Ouverture intempestive de internet explorer

Résolu
ripley38 -  
bonjour, ce sont mes premiers pas dans un forum, alors svp indiquez moi les erreurs de procedures eventuelles que je pourrais faire.
voila le pb :
j'ai des fenetres internet explorer qui s'ouvrent comme ca. depuis que j'ai réinstallé mon systeme.je vous donne 2 exemples que j'ai pensé à recopier.
http://www.hug-ediscounts.com/normal/yyy102.html
http://www.uniqueoffer-s.com/normal/yyy102.html
http://www.mediapurchases.com/normal/yyy65.html
http://www.winantivirus.com/?aid=mgwav5&lid=net

1 j'ai réinstallé mon systeme.
2 j'ai installé norton internet security
3 j'ai installé ma connec adsl

et là errorsafe est arrivé.
je suis allé sur le forum, j'ai téléchargé

ad aware
spybot
ewido.
je les ai fait tourner, ils m'ont trouvé des infections (je ne maitrise pas tres bien les techniques informatiques)
que j'ai fait supprimer.

1ere question : comment me débarrasser des fenetres qui s'ouvrent à tout va?

2eme question : ewido et norton peuvent ils cohabiter ?

merci

ripley38

18 réponses

  1.  ripley38 Auteur
    voila jano68
    le rapport de hijack this

    Logfile of HijackThis v1.99.1
    Scan saved at 18:24:29, on 01/03/2006
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
    C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Norton Internet Security\ISSVC.exe
    C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\ewido anti-malware\ewidoguard.exe
    C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    D:\telechargement\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.videoposte.com/statique/index.html
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [winsysupd] C:\\winsysupd12.exe
    O4 - HKLM\..\Run: [gimmygames] C:\\gimmygames12.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O20 - Winlogon Notify: SharedDLLs - C:\WINDOWS\system32\lvj0091me.dll
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
    O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
    O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

    ripley38
    1. ripley38 Auteur
      voila le rapport apres 12mfix

      L2MFIX find log 010406
      These are the registry keys present
      **********************************************************************************
      Winlogon/notify:
      Windows Registry Editor Version 5.00

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
      "Asynchronous"=dword:00000000
      "Impersonate"=dword:00000000
      "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
      6c,00,00,00
      "Logoff"="ChainWlxLogoffEvent"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
      "Asynchronous"=dword:00000000
      "Impersonate"=dword:00000000
      "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
      6c,00,6c,00,00,00
      "Logoff"="CryptnetWlxLogoffEvent"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
      "DLLName"="cscdll.dll"
      "Logon"="WinlogonLogonEvent"
      "Logoff"="WinlogonLogoffEvent"
      "ScreenSaver"="WinlogonScreenSaverEvent"
      "Startup"="WinlogonStartupEvent"
      "Shutdown"="WinlogonShutdownEvent"
      "StartShell"="WinlogonStartShellEvent"
      "Impersonate"=dword:00000000
      "Asynchronous"=dword:00000001

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
      "DLLName"="wlnotify.dll"
      "Logon"="SCardStartCertProp"
      "Logoff"="SCardStopCertProp"
      "Lock"="SCardSuspendCertProp"
      "Unlock"="SCardResumeCertProp"
      "Enabled"=dword:00000001
      "Impersonate"=dword:00000001
      "Asynchronous"=dword:00000001

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
      "Asynchronous"=dword:00000000
      "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
      6c,00,6c,00,00,00
      "Impersonate"=dword:00000000
      "StartShell"="SchedStartShell"
      "Logoff"="SchedEventLogOff"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
      "Logoff"="WLEventLogoff"
      "Impersonate"=dword:00000000
      "Asynchronous"=dword:00000001
      "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
      6c,00,6c,00,00,00

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
      "DLLName"="WlNotify.dll"
      "Lock"="SensLockEvent"
      "Logon"="SensLogonEvent"
      "Logoff"="SensLogoffEvent"
      "Safe"=dword:00000001
      "MaxWait"=dword:00000258
      "StartScreenSaver"="SensStartScreenSaverEvent"
      "StopScreenSaver"="SensStopScreenSaverEvent"
      "Startup"="SensStartupEvent"
      "Shutdown"="SensShutdownEvent"
      "StartShell"="SensStartShellEvent"
      "PostShell"="SensPostShellEvent"
      "Disconnect"="SensDisconnectEvent"
      "Reconnect"="SensReconnectEvent"
      "Unlock"="SensUnlockEvent"
      "Impersonate"=dword:00000001
      "Asynchronous"=dword:00000001

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SharedDLLs]
      "Asynchronous"=dword:00000000
      "DllName"="C:\\WINDOWS\\system32\\lvj0091me.dll"
      "Impersonate"=dword:00000000
      "Logon"="WinLogon"
      "Logoff"="WinLogoff"
      "Shutdown"="WinShutdown"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
      "Asynchronous"=dword:00000000
      "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
      6c,00,6c,00,00,00
      "Impersonate"=dword:00000000
      "Logoff"="TSEventLogoff"
      "Logon"="TSEventLogon"
      "PostShell"="TSEventPostShell"
      "Shutdown"="TSEventShutdown"
      "StartShell"="TSEventStartShell"
      "Startup"="TSEventStartup"
      "MaxWait"=dword:00000258
      "Reconnect"="TSEventReconnect"
      "Disconnect"="TSEventDisconnect"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
      "DLLName"="wlnotify.dll"
      "Logon"="RegisterTicketExpiredNotificationEvent"
      "Logoff"="UnregisterTicketExpiredNotificationEvent"
      "Impersonate"=dword:00000001
      "Asynchronous"=dword:00000001

      **********************************************************************************
      useragent:
      Windows Registry Editor Version 5.00

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
      "{7981C5A0-BB8E-5A22-C5DB-6D37B3227FC8}"=""

      **********************************************************************************
      Shell Extension key:
      Windows Registry Editor Version 5.00

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
      "{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"
      "{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"
      "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"
      "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"
      "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
      "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
      "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"
      "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration"
      "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"
      "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"
      "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚"
      "{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement"
      "{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"
      "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows"
      "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"
      "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"
      "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers"
      "{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web"
      "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
      "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"
      "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"
      "{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal"
      "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
      "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
      "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"
      "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
      "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
      "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"
      "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"
      "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau"
      "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau"
      "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo"
      "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo"
      "{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo"
      "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo"
      "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo"
      "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
      "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Extension feuille de propri‚t‚ de mise … jour automatique"
      "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows"
      "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft"
      "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
      "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
      "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"
      "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer"
      "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher"
      "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
      "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
      "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..."
      "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
      "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique"
      "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices"
      "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration"
      "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
      "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
      "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
      "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
      "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
      "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
      "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"
      "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement"
      "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"
      "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"
      "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
      "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"
      "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche"
      "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
      "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"
      "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"
      "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"
      "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
      "{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"
      "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"
      "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
      "{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"
      "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"
      "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
      "{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"
      "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses"
      "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"
      "{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"
      "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"
      "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"
      "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
      "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"
      "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
      "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"
      "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"
      "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
      "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
      "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
      "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
      "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
      "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
      "{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique"
      "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
      "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
      "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
      "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"
      "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
      "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
      "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
      "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
      "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
      "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
      "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
      "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
      "{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache"
      "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
      "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
      "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription"
      "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
      "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
      "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
      "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
      "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
      "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
      "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
      "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement"
      "{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es"
      "{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin"
      "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
      "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
      "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI"
      "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)"
      "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML"
      "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
      "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web"
      "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web"
      "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell"
      "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport"
      "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs"
      "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
      "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
      "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne"
      "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne"
      "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
      "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
      "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
      "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
      "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
      "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
      "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
      "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
      "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
      "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
      "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
      "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
      "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
      "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
      "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
      "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
      "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
      "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
      "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
      "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
      "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
      "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"
      "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
      "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
      "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
      "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
      "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
      "{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."
      "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
      "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
      "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
      "{9CEB8C67-CAE4-4FA7-9C6F-C5C73B1DA080}"=""
      "{7CC960E0-E995-4773-AC71-3124591A9A46}"=""
      "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Dossiers Web"
      "{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
      "{33F7642B-3B07-40B9-8722-DBB1BBF84975}"=""
      "{FD9C2CA0-CB74-4721-847E-0AB0879F28CD}"=""
      "{5693005C-AFB7-4277-B491-18787A23381E}"=""
      "{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}"=""

      **********************************************************************************
      HKEY ROOT CLASSIDS:
      Windows Registry Editor Version 5.00

      [HKEY_CLASSES_ROOT\CLSID\{5693005C-AFB7-4277-B491-18787A23381E}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{5693005C-AFB7-4277-B491-18787A23381E}\Implemented Categories]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{5693005C-AFB7-4277-B491-18787A23381E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{5693005C-AFB7-4277-B491-18787A23381E}\InprocServer32]
      @="C:\\WINDOWS\\system32\\lurt.dll"
      "ThreadingModel"="Apartment"

      Windows Registry Editor Version 5.00

      [HKEY_CLASSES_ROOT\CLSID\{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}\Implemented Categories]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}\InprocServer32]
      @="C:\\WINDOWS\\system32\\guard.tmp"
      "ThreadingModel"="Apartment"

      **********************************************************************************
      Files Found are not all bad files:

      C:\WINDOWS\SYSTEM32\
      lvj009~1.dll Wed 1 Mar 2006 10:32:20 A.... 236 546 231,00 K
      n0n60a~1.dll Wed 1 Mar 2006 18:18:44 ..S.R 237 196 231,64 K
      s32evnt1.dll Tue 31 Jan 2006 14:35:34 A.... 91 904 89,75 K

      3 items found: 3 files (1 H/S), 0 directories.
      Total of file sizes: 565 646 bytes 552,39 K
      Locate .tmp files:

      C:\WINDOWS\SYSTEM32\
      __dele~1.tmp Wed 1 Mar 2006 18:47:04 ..... 236 546 231,00 K

      1 item found: 1 file, 0 directories.
      Total of file sizes: 236 546 bytes 231,00 K
      **********************************************************************************
      Directory Listing of system files:
      Le volume dans le lecteur C n'a pas de nom.
      Le num‚ro de s‚rie du volume est 30DD-01F3

      R‚pertoire de C:\WINDOWS\System32

      01/03/2006 18:46 <REP> dllcache
      01/03/2006 18:18 237ÿ196 n0n60a5sed.dll
      28/02/2006 13:41 <REP> Microsoft
      1 fichier(s) 237ÿ196 octets
      2 R‚p(s) 37ÿ853ÿ556ÿ736 octets libres

      a+
      1. boulepate
        Salut,

        Relance L2MFIX et choisis l'option 2, colles le rapport ici, quand il aura redemarré puis mets un nouveau rapport hijackthis

        A++
    2. Utilisateur anonyme
      salut rypley38 bienvenue sur ccm

      les url que tu affiche sont des spywares...

      charge hijackthis

      http://www.01net.com/telecharger/windows/Internet/internet_utlitaire/fiches/29061.html
      - Installe le dans son propre dossier.
      Par exemple, C:\HijackThis
      Choisis l'option "do a scan and a logfile", il va te générer un rapport, copie et colle sur le forum.
      Regarde la démo : http://pageperso.aol.fr/balltrap34/demohijack.htm

      ton anti virus??? ( tu parles de norton internet security qui est un firewal) ewido est considere comme anti trojan, spy, donc pas de probl. de cohabitation avec 1 AV)

      ccleanner
      http://www.ccleaner.com/
      fais un nettoyage

      cleanup40 ( pour virer les temp)laisse la config originale et passe le

      http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
      voir demo
      http://pageperso.aol.fr/balltrap34/democleanup.htm

      avast 4 home ( bon anti virus et gratuit)
      http://www.avast.com/i_kat_207.php?lang=FRE
      fais 1 scan (vire tout ce qu il va trouver)

      envoie le rapport hjt stp a+
      1. ripley38 Auteur
        merci jano68
        j'ai imprimé ta réponse, jevais faire ce que tu me dits
        et je te répondrai + tard.
        il est l'heure d'aller manger alors je reporte tout ca à + tard.

        merci je te tiens au courant

        ripley 38
      2. P.Y.T
        Slt jano!
        J'ai le mm pb de s fenêtres intempestives, pourrais je t'envoyer le rapport hitjack?
        De plus, je n'arrive pas a télécharger ccleaner, jai fait un activscan, il y a des fichiers infectés, mais évidemment il faut payer pour désinfecter! je ne sais pas comment m'en débarrasser!
        Merci d'avance pour ton aide!
    3. Utilisateur anonyme
      re

      coches les cases devant ces lignes avec hijackthis et fix checked

      O4 - HKLM\..\Run: [winsysupd] C:\\winsysupd12.exe
      O4 - HKLM\..\Run: [gimmygames] C:\\gimmygames12.exe
      O20 - Winlogon Notify: SharedDLLs - C:\WINDOWS\system32\lvj0091me.dll

      Affiches tous les fichiers
      ==============================
      panneau de config. / Options des dossiers / Affichage
      coches "afficher les fichiers cachés"
      décoches "masquer les extensions des types connus"
      décoches "masquer les fichiers protégés du système d'exploitation"

      charges ce log
      smitfraud fix
      http://siri.urz.free.fr/Fix/SmitfraudFix.zip
      L'exécuter, puis double-cliquer sur Smitfraudfix.cmd
      Choisir l’option 1, il va générer un rapport
      Copie-colle ce dernier dans un message sur le forum.
      En image :
      http://siri.urz.free.fr/Fix/SmitfraudFix.php

      12mfix
      l2mfix.exe sur http://www.downloads.subratam.org/l2mfix.exe
      - Quitte le net, le navigateur, et toutes autres fenêtres d'applications ;
      - Dézippe l2mfix.exe sur le bureau ;
      - Dans le dossier du programme, double-cliquer sur l2mfix.bat ;
      - Choisir OPTION 1 (Run find log) et valider par la touche [Entrée] ;
      => Un rapport sera généré dans le Bloc-notes, se reconnecter et le poster ici

      a+
      1. ripley38 Auteur
        bon merci j'imprime ta réponse et je vais appliquer tes indiquations.
        a+
      2. ripley38 Auteur
        a jano 38
        est ce que je dois me déconnecter et débrancher mon rj 45 avant de faire ceque tu me dits?
    5. ripley38 Auteur
      voila le rapport
      par contre quand j'ai relancé hijackthis il n'y avait plus que la ligne
      020 winlogon nitify.................

      SmitFraudFix v2.21

      Rapport fait à 20:32:43,23 le 01/03/2006
      Executé à partir de D:\telechargement\SmitfraudFix\SmitfraudFix
      OS: Microsoft Windows XP [version 5.1.2600]

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche ...\Application Data

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau

      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
      "Source"="About:Home"
      "SubscribedURL"="About:Home"
      "FriendlyName"="Ma page d'accueil"

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler

      SrchSTS.exe by S!Ri
      Search SharedTaskScheduler's .dll

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
      "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"

      [HKEY_CLASSES_ROOT\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
      @="%SystemRoot%\System32\browseui.dll"

      [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
      @="%SystemRoot%\System32\browseui.dll"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
      "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

      [HKEY_CLASSES_ROOT\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
      @="%SystemRoot%\System32\browseui.dll"

      [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
      @="%SystemRoot%\System32\browseui.dll"

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

      »»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport

      voila ....
      1. ripley38 Auteur
        L2mfix 010406
        Creating Account.
        La commande s'est termin‚e correctement.

        Adding Administrative privleges.
        Checking for L2MFix account(0=no 1=yes):
        1
        Granting SeDebugPrivilege to L2MFIX ... successful

        Running From:
        C:\WINDOWS\system32

        Killing Processes!

        Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
        Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
        Killing PID 572 'smss.exe'

        Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
        Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
        Killing PID 668 'winlogon.exe'
        Killing PID 668 'winlogon.exe'
        Killing PID 668 'winlogon.exe'

        Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
        Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
        Killing PID 4032 'explorer.exe'

        Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
        Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
        Killing PID 2248 'rundll32.exe'
        Restoring Sedebugprivilege:
        Granting SeDebugPrivilege to Administrateurs ... successful

        Scanning First Pass. Please Wait!

        First Pass Completed

        Second Pass Scanning

        Second pass Completed!
        1 fichier(s) copi‚(s).
        1 fichier(s) copi‚(s).
        1 fichier(s) copi‚(s).
        Deleting: C:\WINDOWS\system32\lvj0091me.dll
        Successfully Deleted: C:\WINDOWS\system32\lvj0091me.dll
        Deleting: C:\WINDOWS\system32\n0n60a5sed.dll
        Successfully Deleted: C:\WINDOWS\system32\n0n60a5sed.dll
        Deleting: C:\WINDOWS\system32\__delete_on_reboot__guard.tmp
        Successfully Deleted: C:\WINDOWS\system32\__delete_on_reboot__guard.tmp

        msg11?.dll
        0 fichier(s) copi‚(s).

        Restoring Windows Update Certificates.:

        The following Is the Current Export of the Winlogon notify key:
        ****************************************************************************
        Windows Registry Editor Version 5.00

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
        "Asynchronous"=dword:00000000
        "Impersonate"=dword:00000000
        "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
        6c,00,00,00
        "Logoff"="ChainWlxLogoffEvent"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
        "Asynchronous"=dword:00000000
        "Impersonate"=dword:00000000
        "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
        6c,00,6c,00,00,00
        "Logoff"="CryptnetWlxLogoffEvent"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
        "DLLName"="cscdll.dll"
        "Logon"="WinlogonLogonEvent"
        "Logoff"="WinlogonLogoffEvent"
        "ScreenSaver"="WinlogonScreenSaverEvent"
        "Startup"="WinlogonStartupEvent"
        "Shutdown"="WinlogonShutdownEvent"
        "StartShell"="WinlogonStartShellEvent"
        "Impersonate"=dword:00000000
        "Asynchronous"=dword:00000001

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
        "DLLName"="wlnotify.dll"
        "Logon"="SCardStartCertProp"
        "Logoff"="SCardStopCertProp"
        "Lock"="SCardSuspendCertProp"
        "Unlock"="SCardResumeCertProp"
        "Enabled"=dword:00000001
        "Impersonate"=dword:00000001
        "Asynchronous"=dword:00000001

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
        "Asynchronous"=dword:00000000
        "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
        6c,00,6c,00,00,00
        "Impersonate"=dword:00000000
        "StartShell"="SchedStartShell"
        "Logoff"="SchedEventLogOff"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
        "Logoff"="WLEventLogoff"
        "Impersonate"=dword:00000000
        "Asynchronous"=dword:00000001
        "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
        6c,00,6c,00,00,00

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
        "DLLName"="WlNotify.dll"
        "Lock"="SensLockEvent"
        "Logon"="SensLogonEvent"
        "Logoff"="SensLogoffEvent"
        "Safe"=dword:00000001
        "MaxWait"=dword:00000258
        "StartScreenSaver"="SensStartScreenSaverEvent"
        "StopScreenSaver"="SensStopScreenSaverEvent"
        "Startup"="SensStartupEvent"
        "Shutdown"="SensShutdownEvent"
        "StartShell"="SensStartShellEvent"
        "PostShell"="SensPostShellEvent"
        "Disconnect"="SensDisconnectEvent"
        "Reconnect"="SensReconnectEvent"
        "Unlock"="SensUnlockEvent"
        "Impersonate"=dword:00000001
        "Asynchronous"=dword:00000001

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SharedDLLs]
        "Asynchronous"=dword:00000000
        "DllName"="C:\\WINDOWS\\system32\\lvj0091me.dll"
        "Impersonate"=dword:00000000
        "Logon"="WinLogon"
        "Logoff"="WinLogoff"
        "Shutdown"="WinShutdown"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
        "Asynchronous"=dword:00000000
        "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
        6c,00,6c,00,00,00
        "Impersonate"=dword:00000000
        "Logoff"="TSEventLogoff"
        "Logon"="TSEventLogon"
        "PostShell"="TSEventPostShell"
        "Shutdown"="TSEventShutdown"
        "StartShell"="TSEventStartShell"
        "Startup"="TSEventStartup"
        "MaxWait"=dword:00000258
        "Reconnect"="TSEventReconnect"
        "Disconnect"="TSEventDisconnect"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
        "DLLName"="wlnotify.dll"
        "Logon"="RegisterTicketExpiredNotificationEvent"
        "Logoff"="UnregisterTicketExpiredNotificationEvent"
        "Impersonate"=dword:00000001
        "Asynchronous"=dword:00000001

        The following are the files found:
        ****************************************************************************
        C:\WINDOWS\system32\lvj0091me.dll
        C:\WINDOWS\system32\n0n60a5sed.dll
        C:\WINDOWS\system32\__delete_on_reboot__guard.tmp

        Registry Entries that were Deleted:
        Please verify that the listing looks ok.
        If there was something deleted wrongly there are backups in the backreg folder.
        ****************************************************************************
        Windows Registry Editor Version 5.00

        [HKEY_CLASSES_ROOT\CLSID\{5693005C-AFB7-4277-B491-18787A23381E}]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{5693005C-AFB7-4277-B491-18787A23381E}\Implemented Categories]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{5693005C-AFB7-4277-B491-18787A23381E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{5693005C-AFB7-4277-B491-18787A23381E}\InprocServer32]
        @="C:\\WINDOWS\\system32\\lurt.dll"
        "ThreadingModel"="Apartment"

        Windows Registry Editor Version 5.00

        [HKEY_CLASSES_ROOT\CLSID\{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}\Implemented Categories]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}\InprocServer32]
        @="C:\\WINDOWS\\system32\\guard.tmp"
        "ThreadingModel"="Apartment"

        REGEDIT4

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
        "{9CEB8C67-CAE4-4FA7-9C6F-C5C73B1DA080}"=-
        "{7CC960E0-E995-4773-AC71-3124591A9A46}"=-
        "{33F7642B-3B07-40B9-8722-DBB1BBF84975}"=-
        "{FD9C2CA0-CB74-4721-847E-0AB0879F28CD}"=-
        "{5693005C-AFB7-4277-B491-18787A23381E}"=-
        "{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}"=-
        [-HKEY_CLASSES_ROOT\CLSID\{9CEB8C67-CAE4-4FA7-9C6F-C5C73B1DA080}]
        [-HKEY_CLASSES_ROOT\CLSID\{7CC960E0-E995-4773-AC71-3124591A9A46}]
        [-HKEY_CLASSES_ROOT\CLSID\{33F7642B-3B07-40B9-8722-DBB1BBF84975}]
        [-HKEY_CLASSES_ROOT\CLSID\{FD9C2CA0-CB74-4721-847E-0AB0879F28CD}]
        [-HKEY_CLASSES_ROOT\CLSID\{5693005C-AFB7-4277-B491-18787A23381E}]
        [-HKEY_CLASSES_ROOT\CLSID\{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}]
        REGEDIT4

        [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
        ****************************************************************************
        Desktop.ini Contents:
        ****************************************************************************

        voila le rapport option 2 de l2mfix******************************************************

        **********************
        Checking for L2MFix account(0=no 1=yes):
        0
        Zipping up files for submission:
        adding: dlls/lvj0091me.dll (164 bytes security) (deflated 5%)
        adding: dlls/n0n60a5sed.dll (164 bytes security) (deflated 5%)
        adding: dlls/__delete_on_reboot__guard.tmp (164 bytes security) (deflated 5%)
        adding: backregs/264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6.reg (212 bytes security) (deflated 70%)
        adding: backregs/5693005C-AFB7-4277-B491-18787A23381E.reg (212 bytes security) (deflated 70%)
        adding: backregs/notibac.reg (164 bytes security) (deflated 87%)
        adding: backregs/shell.reg (164 bytes security) (deflated 73%)
        1. ripley38 Auteur
          voila le rapport de hijackthisLogfile of HijackThis v1.99.1
          Scan saved at 21:01:27, on 01/03/2006
          Platform: Windows XP SP1 (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
          C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
          C:\Program Files\Norton Internet Security\ISSVC.exe
          C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
          C:\WINDOWS\Explorer.EXE
          C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
          C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
          C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
          C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
          C:\WINDOWS\System32\ctfmon.exe
          C:\Program Files\Messenger\msmsgs.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\ewido anti-malware\ewidoctrl.exe
          C:\Program Files\ewido anti-malware\ewidoguard.exe
          C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
          C:\Program Files\Internet Explorer\iexplore.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
          D:\telechargement\HijackThis.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.videoposte.com/statique/index.html
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
          O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
          O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
          O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
          O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
          O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
          O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
          O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
          O20 - Winlogon Notify: SharedDLLs - C:\WINDOWS\system32\lvj0091me.dll (file missing)
          O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
          O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
          O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
          O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
          O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
          O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
          O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
          O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
          O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
          O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
          O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
          O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
          O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

          A+
          1. boulepate
            Re,

            ou en sont tes problémes?
        2. Utilisateur anonyme
          re

          non,te deconnecter tout simplement.

          ok pour smitfraud

          regarde dans ajout /supp des progr. si tu trouve ces 2 prog.

          winsysupd
          gimmygames

          si oui desinstaller

          - réouvres le dossier L2Mfix créé sur le bureau
          - doubles-cliquer sur L2Mfix.bat, choisir l'option 2 Run Fix (entrer 2) et appuies sur n'importe quelle touche pour redémarrer l'ordinateur
          Après redémarrage, le bureau et les icônes vont apparaître puis disparaître, c'est normal !
          - L2Mfix va rescanner le disque ; après 1 ou 2 minutes de recherche, ouverture du Bloc-note ; postes le contenu sur le forum

          fais 1 scan on line ici

          Bitdefender:
          http://www.bitdefender.fr
          envoie le rapport

          et 1 nouveau rapport hjt

          un peu long mais on y arrive

          a++
          1. ripley38 Auteur
            voila le rapport de l2mfix
            L2mfix 010406
            Creating Account.
            La commande s'est termin‚e correctement.

            Adding Administrative privleges.
            Checking for L2MFix account(0=no 1=yes):
            1
            Granting SeDebugPrivilege to L2MFIX ... successful

            Running From:
            C:\WINDOWS\system32

            Killing Processes!

            Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
            Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
            Killing PID 588 'smss.exe'

            Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
            Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
            Killing PID 672 'winlogon.exe'

            Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
            Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
            Killing PID 1956 'explorer.exe'

            Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
            Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
            Error, Cannot find a process with an image name of rundll32.exe
            Restoring Sedebugprivilege:
            Granting SeDebugPrivilege to Administrateurs ... successful

            Scanning First Pass. Please Wait!

            First Pass Completed

            Second Pass Scanning

            Second pass Completed!

            Restoring Windows Update Certificates.:

            The following Is the Current Export of the Winlogon notify key:
            ****************************************************************************
            Windows Registry Editor Version 5.00

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
            "Asynchronous"=dword:00000000
            "Impersonate"=dword:00000000
            "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
            6c,00,00,00
            "Logoff"="ChainWlxLogoffEvent"

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
            "Asynchronous"=dword:00000000
            "Impersonate"=dword:00000000
            "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
            6c,00,6c,00,00,00
            "Logoff"="CryptnetWlxLogoffEvent"

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
            "DLLName"="cscdll.dll"
            "Logon"="WinlogonLogonEvent"
            "Logoff"="WinlogonLogoffEvent"
            "ScreenSaver"="WinlogonScreenSaverEvent"
            "Startup"="WinlogonStartupEvent"
            "Shutdown"="WinlogonShutdownEvent"
            "StartShell"="WinlogonStartShellEvent"
            "Impersonate"=dword:00000000
            "Asynchronous"=dword:00000001

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
            "DLLName"="wlnotify.dll"
            "Logon"="SCardStartCertProp"
            "Logoff"="SCardStopCertProp"
            "Lock"="SCardSuspendCertProp"
            "Unlock"="SCardResumeCertProp"
            "Enabled"=dword:00000001
            "Impersonate"=dword:00000001
            "Asynchronous"=dword:00000001

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
            "Asynchronous"=dword:00000000
            "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
            6c,00,6c,00,00,00
            "Impersonate"=dword:00000000
            "StartShell"="SchedStartShell"
            "Logoff"="SchedEventLogOff"

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
            "Logoff"="WLEventLogoff"
            "Impersonate"=dword:00000000
            "Asynchronous"=dword:00000001
            "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
            6c,00,6c,00,00,00

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
            "DLLName"="WlNotify.dll"
            "Lock"="SensLockEvent"
            "Logon"="SensLogonEvent"
            "Logoff"="SensLogoffEvent"
            "Safe"=dword:00000001
            "MaxWait"=dword:00000258
            "StartScreenSaver"="SensStartScreenSaverEvent"
            "StopScreenSaver"="SensStopScreenSaverEvent"
            "Startup"="SensStartupEvent"
            "Shutdown"="SensShutdownEvent"
            "StartShell"="SensStartShellEvent"
            "PostShell"="SensPostShellEvent"
            "Disconnect"="SensDisconnectEvent"
            "Reconnect"="SensReconnectEvent"
            "Unlock"="SensUnlockEvent"
            "Impersonate"=dword:00000001
            "Asynchronous"=dword:00000001

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SharedDLLs]
            "Asynchronous"=dword:00000000
            "DllName"="C:\\WINDOWS\\system32\\lvj0091me.dll"
            "Impersonate"=dword:00000000
            "Logon"="WinLogon"
            "Logoff"="WinLogoff"
            "Shutdown"="WinShutdown"

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
            "Asynchronous"=dword:00000000
            "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
            6c,00,6c,00,00,00
            "Impersonate"=dword:00000000
            "Logoff"="TSEventLogoff"
            "Logon"="TSEventLogon"
            "PostShell"="TSEventPostShell"
            "Shutdown"="TSEventShutdown"
            "StartShell"="TSEventStartShell"
            "Startup"="TSEventStartup"
            "MaxWait"=dword:00000258
            "Reconnect"="TSEventReconnect"
            "Disconnect"="TSEventDisconnect"

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
            "DLLName"="wlnotify.dll"
            "Logon"="RegisterTicketExpiredNotificationEvent"
            "Logoff"="UnregisterTicketExpiredNotificationEvent"
            "Impersonate"=dword:00000001
            "Asynchronous"=dword:00000001

            The following are the files found:
            ****************************************************************************

            Registry Entries that were Deleted:
            Please verify that the listing looks ok.
            If there was something deleted wrongly there are backups in the backreg folder.
            ****************************************************************************
            REGEDIT4

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
            REGEDIT4

            [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
            ****************************************************************************
            Desktop.ini Contents:
            ****************************************************************************
            ****************************************************************************
            Checking for L2MFix account(0=no 1=yes):
            0
            Zipping up files for submission:
            adding: dlls/lvj0091me.dll (164 bytes security) (deflated 5%)
            adding: dlls/n0n60a5sed.dll (164 bytes security) (deflated 5%)
            adding: dlls/__delete_on_reboot__guard.tmp (164 bytes security) (deflated 5%)
            adding: backregs/264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6.reg (212 bytes security) (deflated 70%)
            adding: backregs/5693005C-AFB7-4277-B491-18787A23381E.reg (212 bytes security) (deflated 70%)
            adding: backregs/notibac.reg (164 bytes security) (deflated 87%)
            adding: backregs/shell.reg (164 bytes security) (deflated 74%)
            1. ripley38 Auteur
              voila le rapport de bitdefender
              <HTML>
              <HEAD>
              <TITLE>BitDefender Online Scanner - Rapport d'analyse</TITLE>
              <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
              </HEAD>
              <BODY BGCOLOR=#FFFFFF leftmargin="10" marginwidth="0" topmargin="20" marginheight="0" >

              <table align="center" border="0" cellpadding="0" cellspacing="0" width="90%">
              <tr>
              <td width="458">
              <p><font face="Arial" color=red><span style="font-size:14pt;"><b>BitDefender Online Scanner</b></span></font></p>
              </td>
              <td width="40%">
              <p> </p>
              </td>
              <td width="10%">
              <p> </p>
              </td>
              </tr>
              <tr>
              <td colspan="3" width="912">
              <p><font face="Arial"><span style="font-size:11pt;"><B>Rapport d'analyse généré à: Wed, Mar 01, 2006 - 22:31:49</b></span></font></p>
              </td>
              </tr>

              <tr>
              <td width="458">
              <p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
              </td>
              <td width="40%">
              <p> </p>
              </td>
              <td width="10%">
              <p> </p>
              </td>
              </tr>

              <tr>
              <td width="458">
              <p><font face="Arial"><span style="font-size:11pt;"><B>Voie d'analyse: </b></span><span style="font-size:10pt;">A:\;C:\;D:\;E:\;F:\;</span></font></p>
              </td>
              <td width="40%">
              <p> </p>
              </td>
              <td width="10%">
              <p> </p>
              </td>
              </tr>

              <tr>
              <td width="458">
              <p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
              </td>
              <td width="40%">
              <p> </p>
              </td>
              <td width="10%">
              <p> </p>
              </td>
              </tr>

              <tr>
              <td width="458">
              <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
              <tr>
              <td width="451" colspan="2" bgcolor="#CCCCCC">
              <p><font face="Arial" size="2"><B>Statistiques</b></font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Temps</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">00:51:40</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Fichiers</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">254297</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Directoires</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">874</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Secteurs de boot</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">4</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Archives</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">754</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Paquets programmes</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">40411</font></p>
              </td>
              </tr>
              </table>
              </td>
              <td width="40%">
              <p> </p>
              </td>
              <td width="10%">
              <p> </p>
              </td>
              </tr>

              <tr>
              <td width="458">
              <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
              <tr>
              <td width="451" colspan="2" bgcolor="#CCCCCC">
              <p><font face="Arial" size="2"><B>Résultats</b></font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Virus identifiés</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">18</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Fichiers infectés</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">58</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Fichiers suspects</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">0</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Avertissements</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">0</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Désinfectés</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">0</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Fichiers effacés</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">99</font></p>
              </td>
              </tr>
              </table>
              </td>
              <td width="40%">
              <p> </p>
              </td>
              <td width="10%">
              <p> </p>
              </td>
              </tr>

              <tr>
              <td width="458">
              <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
              <tr>
              <td width="451" colspan="2" bgcolor="#CCCCCC">
              <p><font face="Arial" size="2"><B>Info sur les moteurs</b></font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Définition virus</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">289403</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Version des moteurs</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">AVCORE v1.0 (build 2292) (i386) (Mar 3 2005 11:57:29)</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Analyse des plugins</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">13</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Archive des plugins</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">39</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Unpack des plugins</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">4</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">E-mail plugins</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">6</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Système plugins</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">1</font></p>
              </td>
              </tr>
              </table>
              </td>
              <td width="40%">
              <p> </p>
              </td>
              <td width="10%">
              <p> </p>
              </td>
              </tr>

              <tr>
              <td width="458">
              <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
              <tr>
              <td width="451" colspan="2" bgcolor="#CCCCCC">
              <p><font face="Arial" size="2"><B>Paramètres d'analyse</b></font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Première action</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">Désinfecté</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Seconde Action</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Heuristique</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">Oui</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Acceptez les avertissements</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">Oui</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Extensions analysées</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">*;</font></p>
              </td>
              </tr>

              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Excludez les extensions</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2"> </font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Analyse d'emails</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">Oui</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Analyse des Archives</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">Oui</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Analyser paquets programmes</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">Oui</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Analyse des fichiers</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">Oui</font></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">Analyse de boot</font></p>
              </td>
              <td width="43%" align="right">
              <p><font face="Arial" size="2">Oui</font></p>
              </td>
              </tr>
              </table>
              </td>
              <td width="40%">
              <p> </p>
              </td>
              <td width="10%">
              <p> </p>
              </td>
              </tr>

              <tr>
              <td colspan=2>  
              <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
              <tr>
              <td width="252" bgcolor="#CCCCCC">
              <p><font face="Arial" size="2"><B>Fichier analysé</b></font></p>
              </td>
              <td width="195" bgcolor="#CCCCCC" align="right">
              <p align="left"><b><font size="2" face="Arial"> Statut</font></b></p>
              </td>
              </tr>
              <tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Documents and Settings\bensaou\Bureau\l2mfix\backup.zip=>dlls/lvj0091me.dll</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Détecté avec: Adware.Dinky.A.Trojan</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Documents and Settings\bensaou\Bureau\l2mfix\backup.zip=>dlls/lvj0091me.dll</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Documents and Settings\bensaou\Bureau\l2mfix\backup.zip</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Mis à jour</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Documents and Settings\bensaou\Bureau\l2mfix\backup.zip=>dlls/n0n60a5sed.dll</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Détecté avec: Adware.Dinky.A.Trojan</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Documents and Settings\bensaou\Bureau\l2mfix\backup.zip=>dlls/n0n60a5sed.dll</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Documents and Settings\bensaou\Bureau\l2mfix\backup.zip</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Mis à jour</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Documents and Settings\bensaou\Bureau\l2mfix\backup.zip=>dlls/__delete_on_reboot__guard.tmp</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Détecté avec: Adware.Dinky.A.Trojan</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Documents and Settings\bensaou\Bureau\l2mfix\backup.zip=>dlls/__delete_on_reboot__guard.tmp</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Documents and Settings\bensaou\Bureau\l2mfix\backup.zip</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Mis à jour</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Documents and Settings\bensaou\Bureau\l2mfix\dlls\lvj0091me.dll</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Détecté avec: Adware.Dinky.A.Trojan</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Documents and Settings\bensaou\Bureau\l2mfix\dlls\lvj0091me.dll</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Documents and Settings\bensaou\Bureau\l2mfix\dlls\n0n60a5sed.dll</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Détecté avec: Adware.Dinky.A.Trojan</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Documents and Settings\bensaou\Bureau\l2mfix\dlls\n0n60a5sed.dll</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Documents and Settings\bensaou\Bureau\l2mfix\dlls\__delete_on_reboot__guard.tmp</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Détecté avec: Adware.Dinky.A.Trojan</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Documents and Settings\bensaou\Bureau\l2mfix\dlls\__delete_on_reboot__guard.tmp</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\DR21206.exe</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Dropped:Trojan.Clicker.Small.G</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\DR21206.exe</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Echec de la désinfection</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\DR21206.exe</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0C5F1398.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Trojan.Canbede.L</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0C5F1398.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Echec de la désinfection</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0C5F1398.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\26604593.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Backdoor.Sdbot.AIG</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\26604593.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Echec de la désinfection</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\26604593.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\34AA22EF.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Trojan.Downloader.Agent.FE</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\34AA22EF.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Echec de la désinfection</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\34AA22EF.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\395B39F5.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Trojan.Canbede.L</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\395B39F5.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Echec de la désinfection</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\395B39F5.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\3E8C10F9.dll=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Trojan.Clicker.Small.G</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\3E8C10F9.dll=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Echec de la désinfection</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\3E8C10F9.dll=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\44EB75F4.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Trojan.Downloader.Small.BUY</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\44EB75F4.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49B268B5.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Trojan.Proxy.493</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49B268B5.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Echec de la désinfection</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49B268B5.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49B93CAD.avi=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Trojan.Dropper.Agent.AAC</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49B93CAD.avi=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49BF10A6.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Trojan.Downloader.TSUpdate.L</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49BF10A6.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49C6649F.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Trojan.Downloader.TSUpdate.P</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49C6649F.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49CC3898.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Trojan.Downloader.Tsupdate.N</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49CC3898.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Echec de la désinfection</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49CC3898.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49D9608A.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Trojan.Downloader.Tsupdate.F</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49D9608A.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Echec de la désinfection</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49D9608A.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49F4306D.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Trojan.Proxy.493</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49F4306D.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Echec de la désinfection</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49F4306D.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49F75A69.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Trojan.Dropper.Agent.AAC</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49F75A69.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49FA0466.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Trojan.Downloader.Agent.FE</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49FA0466.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Echec de la désinfection</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49FA0466.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A04025B.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Trojan.Downloader.Small.BUY</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A04025B.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A0E0050.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Trojan.Downloader.Tsupdate.O</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A0E0050.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Echec de la désinfection</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A0E0050.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A145449.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Trojan.Downloader.Tsupdate.O</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A145449.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Echec de la désinfection</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A145449.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A1E523E.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Trojan.Downloader.Tsupdate.N</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A1E523E.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Echec de la désinfection</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A1E523E.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7B942B6F.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Backdoor.Rbot.AEM</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7B942B6F.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Echec de la désinfection</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7B942B6F.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7F2317F4.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Trojan.Dropper.Agent.AAC</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7F2317F4.exe=>(Quarantine-2)</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP3\A0000405.dll</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Détecté avec: Adware.Dinky.A.Trojan</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP3\A0000405.dll</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP3\A0000421.exe</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: GenPack:Backdoor.RBot.E3DB09FB</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP3\A0000421.exe</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Echec de la désinfection</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP3\A0000421.exe</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP3\A0000422.dll</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Détecté avec: Adware.Dinky.A.Trojan</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP3\A0000422.dll</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP3\A0000433.exe</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Infecté par: Trojan.Downloader.Smar.M</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP3\A0000433.exe</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Echec de la désinfection</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP3\A0000433.exe</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP4\A0000444.dll</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Détecté avec: Adware.Dinky.A.Trojan</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP4\A0000444.dll</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP4\A0000445.dll</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Détecté avec: Adware.Dinky.A.Trojan</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP4\A0000445.dll</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP4\A0000503.dll</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Détecté avec: Adware.Dinky.A.Trojan</font></p>
              </td>
              </tr><tr>
              <td width="57%">
              <p><font face="Arial" size="2">C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP4\A0000503.dll</font></p>
              </td>
              <td width="43%" align="left">
              <p><font face="Arial" size="2">Supprimé</font></p>
              </td>
              </tr><tr&g
              1. ripley38 Auteur
                voila le rapport le hijackthis
                Logfile of HijackThis v1.99.1
                Scan saved at 22:36:47, on 01/03/2006
                Platform: Windows XP SP1 (WinNT 5.01.2600)
                MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
                C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
                C:\WINDOWS\Explorer.EXE
                C:\Program Files\Norton Internet Security\ISSVC.exe
                C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
                C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
                C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
                C:\WINDOWS\System32\ctfmon.exe
                C:\Program Files\Messenger\msmsgs.exe
                C:\WINDOWS\system32\spoolsv.exe
                C:\Program Files\Internet Explorer\iexplore.exe
                C:\Program Files\ewido anti-malware\ewidoctrl.exe
                C:\Program Files\ewido anti-malware\ewidoguard.exe
                C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
                C:\WINDOWS\System32\svchost.exe
                C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
                D:\telechargement\HijackThis.exe

                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.videoposte.com/statique/index.html
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
                O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
                O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
                O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
                O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
                O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
                O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
                O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
                O20 - Winlogon Notify: SharedDLLs - C:\WINDOWS\system32\lvj0091me.dll (file missing)
                O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
                O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
                O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
                O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
                O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
                O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
                O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
                O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
                O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
                O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
                O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
                O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

                du chinois pour moi, mais si quand j'espere tout sera résolu, pourras tu m'expliquer succintement le principe et les differentes phases du nettoyage.
                merci a+
                ripley38
                1. Utilisateur anonyme
                  re
                  fixe cette ligne avec hijackthis
                  O20 - Winlogon Notify: SharedDLLs - C:\WINDOWS\system32\lvj0091me.dll (file missing)

                  desactive la
                  restauration systeme
                  dans..> pannean de configuration...> systeme...>restauration du systeme...>
                  coche la case ...>>>desactiver la restaur. system sur ts les lecteurs...<<<
                  fenetre d avertissements,,passe outre......et appliquer ...ok

                  vide la quarantaine de norton

                  demarre en mode sans echec

                  Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
                  Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
                  Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
                  (Si F8 ne marche pas utilise la touche F5)

                  recherche ce fichier et supp
                  C:\WINDOWS\system32\===>lvj0091me.dll

                  repasse ewido

                  envoie 1 rapport hijack a+
                  2. ripley38 Auteur
                    excuse je suis allé dans norton , j'ai trouvé les rapports de quarantaine.
                    par contre, je n'ai rien en quarantaine.
                    donc là je continue la suite avec le redémarrage.
                    a+
                    1. ripley38 Auteur
                      j'ai redémarré en mode ss echec
                      recherche de lvj0091me.dll rien trouvé
                      recherche de lv*.* tjrs pas trouvé

                      j'ai lancé ewido
                      et voila le rapport hijack
                      Logfile of HijackThis v1.99.1
                      Scan saved at 00:06:17, on 02/03/2006
                      Platform: Windows XP SP1 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
                      C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\Program Files\Norton Internet Security\ISSVC.exe
                      C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
                      C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
                      C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                      C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
                      C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
                      C:\WINDOWS\System32\ctfmon.exe
                      C:\Program Files\Messenger\msmsgs.exe
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\Program Files\ewido anti-malware\ewidoctrl.exe
                      C:\Program Files\ewido anti-malware\ewidoguard.exe
                      C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
                      D:\telechargement\HijackThis.exe

                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.videoposte.com/statique/index.html
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
                      O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
                      O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
                      O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
                      O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
                      O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
                      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
                      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                      O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                      O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                      O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
                      O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                      O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
                      O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
                      O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
                      O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
                      O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
                      O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
                      O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
                      O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
                      O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
                      O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
                      O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
                      O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

                      a+
                      ripley 38
                      3. Utilisateur anonyme
                        re
                        termine!!

                        recache tes doss/fichiers
                        reactive la restaur.systeme

                        ne garde qu un seul AV .. ok pour norton et 1 seul firewal NIS ok

                        merci pour hjt chez zeb.. j ai fr.et anglais

                        mets ton windows a jour ( sp2) micros.windows update, pour ton info tu peux commander le cd ( sp2 ) (plus simple a installer)
                        si probl n hesites pas.....

                        salut bon surf.

                        Discussions similaires

                        FOTOSE (allemagne)
                        lix

                        13 réponses
                        Virus USB-Explorer
                        TheDiglo

                        1 réponse