[WinAntivirus 2006] Fermé

Question

Bonjour,

Je suis une nouvelle victime de Winfixer qui m'envoie à chaque ouverture d'Internet Explorer des popups intempestifs. Comme je vois que c'est de coutume ici, je vous joins un log. Sinon des mesages de Windows me disent que je pourrais être infecté par un virus appellé Blackworm. Et je n'arrive pas à supprimer mon anti-virus Symantec qui ne fonctionne plus bien (mais ça n'a peut-être rien à voir).

J'ai installé Spybot 1.4, Ad-Aware, a-squared, CCleaner, ClenUp!, Ewido. J'ai scanné avec tous sauf a-squared que je n'arrive à connecter au serveur à l'installation. Sinon je n'arrive pas non plus à mettre à jour Ad-Aware.

Mais Winfixer est toujours là. Pouvez-vous me dire si d'autres logiciels sont efficaces, ou si vous désirez un log de HijackThis.

Merci d'avance, Sharlow.

boulepate · Answer

Salut,Oui, nous voulons bien un rapport hijackthis ;-)

Sharlow · Answer

Voilà le log.@+, Sharlow.Logfile of HijackThis v1.99.1Scan saved at 10:15:22, on 27/02/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\system32\spoolsv.exeC:\Acer\eManager\anbmServ.exeC:\Program Files\Symantec AntiVirus\DefWatch.exeC:\Program Files\FileZilla Server\FileZilla Server.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\ZONELABS\vsmon.exeC:\WINDOWS\system32\wscntfy.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\WINDOWS\system32undll32.exeC:\Program Files\Arcade\PCMService.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\acer\epm\epm-dm.exeC:\Program Files\Launch Manager\QtZgAcer.EXEC:\Program Files\Java\j2re1.4.2_04\bin\jusched.exeC:\PROGRA~1\SYMANT~1\vptray.exeC:\Program Files\Lexmark X1100 Series\lxbkbmgr.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\Lexmark X1100 Series\lxbkbmon.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Microsoft AntiSpyware\gcasServ.exeC:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeC:\Program Files\Microsoft AntiSpyware\gcasDtServ.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\acer\eRecovery\Monitor.exeC:\Program Files\ATnotes\ATnotes.exeC:\Program Files\qRezix\qrezix.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Real\RealPlayer\RealPlay.exeC:\Documents and Settings\CMC\Bureau\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.polytechnique.fr/eleves/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.fr/R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://frankiz/proxy.pacR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: (no name) - <default> - (no file)O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: ATLDistrib Object - {2353FCBC-012D-487B-8BF3-865C0929FBEB} - C:\WINDOWS\system32\jkhff.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dllO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dllO4 - HKLM\..\Run: [LaunchApp] AlaunchO4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exeO4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgentO4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNCO4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNCO4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMENameO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exeO4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe bootO4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXEO4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exeO4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\vptray.exeO4 - HKLM\..\Run: [FileZilla Server Interface] "C:\Program Files\FileZilla Server\FileZilla Server Interface.exe"O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [pdfc] C:\Program Files\Adolix\Adolix PDF Converter\pdfcload.exeO4 - HKLM\..\Run: [NI.UWFX5V_0001_N57M1412] "C:\Documents and Settings\CMC\Menu Démarrer\Dossier CMC\Téléchargements\WinFixer2005 tél.exe" -nag O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [NI.UWA6P_0001_N56M1001] "C:\Documents and Settings\CMC\Local Settings\Temporary Internet Files\Content.IE5\CDAF0XYZ\WinAntiVirusPro2006Installer[1].exe" -nag O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeO4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -uO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [ATnotes.exe] C:\Program Files\ATnotes\ATnotes.exeO4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /backgroundO4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\Steam.exe -silentO4 - Startup: qRezix.lnk = C:\Program Files\qRezix\qrezix.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO8 - Extra context menu item: Web Rebates. - file://C:\Program Files\WebRebates4\websrebates\webtrebates	oprC0.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin
pjpi142_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin
pjpi142_04.dllO9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htmO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1127542363843O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{2E56A1F0-820E-4005-A6BF-AC63F801B262}: Domain = eleves.polytechnique.frO17 - HKLM\System\CCS\Services\Tcpip\..\{2E56A1F0-820E-4005-A6BF-AC63F801B262}: NameServer = 129.104.201.53,129.104.201.51O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = eleves.polytechnique.fr,polytechnique.frO17 - HKLM\System\CS1\Services\Tcpip\..\{2E56A1F0-820E-4005-A6BF-AC63F801B262}: Domain = eleves.polytechnique.frO17 - HKLM\System\CS1\Services\Tcpip\..\{2E56A1F0-820E-4005-A6BF-AC63F801B262}: NameServer = 129.104.201.53,129.104.201.51O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = eleves.polytechnique.fr,polytechnique.frO20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO20 - Winlogon Notify: jkhff - C:\WINDOWS\system32\jkhff.dllO20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dllO23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exeO23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: FileZilla Server FTP server (FileZilla Server) - Unknown owner - C:\Program Files\FileZilla Server\FileZilla Server.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exeO23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

Sharlow · Answer

Salut Boulepate,
Merci pour tes instructions, je les ai suivies. Voilà les rapports.
@+, Sharlow.

[03/03/2006, 18:49:08] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\CMC\Menu Démarrer\Dossier CMC\Téléchargements\VirtumundoBeGone tél.exe" )
[03/03/2006, 18:49:21] - Detected System Information:
[03/03/2006, 18:49:21] - Windows Version: 5.1.2600, Service Pack 2
[03/03/2006, 18:49:21] - Current Username: CMC (Admin)
[03/03/2006, 18:49:21] - Windows is in NORMAL mode.
[03/03/2006, 18:49:21] - Searching for Browser Helper Objects:
[03/03/2006, 18:49:21] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[03/03/2006, 18:49:21] - BHO 2: {2353FCBC-012D-487B-8BF3-865C0929FBEB} (ATLDistrib Object)
[03/03/2006, 18:49:21] - ALERT: Found ATLDistrib Object!
[03/03/2006, 18:49:21] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[03/03/2006, 18:49:21] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/03/2006, 18:49:21] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[03/03/2006, 18:49:21] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[03/03/2006, 18:49:21] - BHO 4: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[03/03/2006, 18:49:21] - BHO 5: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
[03/03/2006, 18:49:21] - Finished Searching Browser Helper Objects
[03/03/2006, 18:49:21] - *** Detected ATLDistrib Object
[03/03/2006, 18:49:21] - Trying to remove ATLDistrib Object...
[03/03/2006, 18:49:22] - Terminating Process: IEXPLORE.EXE
[03/03/2006, 18:49:23] - Terminating Process: RUNDLL32.EXE
[03/03/2006, 18:49:23] - Disabling Automatic Shell Restart
[03/03/2006, 18:49:23] - Terminating Process: EXPLORER.EXE
[03/03/2006, 18:49:23] - Suspending the NT Session Manager System Service
[03/03/2006, 18:49:23] - Terminating Windows NT Logon/Logoff Manager
[03/03/2006, 18:49:24] - Re-enabling Automatic Shell Restart
[03/03/2006, 18:49:24] - File to disable: C:\WINDOWS\system32\jkhff.dll
[03/03/2006, 18:49:24] - Renaming C:\WINDOWS\system32\jkhff.dll -> C:\WINDOWS\system32\jkhff.dll.vir
[03/03/2006, 18:49:24] - File successfully renamed!
[03/03/2006, 18:49:24] - Removing HKLM\...\Browser Helper Objects\{2353FCBC-012D-487B-8BF3-865C0929FBEB}
[03/03/2006, 18:49:24] - Removing HKCR\CLSID\{2353FCBC-012D-487B-8BF3-865C0929FBEB}
[03/03/2006, 18:49:24] - Adding Kill Bit for ActiveX for GUID: {2353FCBC-012D-487B-8BF3-865C0929FBEB}
[03/03/2006, 18:49:24] - Deleting ATLEvents/MSEvents Registry entries
[03/03/2006, 18:49:24] - Removing HKLM\...\Winlogon\Notify\jkhff
[03/03/2006, 18:49:24] - Searching for Browser Helper Objects:
[03/03/2006, 18:49:24] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[03/03/2006, 18:49:24] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} ()
[03/03/2006, 18:49:24] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/03/2006, 18:49:24] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[03/03/2006, 18:49:24] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[03/03/2006, 18:49:24] - BHO 3: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[03/03/2006, 18:49:24] - BHO 4: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
[03/03/2006, 18:49:24] - Finished Searching Browser Helper Objects
[03/03/2006, 18:49:24] - Finishing up...
[03/03/2006, 18:49:24] - A restart is needed.
[03/03/2006, 18:49:41] - Attempting to Restart via STOP error (Blue Screen!)

Logfile of HijackThis v1.99.1
Scan saved at 18:56:44, on 03/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\FileZilla Server\FileZilla Server.exe
C:\MATLAB6p5\webserver\bin\win32\matlabserver.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Arcade\PCMService.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\svchost.exe
C:\acer\epm\epm-dm.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\PROGRA~1\SYMANT~1\vptray.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\ATnotes\ATnotes.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\CMC\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.polytechnique.fr/eleves/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.fr/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://frankiz/proxy.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - <default> - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [FileZilla Server Interface] "C:\Program Files\FileZilla Server\FileZilla Server Interface.exe"
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [pdfc] C:\Program Files\Adolix\Adolix PDF Converter\pdfcload.exe
O4 - HKLM\..\Run: [NI.UWA6P_0001_N56M1001] "C:\Documents and Settings\CMC\Local Settings\Temporary Internet Files\Content.IE5\CDAF0XYZ\WinAntiVirusPro2006Installer[1].exe" -nag
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [ATnotes.exe] C:\Program Files\ATnotes\ATnotes.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\Steam.exe -silent
O8 - Extra context menu item: Web Rebates. - file://C:\Program Files\WebRebates4\websrebates\webtrebates\toprC0.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1127542363843
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2E56A1F0-820E-4005-A6BF-AC63F801B262}: Domain = eleves.polytechnique.fr
O17 - HKLM\System\CCS\Services\Tcpip\..\{2E56A1F0-820E-4005-A6BF-AC63F801B262}: NameServer = 129.104.201.53,129.104.201.51
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = eleves.polytechnique.fr,polytechnique.fr
O17 - HKLM\System\CS1\Services\Tcpip\..\{2E56A1F0-820E-4005-A6BF-AC63F801B262}: Domain = eleves.polytechnique.fr
O17 - HKLM\System\CS1\Services\Tcpip\..\{2E56A1F0-820E-4005-A6BF-AC63F801B262}: NameServer = 129.104.201.53,129.104.201.51
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = eleves.polytechnique.fr,polytechnique.fr
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - Unknown owner - C:\Program Files\FileZilla Server\FileZilla Server.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB6p5\webserver\bin\win32\matlabserver.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

[WinAntivirus 2006]

3 réponses

Discussions similaires