate .tmp files:

      C:\WINDOWS\SYSTEM32\
      guard.tmp Thu 11 Aug 2005 6:49:52 ..S.R 417 792 408,00 K

      1 item found: 1 file (1 H/S), 0 directories.
      Total of file sizes: 417 792 bytes 408,00 K
      **********************************************************************************
      Directory Listing of system files:
      Le volume dans le lecteur C n'a pas de nom.
      Le num‚ro de s‚rie du volume est B822-29B4

      R‚pertoire de C:\WINDOWS\System32

      12/08/2005 18:29 417ÿ792 wjnshfhc.dll
      12/08/2005 14:35 417ÿ792 ismui.dll
      12/08/2005 10:18 417ÿ792 mmdxmlc.dll
      11/08/2005 23:35 417ÿ792 iggutil.dll
      11/08/2005 23:26 417ÿ792 wodap32.dll
      11/08/2005 22:27 417ÿ792 khdbene.dll
      11/08/2005 22:12 417ÿ792 damodemx.dll
      11/08/2005 20:17 417ÿ792 sdlogcfg.dll
      11/08/2005 17:48 417ÿ792 mvgsvc.dll
      11/08/2005 16:26 417ÿ792 mdjetoledb40.dll
      11/08/2005 11:29 417ÿ792 ckmres.dll
      11/08/2005 06:49 417ÿ792 guard.tmp
      08/08/2005 06:27 417ÿ792 fsntext.dll
      20/07/2005 21:01 <REP> dllcache
      11/06/2004 13:02 <REP> Microsoft
      13 fichier(s) 5ÿ431ÿ296 octets
      2 R‚p(s) 4ÿ431ÿ548ÿ416 octets libres

      que dois je faire svp?
      0
  18. balltrap34 Messages postés 16241 Statut Contributeur sécurité 332
     
    oki
    repasse l2mfix mais cette fois option 2
    et refait un hijack
    0
    1. sarah.c Messages postés 15 Statut Membre
       
      voici le resultat de hijack:

      Logfile of HijackThis v1.99.1
      Scan saved at 19:32:31, on 12/08/2005
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\WINDOWS\system32\drivers\CDAC11BA.EXE
      C:\Program Files\ewido\security suite\ewidoctrl.exe
      C:\Program Files\ewido\security suite\ewidoguard.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\ZoneLabs\vsmon.exe
      C:\WINDOWS\system32\fxssvc.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\htpatch.exe
      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
      C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
      C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
      C:\Program Files\Wanadoo\EspaceWanadoo.exe
      C:\Program Files\Wanadoo\ComComp.exe
      C:\Program Files\Wanadoo\Watch.exe
      C:\Program Files\Outlook Express\msimn.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\HijackThis\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
      O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
      O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
      O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O17 - HKLM\System\CCS\Services\Tcpip\..\{37731BE1-9D4B-4B31-8578-A071F9245E10}: NameServer = 80.10.246.130 80.10.246.3
      O17 - HKLM\System\CS1\Services\Tcpip\..\{37731BE1-9D4B-4B31-8578-A071F9245E10}: NameServer = 80.10.246.130 80.10.246.3
      O20 - AppInit_DLLs: MsgPlusLoader.dll
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
      O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
      O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
      0
    2. sarah.c Messages postés 15 Statut Membre
       
      JE CROIS QUE MON PB EST RESOLU
      LA POP UP DE WINFIXER NE S AFFICHE PLUS DU TOUT

      MILLE MERCI balltrap34
      tu m'a beaucoup aidé.

      a bientot

      sarah
      0
    3. Kanabou
       
      Salut Balltrap34, j'ai le même problème avec Winfixer. Je me permets de te demander ton aide.
      voici mon Hijackthis :

      Logfile of HijackThis v1.99.1
      Scan saved at 12:04:53, on 13/08/2005
      Platform: Windows XP (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\rundll32.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Logiciels Antivirus\aswUpdSv.exe
      C:\Logiciels Antivirus\ashServ.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\Logiciels Antivirus\ashMaiSv.exe
      C:\windows\system\hpsysdrv.exe
      C:\HP\KBD\KBD.EXE
      C:\WINDOWS\system32\dla\tfswctrl.exe
      C:\PROGRA~1\Wanadoo\CnxMon.exe
      C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
      C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
      C:\LOB700~1\ashDisp.exe
      C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
      C:\Program Files\eurobarre\eb.exe
      C:\Logiciels Antivirus\ashWebSv.exe
      C:\Documents and Settings\Propriétaire\Bureau\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Tiscali
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
      O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
      O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
      O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
      O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
      O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
      O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
      O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
      O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
      O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
      O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
      O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
      O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
      O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
      O4 - HKLM\..\Run: [avast!] C:\LOB700~1\ashDisp.exe
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
      O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - Startup: Eurobarre.lnk = C:\Program Files\eurobarre\eb.exe
      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
      O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
      O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
      O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cab
      O16 - DPF: Interface Chat Wanadoo - http://chat9.x-echo.com/version3/Applet/wchatsign.cab
      O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
      O16 - DPF: {093F9CF8-0DE1-491C-95D5-5EC257BD4CA3} - http://akamai.downloadv3.com/binaries/IA/dtc32_FR_XP.cab
      O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
      O16 - DPF: {11111111-1111-1111-1111-111191113457} - file://c:\ied_s7.cab
      O16 - DPF: {11111111-1111-1111-1111-511111193457} - file://c:\x.cab
      O16 - DPF: {11111111-1111-1111-1111-511111193458} - file://c:\x.cab
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
      O16 - DPF: {42E1F024-ECC3-456F-B98A-4CE5ACDBF25C} (ActiveFormX Contrôle) - http://selfcare.cegetel.net/templates/static/ocx/AFAutoConfig.ocx
      O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://metaboli.wanadoo.fr/components/Metaboli.ocx
      O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.141/code/PWActiveXImgCtl.CAB
      O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
      O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://register.tiscali.fr/configurateur/AccountHelper.cab
      O16 - DPF: {92ABACFE-EF6E-42C7-A824-D50A914B5B70} (MastaCash Loader Class) - http://dx.mastacash.com/loader.cab
      O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab
      O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://fr.jackpotcity.microgaming.com/fr.jackpotcity/FlashAX.cab
      O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://antu.popcap.com/games/popcaploader_v5.cab
      O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab
      O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/fr/check/qdiagh.cab?310
      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
      O20 - Winlogon Notify: MediaContentIndex - C:\WINDOWS\system32\cthelper.dll
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Logiciels Antivirus\aswUpdSv.exe
      O23 - Service: avast! Antivirus - Unknown owner - C:\Logiciels Antivirus\ashServ.exe
      O23 - Service: avast! Mail Scanner - Unknown owner - C:\Logiciels Antivirus\ashMaiSv.exe" /service (file missing)
      O23 - Service: avast! Web Scanner - Unknown owner - C:\Logiciels Antivirus\ashWebSv.exe" /service (file missing)
      O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
      O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
      O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe


      Et voici mon I2mfix option 1 (log):

      L2MFIX find log 1.03
      These are the registry keys present
      **********************************************************************************
      Winlogon/notify:
      Windows Registry Editor Version 5.00

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
      "Asynchronous"=dword:00000000
      "Impersonate"=dword:00000000
      "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
      6c,00,00,00
      "Logoff"="ChainWlxLogoffEvent"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
      "Asynchronous"=dword:00000000
      "Impersonate"=dword:00000000
      "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
      6c,00,6c,00,00,00
      "Logoff"="CryptnetWlxLogoffEvent"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
      "DLLName"="cscdll.dll"
      "Logon"="WinlogonLogonEvent"
      "Logoff"="WinlogonLogoffEvent"
      "ScreenSaver"="WinlogonScreenSaverEvent"
      "Startup"="WinlogonStartupEvent"
      "Shutdown"="WinlogonShutdownEvent"
      "StartShell"="WinlogonStartShellEvent"
      "Impersonate"=dword:00000000
      "Asynchronous"=dword:00000001

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
      @=""
      "DLLName"="igfxsrvc.dll"
      "Asynchronous"=dword:00000001
      "Impersonate"=dword:00000001
      "Unlock"="WinlogonUnlockEvent"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MediaContentIndex]
      "Asynchronous"=dword:00000000
      "DllName"="C:\\WINDOWS\\system32\\cthelper.dll"
      "Impersonate"=dword:00000000
      "Logon"="WinLogon"
      "Logoff"="WinLogoff"
      "Shutdown"="WinShutdown"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
      "DLLName"="wlnotify.dll"
      "Logon"="SCardStartCertProp"
      "Logoff"="SCardStopCertProp"
      "Lock"="SCardSuspendCertProp"
      "Unlock"="SCardResumeCertProp"
      "Enabled"=dword:00000001
      "Impersonate"=dword:00000001
      "Asynchronous"=dword:00000001

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
      "Asynchronous"=dword:00000000
      "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
      6c,00,6c,00,00,00
      "Impersonate"=dword:00000000
      "StartShell"="SchedStartShell"
      "Logoff"="SchedEventLogOff"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
      "Logoff"="WLEventLogoff"
      "Impersonate"=dword:00000000
      "Asynchronous"=dword:00000001
      "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
      6c,00,6c,00,00,00

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
      "DLLName"="WlNotify.dll"
      "Lock"="SensLockEvent"
      "Logon"="SensLogonEvent"
      "Logoff"="SensLogoffEvent"
      "Safe"=dword:00000001
      "MaxWait"=dword:00000258
      "StartScreenSaver"="SensStartScreenSaverEvent"
      "StopScreenSaver"="SensStopScreenSaverEvent"
      "Startup"="SensStartupEvent"
      "Shutdown"="SensShutdownEvent"
      "StartShell"="SensStartShellEvent"
      "PostShell"="SensPostShellEvent"
      "Disconnect"="SensDisconnectEvent"
      "Reconnect"="SensReconnectEvent"
      "Unlock"="SensUnlockEvent"
      "Impersonate"=dword:00000001
      "Asynchronous"=dword:00000001

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
      "Asynchronous"=dword:00000000
      "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
      6c,00,6c,00,00,00
      "Impersonate"=dword:00000000
      "Logoff"="TSEventLogoff"
      "Logon"="TSEventLogon"
      "PostShell"="TSEventPostShell"
      "Shutdown"="TSEventShutdown"
      "StartShell"="TSEventStartShell"
      "Startup"="TSEventStartup"
      "MaxWait"=dword:00000258
      "Reconnect"="TSEventReconnect"
      "Disconnect"="TSEventDisconnect"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
      "DLLName"="wlnotify.dll"
      "Logon"="RegisterTicketExpiredNotificationEvent"
      "Logoff"="UnregisterTicketExpiredNotificationEvent"
      "Impersonate"=dword:00000001
      "Asynchronous"=dword:00000001

      **********************************************************************************
      useragent:
      Windows Registry Editor Version 5.00

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
      "{3DE89731-71C9-49A3-F327-9C3318520C4C}"=""

      **********************************************************************************
      Shell Extension key:
      Windows Registry Editor Version 5.00

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
      "{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"
      "{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"
      "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"
      "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"
      "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
      "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
      "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"
      "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration"
      "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"
      "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"
      "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚"
      "{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement"
      "{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"
      "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows"
      "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"
      "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"
      "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers"
      "{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web"
      "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
      "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"
      "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"
      "{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal"
      "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
      "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
      "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"
      "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
      "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
      "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"
      "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"
      "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau"
      "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau"
      "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo"
      "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo"
      "{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo"
      "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo"
      "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo"
      "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
      "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows"
      "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft"
      "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
      "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
      "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"
      "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer"
      "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher"
      "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
      "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
      "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..."
      "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
      "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique"
      "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices"
      "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration"
      "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
      "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
      "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
      "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
      "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
      "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
      "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"
      "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement"
      "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"
      "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"
      "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
      "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"
      "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche"
      "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
      "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"
      "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"
      "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"
      "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
      "{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"
      "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"
      "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
      "{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"
      "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"
      "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
      "{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"
      "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses"
      "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"
      "{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"
      "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"
      "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"
      "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
      "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"
      "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
      "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"
      "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"
      "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
      "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
      "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
      "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
      "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
      "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
      "{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique"
      "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
      "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
      "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
      "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"
      "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
      "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
      "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
      "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
      "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
      "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
      "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
      "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
      "{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache"
      "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
      "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
      "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription"
      "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
      "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
      "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
      "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
      "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
      "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
      "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
      "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement"
      "{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es"
      "{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin"
      "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
      "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
      "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI"
      "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)"
      "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML"
      "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
      "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web"
      "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web"
      "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell"
      "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport"
      "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs"
      "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
      "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
      "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
      "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
      "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
      "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
      "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
      "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
      "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
      "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
      "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
      "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
      "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
      "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
      "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
      "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
      "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
      "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
      "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
      "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
      "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"
      "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
      "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
      "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
      "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
      "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
      "{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."
      "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
      "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
      "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
      "{5CA3D70E-1895-11CF-8E15-001234567890}"="DriveLetterAccess"
      "{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Explorateur de Bureau"
      "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
      "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Dossiers Web"
      "{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
      "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
      "{32020A01-506E-484D-A2A8-BE3CF17601C3}"="AlcoholShellEx"
      "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
      "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne"
      "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne"
      "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
      "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
      "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
      "{AB77609F-2178-4E6F-9C4B-44AC179D937A}"="aý Context Menu Shell Extension"
      "{8FC04D08-971C-43CB-9290-FD7225A1718B}"=""
      "{472083B0-C522-11CF-8763-00608CC02F24}"="avast"

      **********************************************************************************
      HKEY ROOT CLASSIDS:
      Windows Registry Editor Version 5.00

      [HKEY_CLASSES_ROOT\CLSID\{8FC04D08-971C-43CB-9290-FD7225A1718B}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{8FC04D08-971C-43CB-9290-FD7225A1718B}\Implemented Categories]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{8FC04D08-971C-43CB-9290-FD7225A1718B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{8FC04D08-971C-43CB-9290-FD7225A1718B}\InprocServer32]
      @="C:\\WINDOWS\\system32\\babmm.dll"
      "ThreadingModel"="Apartment"

      **********************************************************************************
      Files Found are not all bad files:

      C:\WINDOWS\SYSTEM32\
      awsldpc.dll Tue 2 Aug 2005 21:54:28 ..S.R 417 792 408,00 K
      babmm.dll Sat 13 Aug 2005 12:03:08 ..S.R 417 792 408,00 K
      cptdll.dll Wed 22 Jun 2005 9:36:48 ..S.R 417 792 408,00 K
      cthelper.dll Fri 5 Aug 2005 9:47:08 ..S.R 417 792 408,00 K
      cuyptsvc.dll Tue 21 Jun 2005 23:03:00 ..S.R 417 792 408,00 K
      dblayx.dll Thu 14 Jul 2005 20:03:52 ..S.R 417 792 408,00 K
      dbsapi.dll Fri 22 Jul 2005 12:09:38 ..S.R 417 792 408,00 K
      dqskmon.dll Thu 14 Jul 2005 20:03:32 ..S.R 417 792 408,00 K
      duvx.dll Thu 21 Jul 2005 17:28:54 ..S.R 417 792 408,00 K
      ecent.dll Thu 14 Jul 2005 21:01:30 ..S.R 417 792 408,00 K
      fhclient.dll Thu 14 Jul 2005 21:01:40 ..S.R 417 792 408,00 K
      iaetppui.dll Tue 12 Jul 2005 18:22:56 ..S.R 417 792 408,00 K
      iefxdev.dll Mon 8 Aug 2005 17:04:04 ..S.R 417 792 408,00 K
      ieshlpr.dll Tue 12 Jul 2005 18:22:34 ..S.R 417 792 408,00 K
      ifseng.dll Tue 9 Aug 2005 10:45:44 ..S.R 417 792 408,00 K
      iilmrem.dll Thu 30 Jun 2005 23:32:44 ..S.R 417 792 408,00 K
      illm5.dll Mon 11 Jul 2005 11:21:14 ..S.R 417 792 408,00 K
      jivart.dll Tue 12 Jul 2005 12:26:40 ..S.R 417 792 408,00 K
      kfdkyr.dll Mon 27 Jun 2005 21:42:36 ..S.R 417 792 408,00 K
      kgdgr.dll Tue 12 Jul 2005 13:30:48 ..S.R 417 792 408,00 K
      kgdic.dll Tue 12 Jul 2005 19:27:48 ..... 417 792 408,00 K
      khddv.dll Fri 22 Jul 2005 0:04:16 ..S.R 417 792 408,00 K
      kjdhe.dll Tue 12 Jul 2005 14:53:26 ..S.R 417 792 408,00 K
      kldca.dll Sat 23 Jul 2005 23:27:24 ..S.R 417 792 408,00 K
      kldic.dll Fri 22 Jul 2005 0:04:24 ..S.R 417 792 408,00 K
      kqdfr.dll Tue 12 Jul 2005 13:30:54 ..S.R 417 792 408,00 K
      krdhe.dll Tue 12 Jul 2005 12:26:58 ..S.R 417 792 408,00 K
      krdtat.dll Tue 12 Jul 2005 14:53:18 ..S.R 417 792 408,00 K
      ktdcr.dll Sun 3 Jul 2005 21:07:22 ..S.R 417 792 408,00 K
      masystem.dll Fri 8 Jul 2005 14:52:20 ..S.R 417 792 408,00 K
      mctlsapi.dll Tue 9 Aug 2005 10:48:00 ..S.R 417 792 408,00 K
      mdxml3.dll Wed 13 Jul 2005 21:42:02 ..S.R 417 792 408,00 K
      mghcp.dll Sat 13 Aug 2005 11:29:56 ..S.R 417 792 408,00 K
      mmls31.dll Sat 16 Jul 2005 11:01:18 ..S.R 417 792 408,00 K
      mnacm32.dll Thu 14 Jul 2005 22:18:08 ..S.R 417 792 408,00 K
      mqhtmler.dll Tue 12 Jul 2005 16:19:52 ..S.R 417 792 408,00 K
      murmsg.dll Tue 12 Jul 2005 16:19:36 ..S.R 417 792 408,00 K
      nmh0409.dll Wed 1 Jun 2005 21:13:44 A.... 16 384 16,00 K
      noprovau.dll Thu 21 Jul 2005 23:59:24 ..S.R 417 792 408,00 K
      ogexl32.dll Tue 12 Jul 2005 12:22:10 ..S.R 417 792 408,00 K
      oqethk32.dll Fri 22 Jul 2005 1:19:04 ..S.R 417 792 408,00 K
      plchdprf.dll Wed 6 Jul 2005 11:32:48 ..S.R 417 792 408,00 K
      pyrfnet.dll Fri 22 Jul 2005 1:19:12 ..S.R 417 792 408,00 K
      qodwipes.dll Sun 17 Jul 2005 21:55:50 ..S.R 417 792 408,00 K
      rgcdll.dll Tue 12 Jul 2005 17:22:06 ..S.R 417 792 408,00 K
      sdc.dll Mon 18 Jul 2005 13:06:16 ..S.R 417 792 408,00 K
      shtupwbv.dll Tue 12 Jul 2005 17:22:22 ..S.R 417 792 408,00 K
      slmscrpt.dll Thu 30 Jun 2005 21:10:42 ..S.R 417 792 408,00 K
      sqells~1.dll Fri 15 Jul 2005 13:13:52 ..S.R 417 792 408,00 K
      utbmon.dll Wed 6 Jul 2005 17:22:32 ..S.R 417 792 408,00 K
      vopodbc.dll Fri 12 Aug 2005 13:37:04 ..S.R 417 792 408,00 K
      wgsdmoe2.dll Thu 21 Jul 2005 23:54:14 ..S.R 417 792 408,00 K

      52 items found: 52 files (50 H/S), 0 directories.
      Total of file sizes: 21 323 776 bytes 20,34 M
      Locate .tmp files:

      C:\WINDOWS\SYSTEM32\
      guard.tmp Wed 22 Jun 2005 12:43:48 ..S.R 417 792 408,00 K

      1 item found: 1 file (1 H/S), 0 directories.
      Total of file sizes: 417 792 bytes 408,00 K
      **********************************************************************************
      Directory Listing of system files:
      Le volume dans le lecteur C s'appelle HP_PAVILION
      Le num‚ro de s‚rie du volume est 909A-FC9D

      R‚pertoire de C:\WINDOWS\System32

      13/08/2005 12:03 417ÿ792 babmm.dll
      13/08/2005 11:29 417ÿ792 mghcp.dll
      12/08/2005 13:37 417ÿ792 vopodbc.dll
      09/08/2005 10:47 417ÿ792 mctlsapi.dll
      09/08/2005 10:45 417ÿ792 ifseng.dll
      08/08/2005 17:04 417ÿ792 iefxdev.dll
      05/08/2005 09:47 417ÿ792 cthelper.dll
      02/08/2005 21:54 417ÿ792 awsldpc.dll
      23/07/2005 23:27 417ÿ792 kldca.dll
      22/07/2005 12:09 417ÿ792 dbsapi.dll
      22/07/2005 01:19 417ÿ792 pyrfnet.dll
      22/07/2005 01:19 417ÿ792 oqethk32.dll
      22/07/2005 00:04 417ÿ792 kldic.dll
      22/07/2005 00:04 417ÿ792 khddv.dll
      21/07/2005 23:59 417ÿ792 noprovau.dll
      21/07/2005 23:54 417ÿ792 wgsdmoe2.dll
      21/07/2005 17:28 417ÿ792 DuvX.dll
      18/07/2005 13:06 417ÿ792 sdc.dll
      17/07/2005 21:55 417ÿ792 qodwipes.dll
      16/07/2005 11:01 417ÿ792 mmls31.dll
      15/07/2005 13:13 417ÿ792 sqellstyle.dll
      14/07/2005 22:18 417ÿ792 mnacm32.dll
      14/07/2005 21:01 417ÿ792 fhclient.dll
      14/07/2005 21:01 417ÿ792 ecent.dll
      14/07/2005 20:03 417ÿ792 dblayx.dll
      14/07/2005 20:03 417ÿ792 dqskmon.dll
      13/07/2005 21:42 417ÿ792 mdxml3.dll
      12/07/2005 18:22 417ÿ792 iaetppui.dll
      12/07/2005 18:22 417ÿ792 iEshlpr.dll
      12/07/2005 17:22 417ÿ792 shtupwbv.dll
      12/07/2005 17:22 417ÿ792 rgcdll.dll
      12/07/2005 16:19 417ÿ792 mqhtmler.dll
      12/07/2005 16:19 417ÿ792 murmsg.dll
      12/07/2005 14:53 417ÿ792 kjdhe.dll
      12/07/2005 14:53 417ÿ792 krdtat.dll
      12/07/2005 13:30 417ÿ792 kqdfr.dll
      12/07/2005 13:30 417ÿ792 kgdgr.dll
      12/07/2005 12:26 417ÿ792 krdhe.dll
      12/07/2005 12:26 417ÿ792 jIvart.dll
      12/07/2005 12:22 417ÿ792 ogexl32.dll
      11/07/2005 11:21 417ÿ792 illm5.dll
      08/07/2005 14:52 417ÿ792 masystem.dll
      06/07/2005 17:22 417ÿ792 utbmon.dll
      06/07/2005 11:32 417ÿ792 plchdprf.dll
      03/07/2005 21:07 417ÿ792 ktdcr.dll
      30/06/2005 23:32 417ÿ792 iIlmrem.dll
      30/06/2005 21:10 417ÿ792 SLMSCRPT.DLL
      27/06/2005 21:42 417ÿ792 kfdkyr.dll
      22/06/2005 12:43 417ÿ792 guard.tmp
      22/06/2005 09:36 417ÿ792 cptdll.dll
      21/06/2005 23:02 417ÿ792 cuyptsvc.dll
      21/06/2005 23:02 <REP> dllcache
      24/05/2002 18:31 <REP> Microsoft
      51 fichier(s) 21ÿ307ÿ392 octets
      2 R‚p(s) 27ÿ524ÿ108ÿ288 octets libres

      Dois-je continuer avec l'option 2 d'I2mfix. J'ai peur de faire des bêtises. Merci pour ton aide.
      0
      1. balltrap34 Messages postés 16241 Statut Contributeur sécurité 332 > Kanabou
         
        salut oui fait l option 2 en mode sans echec
        et je te conseil de le refaire une deuxieme fois
        ensuite met le rapport de la deuxieme fois et un hijack
        0
  19. balltrap34 Messages postés 16241 Statut Contributeur sécurité 332
     
    content pour toi mais refait un silence runner pour voir stp
    0
    1. sarah.c Messages postés 15 Statut Membre
       
      salut balltrap34
      voici le resultat du silence runner:

      "Silent Runners.vbs", revision 39, http://www.silentrunners.org/
      Operating System: Windows XP SP2
      Output limited to non-default values, except where indicated by "{++}"


      Startup items buried in registry:
      ---------------------------------

      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
      "msnmsgr" = ""C:\Program Files\MSN Messenger\msnmsgr.exe" /background" [MS]
      "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]

      HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
      "HTpatch" = "C:\WINDOWS\htpatch.exe" [null data]
      "TkBellExe" = ""C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
      "ISUSPM Startup" = "C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup" ["InstallShield Software Corporation"]
      "ISUSScheduler" = ""C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start" ["InstallShield Software Corporation"]
      "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
      "QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
      "avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data]

      HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
      {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
      -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]
      {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
      -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]

      HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
      "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"
      -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
      "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"
      -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
      "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
      -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
      "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
      -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
      "{5E44E225-A408-11CF-B581-008029601108}" = "Adaptec DirectCD Shell Extension"
      -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Roxio\EASYCD~1\DirectCD\Shellex.dll" ["Roxio"]
      "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
      -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]
      "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
      -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]
      "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
      -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
      "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
      -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
      "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
      -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
      "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
      -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
      "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
      -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
      "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
      -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
      "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
      -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
      "{DEE12703-6333-4D4E-8F34-738C4DCC2E04}" = "RecordNow! SendToExt"
      -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Sonic\RecordNow Deluxe\RecordNow! Deluxe\shlext.dll" [null data]
      "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"
      -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
      "{AB77609F-2178-4E6F-9C4B-44AC179D937A}" = "a² Context Menu Shell Extension"
      -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\A2FREE~1\A2CONT~1.DLL" [null data]

      HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
      INFECTION WARNING! "{54D9498B-CF93-414F-8984-8CE7FDE0D391}" = "ewido shell guard"
      -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido\security suite\shellhook.dll" ["TODO: <Firmenname>"]

      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\
      INFECTION WARNING! "AppInit_DLLs" = "MsgPlusLoader.dll" ["Patchou"]

      HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
      avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
      -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
      ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
      -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido\security suite\context.dll" ["ewido networks"]
      WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
      -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

      HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
      ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
      -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido\security suite\context.dll" ["ewido networks"]
      WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
      -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

      HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
      a2ContMenu\(Default) = "{AB77609F-2178-4E6F-9C4B-44AC179D937A}"
      -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\A2FREE~1\A2CONT~1.DLL" [null data]
      avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
      -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
      WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
      -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]


      Active Desktop and Wallpaper:
      -----------------------------

      Active Desktop is disabled at this entry:
      HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

      HKCU\Control Panel\Desktop\
      "Wallpaper" = "C:\WINDOWS\web\wallpaper\Colline verdoyante.bmp"


      Enabled Screen Saver:
      ---------------------

      HKCU\Control Panel\Desktop\
      "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]


      Startup items in "sarah" & "All Users" startup folders:
      -------------------------------------------------------

      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
      "DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W" [empty string]
      "ZoneAlarm" -> shortcut to: "C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe" ["Zone Labs Inc."]


      Enabled Scheduled Tasks:
      ------------------------

      "AC57CC8291887F22" -> launches: "c:\progra~1\medias~1\IdleTimeGreat.exe" [file not found]
      "AC5EA4DF9181574F" -> launches: "c:\progra~1\medias~1\IdleTimeGreat.exe" [file not found]
      "Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]


      Winsock2 Service Provider DLLs:
      -------------------------------

      Namespace Service Providers

      HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
      000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
      000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
      000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

      Transport Service Providers

      HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
      0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
      %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17
      %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


      Toolbars, Explorer Bars, Extensions:
      ------------------------------------

      Toolbars

      HKLM\Software\Microsoft\Internet Explorer\Toolbar\
      "{327C2873-E90D-4C37-AA9D-10AC9BABA46C}" = "Easy-WebPrint"
      -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Canon\Easy-WebPrint\Toolband.dll" [empty string]

      Extensions (Tools menu items, main toolbar menu buttons)

      HKLM\Software\Microsoft\Internet Explorer\Extensions\
      {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
      "MenuText" = "Console Java (Sun)"
      "CLSIDExtension" = "{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}"
      -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll" ["Sun Microsystems, Inc."]

      {FB5F1910-F110-11D2-BB9E-00C04F795683}\
      "ButtonText" = "Messenger"
      "MenuText" = "Windows Messenger"
      "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]


      Miscellaneous IE Hijack Points
      ------------------------------

      C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

      Added lines (compared with English-language version):
      [Strings]: SAFESITE_VALUE="http://home.microsoft.com/intl/fr/"

      Missing lines (compared with English-language version):
      [Strings]: 1 line


      Running Services (Display Name, Service Name, Path {Service DLL}):
      ------------------------------------------------------------------

      avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" [null data]
      avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" [null data]
      C-DillaCdaC11BA, C-DillaCdaC11BA, "C:\WINDOWS\system32\drivers\CDAC11BA.EXE" ["Macrovision"]
      ewido security suite control, ewido security suite control, "C:\Program Files\ewido\security suite\ewidoctrl.exe" ["ewido networks"]
      ewido security suite guard, ewido security suite guard, "C:\Program Files\ewido\security suite\ewidoguard.exe" ["ewido networks"]
      Fax, Fax, "C:\WINDOWS\system32\fxssvc.exe" [MS]
      NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
      TrueVector Internet Monitor, vsmon, "C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs Inc."]
      Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]


      ----------
      + This report excludes default entries except where indicated.
      + To see *everywhere* the script checks and *everything* it finds,
      launch it from a command prompt or a shortcut with the -all parameter.
      + To search all directories of local fixed drives for DESKTOP.INI
      DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
      use the -supp parameter or answer "Yes" at the first message box.
      ---------- (total run time: 46 seconds, including 8 seconds for message boxes)

      t'en pense quoi?

      merci d'avance
      0
  20. balltrap34 Messages postés 16241 Statut Contributeur sécurité 332
     
    je vois rien cela a lair bon
    a++
    0
    1. sarah.c Messages postés 15 Statut Membre
       
      merci

      @+
      0

Discussions similaires

Enlever ou désactiver le mode sécurisé Freebox
Cycy -
bazfile -

18 réponses
Je veux retirer le mode sécurité de ma TV Freebox
beatrice -
baladur13 -

1 réponse
"Mode sécurisé": comment l'enlever ?
skander1615 -
Tito -

2 réponses
Comment supprimer le surlignage sur Word ?
luxbanne -
Maud -

11 réponses