Pgs internet blokées, pubs, dso exploit

salut telecharge et execute ces antispywares ( pense a les mettre a jour avant de les lancées)
(1) ad-aware version 1.06

(ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
voir demo
http://pageperso.aol.fr/balltrap34/adwseflash.zip
***
(2) spybot version 1.4

(ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite

voir demo d utilisation
http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm
***

et aussi ceci
(3) CleanUp40.exe
http://www.florensac-chasse-trap.com/ section virus/logiciel de securite

voir demo
http://pageperso.aol.fr/balltrap34/democleanup.htm
***
(4) a2

http://www.emsisoft.net/fr/
penser a le metre a jour avant de scanner le pc
***
ps : un grand merci a balltrap pour les lien :)

(5) Edwido
http://download.ewido.net/ewido-setup.exe
Pendant l'installation, sur la page "Additional Options", décoche les deux options "Install background guard" et "Install scan via context menu Ewido Security Suite. Clique sur mise à jour.

Clique sur scanner puis sur scan complet du système.

(6)SmitfraudFix

http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, il va générer un rapport
Copie/colle le sur le poste stp.

ensuite telecharge hijackthis et colle le raport ici
http://www.infos-du-net.com/telecharger/HijackThis.html
demo :
http://pageperso.aol.fr/balltrap34/demohijack.htm

@++++++++

salut tout d'abord il faut desactiver ce service O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\eric\LOCALS~1\Temp\hpdj.exe (file missing)

donc va dans :
Menu Démarrer/Panneau de Configuration/Outils d'administration/Services
Dans la fenêtre qui s'ouvre, double-clique sur la ligne "hpdj ".
Dans le champ "Type de démarrage" de l'onglet "Général", sélectionne "Desactivé".
Clique sur "Arrêter".
Clique ensuite sur "OK" pour valider la configuration.

O4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1022.dll,InstantAccess

1.redemarre en mode sans echec (redemarage + tapotte sans arret sur F8 desque l'ordi s'allume)

2. desactive ta restauration (pour win xp ) comme ceci :
clike droit sur post de travaille/proprietes/restauration system et la tu coche desactiver la restauration du systeme tu applique

3. affiche les fichier cacher comme ceci :
clicker sur demarrer/panneau de configuration/option des dossiers/affichage
Cocher afficher les dossiers cacher
Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"
Puis fais «Ok» pour valider les changements.
Decocher masquer les extentions dont le type est connues

4.ensuite va dans demarrer/rechercher et tape:
p2esocks_1022.dll
suprime le et vide ta corebeille

reactive la restauration et masque les fichiers caché en suivant le meme chemin

toujour en mode sans echec execute smitfraud et cette fois ci choisi l'option 2 et colle le rapport ici

@+++++++

Voila, voila,

Concernant "p2esocks_1022.dll", la recherche a été infructueuse. Il faut savoir que depusi qqs tps (bien avant ce pb de virus), le message suivant apparait à l'entrée de windows :

Erreur de chargement de p2esocks_1022.dll
Le module spécifié est introuvable.

Sinon, voici le rapport de smitfraud :

SmitFraudFix v2.08

Rapport fait à 23:51:43,29 le 13/12/2005
Executé à partir de C:\Documents and Settings\eric\Bureau\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

C:\WINDOWS\system32\msvol.tlb supprimé
C:\WINDOWS\system32\ncompat.tlb supprimé
C:\WINDOWS\system32\ot.ico supprimé
C:\WINDOWS\system32\ts.ico supprimé
C:\WINDOWS\system32\1024\ supprimé
C:\Program Files\SpyKiller\ supprimé

»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport

remet un hijack stp
ou en ai tu avec tes problemes?
@+++++++

Voilà :

Logfile of HijackThis v1.99.1
Scan saved at 00:11:11, on 14/12/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\CPUIDLE\srvany.exe
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\CPUIDLE\cpuidle.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
C:\Program Files\Classic PhoneTools\CapFax.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe
C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Webroot\Washer\wwDisp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Harrap's Multimédia\Shorter\bin\HiHarrapsTray.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fourni par chello broadband n.v.
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.chello.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Agent] C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
O4 - HKLM\..\Run: [CapFax] C:\Program Files\Classic PhoneTools\CapFax.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SCM] c:\program files\silver crest memory adapter tools2.93\scma.exe sys_auto_run C:\Program Files\Silver Crest Memory Adapter Tools2.93
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [ymetray] "C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe"
O4 - HKLM\..\Run: [Control Center] C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1022.dll,InstantAccess
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Ask Harrap's Shorter.lnk = ?
O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://home.fra.chello.be/ssi/welcome/welcome.php?url=home
O16 - DPF: ChatSpace Full Java Client 3.1.0.235 - http://irc.chatway.com:8059/Java/cfs31235.cab
O16 - DPF: Interface Chat Voila - http://chat9.x-echo.com/version5/Applet/vchatsign.cab
O16 - DPF: ServerPushBox - http://www.spot.be/servp12.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://64.124.45.181/downloads/ccpm_0237.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-9.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/0489b35107d6b53e9b21/netzip/RdxIE601_fr.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120293400015
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
O16 - DPF: {AE775D48-49AA-11D1-8F1C-00C04FB67063} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v5/ticker.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: cpuidle - Unknown owner - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\CPUIDLE\srvany.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

En fait, le virus semble être supprimé... plus aucun message quelconque n'apparait à ce propos.

Il est bien parti ou pas ?

merci

re ton log est propre y'a just un truc que j'ai oublié de precisé c'est de fixer cette ligne avec hijack

tu lance hijack clike sur le 2eme bouton / coche cette ligne et clike sur fix checked

O4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1022.dll,InstantAccess

apres t'aura plus ce message au demarage : Erreur de chargement de p2esocks_1022.dll
Le module spécifié est introuvable.

sinon apart ca tout est clean lance les antispyware au moin une fois par semaine .
installe un parfeu pour renforcé la securité perso je te conseille kerio

@+++++++

Yes, un très grand merci en tt cas !!!!

Juste une petite chose. Spybot S&D trouve encore :

Smitfraud-C.: Réglages utilisateur (Modification du registre, nothing done)
HKEY_USERS\S-1-5-21-1715567821-1547161642-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\free-spy-cam.net\*!=W=4

--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

Pas possible de le supprimer "sans doute parce que les fichiers concernés sont tjs actifs (en mémoire)"

Qu'est-ce ??

Et pr le pare-feu, celui de windowx xp pack2 ne suffit dc pas selon toi ??

Quoiqu'il en soit, encore un tt grand merci à toi !

salut

supprime la direct du registre voici le chemin

demarrer/executer/tape : regedit
ensuite supprime la clée en suivent son chemin d acces HKEY_USERS\S-1-5-21-1715567821-1547161642-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\free-spy-cam.net\*!=W=4

si t'arrive pas en mode normal essay en mode sans echec

nb faut faire attention avec le registre c'est a dire supprime la bonne clée sinon plantage du pc !!

pour le parefeu de windows je connais pas bien donc je peu pas donné un avi la dessu .perso j'utlise kerio il est trés bien :) .si tu te sent protegé avec la parefeu de windows alors garde le :)

@++++++
bonne nuit !! :)

salut
pour cela utilise ceci avec l option 3
telecharge
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
tu le decompresse tu double clik dessus sur smitfraudfix.cmd et tu choisi l option 3

Un grand merci, tout est résolu !!

De rien :)

@+++

Bonjour à tous !
Je viens de faire une recherche sur le forum et il s'avère ke je viens de trouver un sujet ou j'ai exactement le même problème. J'ai également des pages internets qui s'ouvrent disons toutes les 5-10 minutes (soit en me disant ke mon systme est infecté et que fo ke j'achete et scan en ligne, soit des pubs), ce qui s'avère très très pénible.

Je viens alors de faire ce que tu a dit Jess pour la personne d'avant, c'est à dire que dl les programmes que je n'avais pas (j'utilisais seulement kaspersky en anti-virus + ad aware et spybot, mais pas le reste), voici le rapport des deux derniers

SmitFraudFix v2.21

Rapport fait à 13:20:03,79 le 18/02/2006
Executé à partir de C:\Documents and Settings\Uilisateur\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32

C:\WINDOWS\system32\paradise.raw.exe PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Recherche ...\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"

[HKEY_CLASSES_ROOT\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

[HKEY_CLASSES_ROOT\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport

.............................................................................................

Logfile of HijackThis v1.99.1
Scan saved at 13:25:59, on 18/02/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Documents and Settings\Uilisateur\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\RunServices: [Windows mod Verifier] Windows-mod.exe
O4 - HKLM\..\RunServices: [AdobeReaderPro] svxhost.exe
O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a-squared\a2guard.exe"
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: App Management - C:\WINDOWS\system32\en48l1hu1.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Microsoft Windows Update Service (Windows Update Service) - Unknown owner - C:\WINDOWS\services.exe (file missing)

Si quelqu'un peut m'aider à régler cette affaire, j'avoue que ca m'aiderait vraiment beaucoup, car c super pénible.
Merci d'avance

Bonjour à tous !
Je viens de faire une recherche sur le forum et il s'avère ke je viens de trouver un sujet ou j'ai exactement le même problème. J'ai également des pages internets qui s'ouvrent disons toutes les 5-10 minutes (soit en me disant ke mon systme est infecté et que fo ke j'achete et scan en ligne, soit des pubs), ce qui s'avère très très pénible.

Je viens alors de faire ce que tu a dit Jess pour la personne d'avant, c'est à dire que dl les programmes que je n'avais pas (j'utilisais seulement kaspersky en anti-virus + ad aware et spybot, mais pas le reste), voici le rapport des deux derniers

SmitFraudFix v2.21

Rapport fait à 13:20:03,79 le 18/02/2006
Executé à partir de C:\Documents and Settings\Uilisateur\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32

C:\WINDOWS\system32\paradise.raw.exe PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Recherche ...\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"

[HKEY_CLASSES_ROOT\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

[HKEY_CLASSES_ROOT\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport

.............................................................................................

Logfile of HijackThis v1.99.1
Scan saved at 13:25:59, on 18/02/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Documents and Settings\Uilisateur\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\RunServices: [Windows mod Verifier] Windows-mod.exe
O4 - HKLM\..\RunServices: [AdobeReaderPro] svxhost.exe
O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a-squared\a2guard.exe"
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: App Management - C:\WINDOWS\system32\en48l1hu1.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Microsoft Windows Update Service (Windows Update Service) - Unknown owner - C:\WINDOWS\services.exe (file missing)

salut
1.redemarre en mode sans echec (redemarage + tapotte sans arret sur F8 desque l'ordi s'allume)

2. lance smitfraud et choisi l'option 2 et 3 et colle le rapport ici

redemare en mode normal

1/ Télécharge l2mfix.exe ici http://www.downloads.subratam.org/l2mfix.exe

Mets-le sur ton bureau.
Double-clic sur l2mfix.exe
A la 1ère question clic sur Accept, ensuite clic sur Install

2/ Ouvre le dossier l2mfix créé sur le bureau puis double-clic sur L2Mfix.bat
Ensuite choisis l'option 1 puis Entrée
Poste ce 1er rapport.

@+++++++++

Merci de ta réponse si rapide :)

Alors, j'ai fais ce que tu m'a demandé de faire, voici le rapport de smitfraud :

SmitFraudFix v2.21

Rapport fait à 14:07:48,42 le 18/02/2006
Executé à partir de C:\Documents and Settings\Uilisateur\Mes documents\barre d'outil\logiciel nettoyage\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

C:\WINDOWS\system32\paradise.raw.exe supprimé

»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage Fichiers Temporaires

»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport

..............................................................................................

Et voici celui de l2mfix

L2MFIX find log 010406
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Explorer]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\k0260afsed260.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{63D8F587-E691-CB83-B3E6-1D1878372757}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"
"{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Extension de la page de propri‚t‚s de mise … jour automatique"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{5E2121EE-0300-11D4-8D3B-444553540000}"="Catalyst Context Menu extension"
"{1768500D-8668-40FA-A94E-A3FF196EE7FA}"=""
"{84B3EB00-958F-4B9A-901D-1AC522237412}"=""
"{DE164912-8F55-453D-AB05-EECE2F028371}"=""
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}"=""
"{C37031C3-A4DA-4433-A70A-AFD735BB42DE}"=""
"{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}"=""
"{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}"=""
"{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}"=""
"{618900C2-7E1A-4F78-9C73-DBC91607FB9D}"=""
"{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}"=""
"{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}"=""
"{9443DF74-6C07-4C5F-837B-5A6B1692656D}"=""
"{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}"=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}]
@=""
"IDEx"="ADDR"

[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}\InprocServer32]
@="C:\\WINDOWS\\system32\\cMtsrv.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}\InprocServer32]
@="C:\\WINDOWS\\system32\\jcmd400.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}\InprocServer32]
@="C:\\WINDOWS\\system32\\ktdgr.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}\InprocServer32]
@="C:\\WINDOWS\\system32\\msxclu.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}\InprocServer32]
@="C:\\WINDOWS\\system32\\mccorier.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}\InprocServer32]
@="C:\\WINDOWS\\system32\\clmdlg32.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}\InprocServer32]
@="C:\\WINDOWS\\system32\\mqtime.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}\InprocServer32]
@="C:\\WINDOWS\\system32\\whhisn.dll"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
ati2cqag.dll Wed 25 Jan 2006 4:10:38 A.... 258 048 252,00 K
ati2dvag.dll Wed 25 Jan 2006 4:52:48 A.... 255 488 249,50 K
ati2edxx.dll Wed 25 Jan 2006 4:46:50 A.... 41 472 40,50 K
ati2evxx.dll Wed 25 Jan 2006 4:46:38 A.... 61 440 60,00 K
ati3duag.dll Wed 25 Jan 2006 4:36:50 A.... 2 604 128 2,48 M
atiddc.dll Wed 25 Jan 2006 4:44:58 A.... 53 248 52,00 K
atidemgr.dll Wed 25 Jan 2006 3:29:40 A.... 282 624 276,00 K
atiiiexx.dll Wed 25 Jan 2006 4:28:12 A.... 307 200 300,00 K
atikvmag.dll Wed 25 Jan 2006 4:16:50 A.... 151 552 148,00 K
atioglx1.dll Wed 25 Jan 2006 4:30:28 A.... 6 684 672 6,38 M
atioglxx.dll Wed 25 Jan 2006 4:13:54 A.... 5 115 904 4,88 M
atipdlxx.dll Wed 25 Jan 2006 4:47:18 A.... 114 688 112,00 K
atitvo32.dll Wed 25 Jan 2006 4:16:08 A.... 17 408 17,00 K
ativvaxx.dll Wed 25 Jan 2006 4:30:18 A.... 860 192 840,03 K
divx.dll Thu 26 Jan 2006 19:36:02 A.... 574 976 561,50 K
divxwm~1.dll Tue 24 Jan 2006 19:08:30 A.... 12 288 12,00 K
divx_x~1.dll Thu 26 Jan 2006 19:36:00 A.... 679 936 664,00 K
divx_x~2.dll Thu 26 Jan 2006 19:36:00 A.... 679 936 664,00 K
divx_x~3.dll Thu 26 Jan 2006 19:36:00 A.... 663 552 648,00 K
dpl100.dll Mon 9 Jan 2006 20:32:02 A.... 86 016 84,00 K
dpu10.dll Mon 9 Jan 2006 20:32:02 A.... 294 912 288,00 K
dpu11.dll Mon 9 Jan 2006 20:32:02 A.... 294 912 288,00 K
dpugui11.dll Mon 9 Jan 2006 20:32:02 A.... 593 920 580,00 K
dpus11.dll Mon 9 Jan 2006 20:32:02 A.... 339 968 332,00 K
dpv11.dll Mon 9 Jan 2006 20:32:02 A.... 57 344 56,00 K
dtu100.dll Mon 9 Jan 2006 20:32:02 A.... 200 704 196,00 K
i4lo0e~1.dll Sat 18 Feb 2006 14:07:16 ..S.R 234 183 228,69 K
k0260a~1.dll Sat 18 Feb 2006 14:05:40 ..S.R 237 195 231,63 K
oemdspif.dll Wed 25 Jan 2006 4:47:04 A.... 77 824 76,00 K
sirenacm.dll Tue 24 Jan 2006 19:34:24 A.... 118 784 116,00 K
whhisn.dll Sat 18 Feb 2006 14:10:22 ..S.R 237 195 231,63 K

31 items found: 31 files (3 H/S), 0 directories.
Total of file sizes: 22 191 709 bytes 21,16 M
Locate .tmp files:

C:\WINDOWS\SYSTEM32\
guard.tmp Sat 18 Feb 2006 14:10:28 A.... 234 131 228,64 K

1 item found: 1 file, 0 directories.
Total of file sizes: 234 131 bytes 228,64 K
**********************************************************************************
Directory Listing of system files:
Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est C81C-1F92

R‚pertoire de C:\WINDOWS\System32

18/02/2006 14:10 237ÿ195 whhisn.dll
18/02/2006 14:07 234ÿ183 i4lo0e33eh.dll
18/02/2006 14:05 237ÿ195 k0260afsed260.dll
18/02/2006 13:49 <REP> dllcache
3 fichier(s) 708ÿ573 octets
1 R‚p(s) 53ÿ991ÿ952ÿ384 octets libres

Bon bah voilà, je vous ai donné les rapports sur le messages précédents, et pour l'instant, j'ai toujours les pages internets qui s'ouvrent toutes les 5 min :p.

Merci quand même de l'aide, c vraiment sympa, que dois je faire now ??

Bah voilà, j'ai fais ce que vous m'aviez dit, mais bon ca marche toujours pas snif, ces pages internets s'ouvrent toujours toutes les cinq minutes.
Je dois par contre signaler qu'il m'a été impossible de supprimer les trois fichiers que tu as dit, car ils n'ont pas été trouvé (bizar quand je c que svxhost, il é bel et bien dans l'ordi). Enfin, je vous dit tout ki pourrait vs etre utile .

Merci encore de votre aide, et que dois je faire maintenant ?

nan nan je n'ai pas eu le tps de faire la manipulation, enfin maintenant si. Je pensais que mon message ne s'affichait pas alors j'en avais fait un 2eme et en plus j'avais oublié de parler des fichiers non supprimé. Désolé s'il y a eu une mauvaise compréhension. Toujours est il que maintenant je viens de relancer l2mfix.bat et voici le rapport en choississant l'option 2

L2mfix 010406
Creating Account.
La commande s'est termin‚e correctement.

Adding Administrative privleges.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful

Running From:
C:\WINDOWS\system32

Killing Processes!

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 440 'smss.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 560 'winlogon.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1760 'explorer.exe'
Killing PID 1760 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1220 'rundll32.exe'
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrateurs ... successful

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
Deleting: C:\WINDOWS\system32\iHsads.dll
Successfully Deleted: C:\WINDOWS\system32\iHsads.dll
Deleting: C:\WINDOWS\system32\iuetmib1.dll
Successfully Deleted: C:\WINDOWS\system32\iuetmib1.dll
Deleting: C:\WINDOWS\system32\lvr0099me.dll
Successfully Deleted: C:\WINDOWS\system32\lvr0099me.dll
Deleting: C:\WINDOWS\system32\p0p60a7sed.dll
Successfully Deleted: C:\WINDOWS\system32\p0p60a7sed.dll
Deleting: C:\WINDOWS\system32\pamjpg21.dll
Successfully Deleted: C:\WINDOWS\system32\pamjpg21.dll
Deleting: C:\WINDOWS\system32\whhisn.dll
Successfully Deleted: C:\WINDOWS\system32\whhisn.dll
Deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp

msg11?.dll
0 fichier(s) copi‚(s).

Restoring Windows Update Certificates.:

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SharedDLLs]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\lvr0099me.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

The following are the files found:
****************************************************************************
C:\WINDOWS\system32\iHsads.dll
C:\WINDOWS\system32\iuetmib1.dll
C:\WINDOWS\system32\lvr0099me.dll
C:\WINDOWS\system32\p0p60a7sed.dll
C:\WINDOWS\system32\pamjpg21.dll
C:\WINDOWS\system32\whhisn.dll
C:\WINDOWS\system32\guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}]
@=""
"IDEx"="ADDR"

[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}\InprocServer32]
@="C:\\WINDOWS\\system32\\cMtsrv.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}\InprocServer32]
@="C:\\WINDOWS\\system32\\jcmd400.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}\InprocServer32]
@="C:\\WINDOWS\\system32\\ktdgr.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}\InprocServer32]
@="C:\\WINDOWS\\system32\\msxclu.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}\InprocServer32]
@="C:\\WINDOWS\\system32\\mccorier.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}\InprocServer32]
@="C:\\WINDOWS\\system32\\clmdlg32.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}\InprocServer32]
@="C:\\WINDOWS\\system32\\mqtime.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}\InprocServer32]
@="C:\\WINDOWS\\system32\\whhisn.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{7E44E393-51C8-41F7-A0EC-889769420A16}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7E44E393-51C8-41F7-A0EC-889769420A16}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7E44E393-51C8-41F7-A0EC-889769420A16}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7E44E393-51C8-41F7-A0EC-889769420A16}\InprocServer32]
@="C:\\WINDOWS\\system32\\iHsads.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{E004A98C-FA99-4C68-BC55-33B50BF19977}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E004A98C-FA99-4C68-BC55-33B50BF19977}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E004A98C-FA99-4C68-BC55-33B50BF19977}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E004A98C-FA99-4C68-BC55-33B50BF19977}\InprocServer32]
@="C:\\WINDOWS\\system32\\pamjpg21.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{256C44BD-6B1C-47A0-861B-2A116BC4FBAE}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{256C44BD-6B1C-47A0-861B-2A116BC4FBAE}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{256C44BD-6B1C-47A0-861B-2A116BC4FBAE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{256C44BD-6B1C-47A0-861B-2A116BC4FBAE}\InprocServer32]
@="C:\\WINDOWS\\system32\\iuetmib1.dll"
"ThreadingModel"="Apartment"

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{1768500D-8668-40FA-A94E-A3FF196EE7FA}"=-
"{84B3EB00-958F-4B9A-901D-1AC522237412}"=-
"{DE164912-8F55-453D-AB05-EECE2F028371}"=-
"{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}"=-
"{C37031C3-A4DA-4433-A70A-AFD735BB42DE}"=-
"{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}"=-
"{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}"=-
"{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}"=-
"{618900C2-7E1A-4F78-9C73-DBC91607FB9D}"=-
"{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}"=-
"{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}"=-
"{9443DF74-6C07-4C5F-837B-5A6B1692656D}"=-
"{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}"=-
"{7E44E393-51C8-41F7-A0EC-889769420A16}"=-
"{E004A98C-FA99-4C68-BC55-33B50BF19977}"=-
"{256C44BD-6B1C-47A0-861B-2A116BC4FBAE}"=-
[-HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}]
[-HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}]
[-HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}]
[-HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}]
[-HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}]
[-HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}]
[-HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}]
[-HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}]
[-HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}]
[-HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}]
[-HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}]
[-HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}]
[-HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}]
[-HKEY_CLASSES_ROOT\CLSID\{7E44E393-51C8-41F7-A0EC-889769420A16}]
[-HKEY_CLASSES_ROOT\CLSID\{E004A98C-FA99-4C68-BC55-33B50BF19977}]
[-HKEY_CLASSES_ROOT\CLSID\{256C44BD-6B1C-47A0-861B-2A116BC4FBAE}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
****************************************************************************
Desktop.ini Contents:
****************************************************************************

****************************************************************************
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
adding: dlls/guard.tmp (164 bytes security) (deflated 4%)
adding: dlls/iHsads.dll (164 bytes security) (deflated 6%)
adding: dlls/iuetmib1.dll (164 bytes security) (deflated 4%)
adding: dlls/lvr0099me.dll (164 bytes security) (deflated 4%)
adding: dlls/p0p60a7sed.dll (164 bytes security) (deflated 4%)
adding: dlls/pamjpg21.dll (164 bytes security) (deflated 6%)
adding: dlls/whhisn.dll (164 bytes security) (deflated 6%)
adding: backregs/1768500D-8668-40FA-A94E-A3FF196EE7FA.reg (212 bytes security) (deflated 69%)
adding: backregs/256C44BD-6B1C-47A0-861B-2A116BC4FBAE.reg (212 bytes security) (deflated 70%)
adding: backregs/4B0CEDDE-A42F-43D9-A15B-D6BA47196310.reg (212 bytes security) (deflated 70%)
adding: backregs/52AAC8C1-C512-4E61-BAFC-F84AF45AB877.reg (212 bytes security) (deflated 70%)
adding: backregs/618900C2-7E1A-4F78-9C73-DBC91607FB9D.reg (212 bytes security) (deflated 70%)
adding: backregs/61CBD7B2-A25B-49BE-A326-A2FC11B15DC7.reg (212 bytes security) (deflated 70%)
adding: backregs/7E44E393-51C8-41F7-A0EC-889769420A16.reg (212 bytes security) (deflated 70%)
adding: backregs/84B3EB00-958F-4B9A-901D-1AC522237412.reg (212 bytes security) (deflated 70%)
adding: backregs/9443DF74-6C07-4C5F-837B-5A6B1692656D.reg (212 bytes security) (deflated 70%)
adding: backregs/AD65B027-A9BD-4BF5-AA7C-6D04F48038DB.reg (212 bytes security) (deflated 70%)
adding: backregs/C37031C3-A4DA-4433-A70A-AFD735BB42DE.reg (212 bytes security) (deflated 70%)
adding: backregs/D25F1A6C-D09E-445D-8BCF-C5C37DBBF695.reg (212 bytes security) (deflated 70%)
adding: backregs/DDD2998D-E903-47F5-94A6-A8AA255F7FFE.reg (212 bytes security) (deflated 70%)
adding: backregs/DE164912-8F55-453D-AB05-EECE2F028371.reg (212 bytes security) (deflated 70%)
adding: backregs/E004A98C-FA99-4C68-BC55-33B50BF19977.reg (212 bytes security) (deflated 70%)
adding: backregs/F0EE6E86-C42A-4A5D-A83B-40950FD9A86A.reg (212 bytes security) (deflated 70%)
adding: backregs/notibac.reg (164 bytes security) (deflated 87%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)

Voilà, j'ai fais ce que tu viens de me suggerer, tout s'est apparament bien passé, et visiblement le problème se saurait résolé (je dis visiblement par encore sûr). Donc franchement, si ca confirmait, merci beaucoup à vous, ca fait plaisir de voire de voir que des personnes comme ca utilisent de leur tps perso pr aider les autres. Désolé les gars, je ne peux que vs remercier sans vous proposer un quelquonque retour. Enfin, voici tout de même le rapport, dites mwa si y'a encore quelque chose à faire. Si le pb persiste, je reviendrais sur le message, sinon je vous confirmerais que c bien fini disons ce soir ou demain :)

Logfile of HijackThis v1.99.1
Scan saved at 15:42:10, on 18/02/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Uilisateur\Mes documents\barre d'outil\logiciel nettoyage\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [KAVPersonal50]