Probleme wingolon .exe
bj j ai un probleme au demarage de xp j ai le message d erreur suivant
probleme wingolon .exe depuis mon pc est lent je suis novice et besoin d aide merci a ce qui porront d aider
voici mon hijackthis
StartupList report, 07/02/2007, 08:37:33
StartupList version: 1.52.2
Started from : C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Media Connect\mswmcls.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\PROGRA~1\Medion\KeyStat\KeyStat.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\Dit.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\WINDOWS\system32\XCSyncML.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Windows Media Connect\mswmc.exe
C:\WINDOWS\explorer.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
--------------------------------------------------
Listing of startup folders:
Shell folders Startup:
[C:\Documents and Settings\descamps christine\Menu Démarrer\Programmes\Démarrage]
Ubisoft register.lnk = ?
Shell folders Common Startup:
[C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]
BlueSoleil.lnk = ?
DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cmaudio = RunDll32 cmicnfg.cpl,CMICtrlWnd
AGRSMMSG = AGRSMMSG.exe
avast! = C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
LVCOMSX = C:\WINDOWS\system32\LVCOMSX.EXE
LogitechVideoRepair = C:\Program Files\Logitech\Video\ISStart.exe
LogitechVideoTray = C:\Program Files\Logitech\Video\LogiTray.exe
RemoteControl = "C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe"
PCMService = "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
NeroFilterCheck = C:\WINDOWS\system32\NeroCheck.exe
Keyboard Status = C:\PROGRA~1\Medion\KeyStat\KeyStat.exe
HP Software Update = C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
HP Component Manager = "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
Dit = Dit.exe
Lexmark X1100 Series = "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
eBayToolbar = C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
XCSyncML = C:\WINDOWS\system32\XCSyncML.exe
Adobe Photo Downloader = "C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe"
SunJavaUpdateSched = "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
EoEngine =
EoNet =
AdwareAlert = C:\Program Files\AdwareAlert\AdwareAlert.exe -boot
itch download meta play = C:\Documents and Settings\All Users\Application Data\Mail ace itch download\Lies Test.exe
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
LogitechSoftwareUpdate = "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
ATI Launchpad = "C:\Program Files\ATI Multimedia\main\launchpd.exe"
ATI DeviceDetect = C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
updateMgr = "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
mix enc = C:\DOCUME~1\DESCAM~1\APPLIC~1\CDROMW~1\Camp Mail.exe
--------------------------------------------------
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=
SCRNSAVE.EXE=C:\WINDOWS\system32\BUTTER~1.SCR
drivers=
Shell & screensaver key from Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\logon.scr
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*
--------------------------------------------------
Enumerating Browser Helper Objects:
(no name) - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD}
EoRezoBHO - C:\PROGRA~1\eoRezo\EoAdv\EOREZO~1.DLL (file missing) - {64F56FC1-1272-44CD-BA6E-39723696E350}
(no name) - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
(no name) - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll - {9030D464-4C02-4ABF-8ECC-5164760863C6}
(no name) - c:\program files\google\googletoolbar4.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}
--------------------------------------------------
Enumerating Task Scheduler jobs:
AF1F836791C43387.job
At12.job
At13.job
At14.job
At3.job
At5.job
At6.job
WebReg 20050403184959.job
--------------------------------------------------
Enumerating Download Program Files:
[Checkers Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\msgrchkr.dll
CODEBASE = http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
[MessengerStatsClient Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll
CODEBASE = http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
[ewidoOnlineScan Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\EWIDOO~1.DLL
CODEBASE = http://downloads.ewido.net/ewidoOnlineScan.cab
[CoGSManager Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\GSManager.dll
CODEBASE = http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
[Minesweeper Flags Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\minesweeper.dll
CODEBASE = http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
[MessengerStatsClient Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\messengerstatsclient.dll
CODEBASE = http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx
CODEBASE = http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
[Solitaire Showdown Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\solitaireshowdown.dll
CODEBASE = http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
--------------------------------------------------
Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*
Windows NT checkdisk command:
BootExecute = autocheck autochk *
Windows NT 'Wininit.ini':
PendingFileRenameOperations: c:\documents and settings\le compte de didine\cookies\le compte de didine@adserver.aol[2].txt||c:\documents and settings\le compte de didine\cookies\le compte de didine@metriweb[1].txt||C:\DOCUME~1\DESCAM~1\LOCALS~1\Temp\_iu14D2N.tmp|||i
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll
--------------------------------------------------
End of report, 10 546 bytes
Report generated in 0,063 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
probleme wingolon .exe depuis mon pc est lent je suis novice et besoin d aide merci a ce qui porront d aider
voici mon hijackthis
StartupList report, 07/02/2007, 08:37:33
StartupList version: 1.52.2
Started from : C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Media Connect\mswmcls.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\PROGRA~1\Medion\KeyStat\KeyStat.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\Dit.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\WINDOWS\system32\XCSyncML.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Windows Media Connect\mswmc.exe
C:\WINDOWS\explorer.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
--------------------------------------------------
Listing of startup folders:
Shell folders Startup:
[C:\Documents and Settings\descamps christine\Menu Démarrer\Programmes\Démarrage]
Ubisoft register.lnk = ?
Shell folders Common Startup:
[C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]
BlueSoleil.lnk = ?
DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cmaudio = RunDll32 cmicnfg.cpl,CMICtrlWnd
AGRSMMSG = AGRSMMSG.exe
avast! = C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
LVCOMSX = C:\WINDOWS\system32\LVCOMSX.EXE
LogitechVideoRepair = C:\Program Files\Logitech\Video\ISStart.exe
LogitechVideoTray = C:\Program Files\Logitech\Video\LogiTray.exe
RemoteControl = "C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe"
PCMService = "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
NeroFilterCheck = C:\WINDOWS\system32\NeroCheck.exe
Keyboard Status = C:\PROGRA~1\Medion\KeyStat\KeyStat.exe
HP Software Update = C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
HP Component Manager = "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
Dit = Dit.exe
Lexmark X1100 Series = "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
eBayToolbar = C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
XCSyncML = C:\WINDOWS\system32\XCSyncML.exe
Adobe Photo Downloader = "C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe"
SunJavaUpdateSched = "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
EoEngine =
EoNet =
AdwareAlert = C:\Program Files\AdwareAlert\AdwareAlert.exe -boot
itch download meta play = C:\Documents and Settings\All Users\Application Data\Mail ace itch download\Lies Test.exe
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
LogitechSoftwareUpdate = "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
ATI Launchpad = "C:\Program Files\ATI Multimedia\main\launchpd.exe"
ATI DeviceDetect = C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
updateMgr = "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
mix enc = C:\DOCUME~1\DESCAM~1\APPLIC~1\CDROMW~1\Camp Mail.exe
--------------------------------------------------
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=
SCRNSAVE.EXE=C:\WINDOWS\system32\BUTTER~1.SCR
drivers=
Shell & screensaver key from Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\logon.scr
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*
--------------------------------------------------
Enumerating Browser Helper Objects:
(no name) - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD}
EoRezoBHO - C:\PROGRA~1\eoRezo\EoAdv\EOREZO~1.DLL (file missing) - {64F56FC1-1272-44CD-BA6E-39723696E350}
(no name) - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
(no name) - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll - {9030D464-4C02-4ABF-8ECC-5164760863C6}
(no name) - c:\program files\google\googletoolbar4.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}
--------------------------------------------------
Enumerating Task Scheduler jobs:
AF1F836791C43387.job
At12.job
At13.job
At14.job
At3.job
At5.job
At6.job
WebReg 20050403184959.job
--------------------------------------------------
Enumerating Download Program Files:
[Checkers Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\msgrchkr.dll
CODEBASE = http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
[MessengerStatsClient Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll
CODEBASE = http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
[ewidoOnlineScan Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\EWIDOO~1.DLL
CODEBASE = http://downloads.ewido.net/ewidoOnlineScan.cab
[CoGSManager Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\GSManager.dll
CODEBASE = http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
[Minesweeper Flags Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\minesweeper.dll
CODEBASE = http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
[MessengerStatsClient Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\messengerstatsclient.dll
CODEBASE = http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx
CODEBASE = http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
[Solitaire Showdown Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\solitaireshowdown.dll
CODEBASE = http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
--------------------------------------------------
Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*
Windows NT checkdisk command:
BootExecute = autocheck autochk *
Windows NT 'Wininit.ini':
PendingFileRenameOperations: c:\documents and settings\le compte de didine\cookies\le compte de didine@adserver.aol[2].txt||c:\documents and settings\le compte de didine\cookies\le compte de didine@metriweb[1].txt||C:\DOCUME~1\DESCAM~1\LOCALS~1\Temp\_iu14D2N.tmp|||i
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll
--------------------------------------------------
End of report, 10 546 bytes
Report generated in 0,063 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
Configuration: Windows XP Firefox 2.0.0.1
4 réponses
-
Salut
Ton rapport hijackthis n'est pas entier !
Télécharge lopxp :
http://perso.numericable.fr/~altshift/Info/Fichiers/lopxpMH2.zip
dézippe-le sur ton bureau puis double-clic sur le fichier "lopxpMH.bat"
quand il a terminé, un rapport s'ouvre : fait un copier-coller du rapport puis mets le ici
-
merci pour essayer de m aider voici le reste
Rapport fait à 16:10:08,40 le 07/02/2007
******************************************
## Répertoires Application Data
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\All Users\Application Data
20/01/2005 15:26 <REP> .
20/01/2005 15:26 <REP> ..
25/01/2005 15:41 <REP> Adobe
25/01/2005 17:27 <REP> Ahead
26/01/2005 13:08 <REP> AOL
25/02/2006 00:12 <REP> ATI MMC
26/01/2005 12:24 <REP> Bluetooth
09/02/2006 03:20 <REP> BOONTY
24/03/2005 16:22 <REP> BVRP Software
05/02/2005 18:41 <REP> CyberLink
25/08/2006 15:34 <REP> DVD Shrink
01/12/2006 18:54 <REP> espionServerData
25/09/2006 17:40 <REP> Google
04/04/2005 13:31 <REP> Hewlett-Packard
16/06/2005 16:59 <REP> Macrovision
24/03/2006 20:39 <REP> Mail ace itch download
20/01/2005 15:26 <REP> Microsoft
26/01/2005 19:43 <REP> muvee Technologies
26/01/2005 11:41 <REP> QuickTime
20/01/2005 14:53 <REP> SBSI
16/01/2006 20:24 <REP> Spybot - Search & Destroy
04/02/2007 21:18 <REP> Symantec
05/02/2007 16:16 <REP> TEMP
13/11/2006 20:50 <REP> Trymedia
26/01/2005 13:08 <REP> Viewpoint
30/06/2006 02:22 <REP> Windows Genuine Advantage
09/12/2005 20:41 <REP> Yahoo! Companion
30/12/2006 15:02 <REP> Zylom
06/02/2007 04:07 3ÿ120 118300.34
20/01/2005 15:26 62 desktop.ini
29/03/2005 17:33 2ÿ698 hpzinstall.log
3 fichier(s) 5ÿ880 octets
28 R‚p(s) 10ÿ822ÿ144ÿ000 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\Default User\Application Data
20/01/2005 15:26 <REP> .
20/01/2005 15:26 <REP> ..
24/03/2005 16:16 <REP> Adobe
24/03/2005 16:16 <REP> AOL
24/03/2005 16:16 <REP> CyberLink
20/01/2005 14:33 <REP> Identities
24/03/2005 16:16 <REP> Macromedia
20/01/2005 15:26 <REP> Microsoft
24/03/2005 16:16 <REP> Real
24/03/2005 16:16 <REP> Sun
24/03/2005 16:16 <REP> You've Got Pictures Screensaver
20/01/2005 15:26 62 desktop.ini
1 fichier(s) 62 octets
11 R‚p(s) 10ÿ822ÿ144ÿ000 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\Default User\Local Settings\Application Data
20/01/2005 15:26 <REP> .
20/01/2005 15:26 <REP> ..
24/03/2005 16:16 <REP> {3248F0A6-6813-11D6-A77B-00B0D0150010}
24/03/2005 16:16 <REP> Adobe
24/03/2005 16:16 <REP> ApplicationHistory
20/01/2005 14:33 <REP> Microsoft
24/03/2005 16:16 <REP> PowerCinema
24/03/2005 16:16 <REP> WMTools Downloaded Files
24/03/2005 16:16 4ÿ608 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
24/03/2005 16:16 135 fusioncache.dat
24/03/2005 16:16 64ÿ152 GDIPFONTCACHEV1.DAT
24/03/2005 16:16 5ÿ876ÿ804 IconCache.db
4 fichier(s) 5ÿ945ÿ699 octets
8 R‚p(s) 10ÿ822ÿ131ÿ712 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\descamps christine\Application Data
24/03/2005 16:18 <REP> .
24/03/2005 16:18 <REP> ..
24/03/2005 16:18 <REP> Adobe
14/07/2005 20:06 <REP> AdobeUM
14/03/2006 18:37 <REP> Ahead
28/03/2005 13:38 <REP> Aim
19/05/2006 17:14 <REP> Alawar
24/03/2005 16:18 <REP> AOL
16/01/2006 22:24 <REP> ArcSoft
12/03/2006 20:03 <REP> ATI MMC
07/02/2007 08:06 <REP> BitDownload
07/02/2007 08:06 <REP> CdromWait
24/03/2005 16:18 <REP> CyberLink
25/08/2006 16:57 <REP> Elaborate Bytes
17/01/2007 18:41 <REP> EoRezo
24/12/2005 10:49 <REP> Google
08/04/2005 18:46 <REP> Help
24/03/2005 16:18 <REP> Identities
10/09/2005 09:59 <REP> La Bataille pour la Terre du Milieu
24/03/2005 21:57 <REP> Lavasoft
20/11/2006 18:11 <REP> Leadertech
24/03/2005 16:18 <REP> Macromedia
23/01/2007 13:22 <REP> MessengerSkinner
24/03/2005 16:18 <REP> Microsoft
24/03/2005 21:16 <REP> Mozilla
02/12/2006 11:41 <REP> Opera
05/02/2007 16:16 <REP> PC Tools
24/03/2005 16:18 <REP> Real
11/05/2006 02:07 <REP> SlySoft
24/03/2005 16:18 <REP> Sun
29/04/2005 16:17 <REP> Talkback
18/10/2005 15:25 <REP> WholeSecurity
30/06/2006 16:57 <REP> XCPCSync.OEM
24/03/2005 16:18 <REP> You've Got Pictures Screensaver
30/12/2006 15:03 <REP> Zylom
25/08/2006 16:52 125 .zreglib
24/03/2005 16:18 62 desktop.ini
31/03/2005 18:33 64ÿ944 GDIPFONTCACHEV1.DAT
25/06/2006 19:50 7ÿ512 GdiplusUpgrade_MSIApproach_Wrapper.log
23/01/2007 16:59 1ÿ858 HPCOM_48BitScanUpdate.log
05/02/2007 04:01 262 WinssCookie.txt
24/03/2005 16:48 29ÿ538 wklnhst.dat
7 fichier(s) 104ÿ301 octets
35 R‚p(s) 10ÿ822ÿ127ÿ616 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\descamps christine\Local Settings\Application Data
24/03/2005 16:18 <REP> .
24/03/2005 16:18 <REP> ..
24/03/2005 16:18 <REP> {3248F0A6-6813-11D6-A77B-00B0D0150010}
20/05/2005 22:24 <REP> ABBYY
24/03/2005 16:18 <REP> Adobe
13/07/2005 15:32 <REP> Ahead
23/01/2007 13:16 <REP> Alice ADSL
24/03/2005 16:18 <REP> ApplicationHistory
05/04/2005 06:33 <REP> Google
08/04/2005 18:46 <REP> Help
29/03/2005 18:14 <REP> HP
28/03/2005 18:26 <REP> Identities
09/05/2006 18:11 <REP> IM
29/03/2005 18:14 <REP> IsolatedStorage
19/11/2005 18:57 <REP> Logitech-LS
24/03/2005 16:18 <REP> Microsoft
07/03/2006 21:24 <REP> Mozilla
02/03/2006 18:31 <REP> NFS Underground 2
23/12/2005 20:21 <REP> Nikon
23/12/2005 20:21 <REP> Pixology
24/03/2005 16:18 <REP> PowerCinema
02/07/2006 13:09 <REP> SM
28/03/2005 13:38 <REP> Wildtangent
24/03/2005 16:18 <REP> WMTools Downloaded Files
24/03/2005 16:18 115ÿ200 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
24/03/2005 16:18 141 fusioncache.dat
24/03/2005 16:18 67ÿ376 GDIPFONTCACHEV1.DAT
24/03/2005 16:18 2ÿ113ÿ830 IconCache.db
4 fichier(s) 2ÿ296ÿ547 octets
24 R‚p(s) 10ÿ822ÿ127ÿ616 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\le compte de didine\Application Data
23/08/2006 14:09 <REP> .
23/08/2006 14:09 <REP> ..
23/08/2006 14:09 <REP> Adobe
23/08/2006 17:48 <REP> Aim
23/08/2006 14:09 <REP> AOL
23/08/2006 14:09 <REP> CyberLink
01/11/2006 16:12 <REP> Google
23/08/2006 14:09 <REP> Identities
23/08/2006 14:09 <REP> Macromedia
23/08/2006 14:09 <REP> Microsoft
23/08/2006 20:35 <REP> Mozilla
23/08/2006 14:09 <REP> Real
23/08/2006 14:09 <REP> Sun
23/08/2006 20:37 <REP> Talkback
23/08/2006 14:10 <REP> WholeSecurity
23/08/2006 14:09 <REP> You've Got Pictures Screensaver
23/08/2006 14:09 62 desktop.ini
1 fichier(s) 62 octets
16 R‚p(s) 10ÿ822ÿ123ÿ520 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\le compte de didine\Local Settings\Application Data
23/08/2006 14:09 <REP> .
23/08/2006 14:09 <REP> ..
23/08/2006 14:09 <REP> {3248F0A6-6813-11D6-A77B-00B0D0150010}
23/08/2006 14:09 <REP> Adobe
23/08/2006 14:09 <REP> ApplicationHistory
01/11/2006 16:12 <REP> Google
23/08/2006 14:10 <REP> HP
13/09/2006 22:46 <REP> Identities
23/08/2006 14:10 <REP> IsolatedStorage
23/08/2006 14:10 <REP> Logitech-LS
23/08/2006 14:09 <REP> Microsoft
23/08/2006 20:35 <REP> Mozilla
23/08/2006 14:09 <REP> PowerCinema
23/08/2006 14:09 <REP> WMTools Downloaded Files
23/08/2006 14:09 4ÿ608 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
23/08/2006 14:09 142 fusioncache.dat
23/08/2006 14:09 64ÿ944 GDIPFONTCACHEV1.DAT
23/08/2006 14:09 5ÿ876ÿ804 IconCache.db
4 fichier(s) 5ÿ946ÿ498 octets
14 R‚p(s) 10ÿ822ÿ123ÿ520 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\LocalService\Application Data
20/01/2005 14:35 <REP> .
20/01/2005 14:35 <REP> ..
30/03/2005 10:38 <REP> Help
30/03/2005 10:41 <REP> Macromedia
20/01/2005 14:35 <REP> Microsoft
12/09/2005 20:35 <REP> Mozilla
12/09/2005 20:35 <REP> Talkback
26/01/2005 19:22 <REP> X10 Commander
0 fichier(s) 0 octets
8 R‚p(s) 10ÿ822ÿ123ÿ520 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\LocalService\Local Settings\Application Data
20/01/2005 14:35 <REP> .
20/01/2005 14:35 <REP> ..
30/03/2005 10:38 <REP> Help
20/01/2005 14:35 <REP> Microsoft
08/03/2006 14:57 <REP> Mozilla
0 fichier(s) 0 octets
5 R‚p(s) 10ÿ822ÿ123ÿ520 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\NetworkService\Application Data
20/01/2005 14:35 <REP> .
20/01/2005 14:35 <REP> ..
20/01/2005 14:35 <REP> Microsoft
23/06/2006 03:45 <REP> X10 Commander
0 fichier(s) 0 octets
4 R‚p(s) 10ÿ822ÿ123ÿ520 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\NetworkService\Local Settings\Application Data
20/01/2005 14:35 <REP> .
20/01/2005 14:35 <REP> ..
30/04/2005 01:59 <REP> ApplicationHistory
20/01/2005 14:35 <REP> Microsoft
30/04/2005 01:59 137 fusioncache.dat
1 fichier(s) 137 octets
4 R‚p(s) 10ÿ822ÿ123ÿ520 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\Propri‚taire\Application Data
27/03/2005 22:02 <REP> .
27/03/2005 22:02 <REP> ..
09/06/2005 10:22 <REP> Real
27/03/2005 22:02 <REP> You've Got Pictures Screensaver
0 fichier(s) 0 octets
4 R‚p(s) 10ÿ822ÿ119ÿ424 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\WINDOWS\system32\config\systemprofile\Application Data
20/01/2005 14:35 <REP> .
20/01/2005 14:35 <REP> ..
24/03/2005 16:18 <REP> Adobe
24/03/2005 16:18 <REP> AOL
24/03/2005 16:18 <REP> CyberLink
20/01/2005 14:35 <REP> Identities
24/03/2005 16:18 <REP> Macromedia
20/01/2005 14:35 <REP> Microsoft
24/03/2005 16:18 <REP> Real
24/03/2005 16:18 <REP> Sun
24/03/2005 19:33 <REP> X10 Commander
24/03/2005 16:18 <REP> You've Got Pictures Screensaver
20/01/2005 14:35 62 desktop.ini
1 fichier(s) 62 octets
12 R‚p(s) 10ÿ822ÿ119ÿ424 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data
20/01/2005 14:35 <REP> .
20/01/2005 14:35 <REP> ..
24/03/2005 16:18 <REP> {3248F0A6-6813-11D6-A77B-00B0D0150010}
24/03/2005 16:18 <REP> Adobe
24/03/2005 16:18 <REP> ApplicationHistory
20/01/2005 14:35 <REP> Microsoft
24/03/2005 16:18 <REP> PowerCinema
24/03/2005 16:18 <REP> WMTools Downloaded Files
24/03/2005 16:18 4ÿ608 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
24/03/2005 16:18 135 fusioncache.dat
24/03/2005 16:18 64ÿ152 GDIPFONTCACHEV1.DAT
24/03/2005 16:18 5ÿ876ÿ804 IconCache.db
4 fichier(s) 5ÿ945ÿ699 octets
8 R‚p(s) 10ÿ822ÿ119ÿ424 octets libres
******************************************
Recherche des taches planifiées dans C:\WINDOWS\tasks
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\WINDOWS\Tasks
07/02/2007 08:07 296 AF1F836791C43387.job
26/10/2005 17:08 348 At14.job
26/10/2005 17:08 348 At13.job
26/10/2005 17:08 340 At12.job
21/10/2005 17:05 348 At6.job
21/10/2005 17:05 348 At5.job
21/10/2005 17:04 340 At3.job
03/04/2005 17:49 386 WebReg 20050403184959.job
20/01/2005 14:35 6 SA.DAT
20/01/2005 14:32 <REP> .
20/01/2005 14:32 <REP> ..
20/01/2005 14:21 65 desktop.ini
10 fichier(s) 2ÿ825 octets
2 R‚p(s) 10ÿ822ÿ119ÿ424 octets libres
******************************************
## Répertoires de Program files
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Program Files
07/02/2007 08:13 <REP> .
07/02/2007 08:13 <REP> ..
11/03/2006 15:25 <REP> 2015
12/03/2006 20:04 <REP> ABBYY FineReader 5.0 Sprint
08/10/2005 15:09 <REP> ABBYY FineReader 5.0 Sprint(2)
04/04/2005 02:40 <REP> ABBYY FineReader 6.0
28/01/2006 19:50 <REP> Activision
04/01/2007 04:11 <REP> Adobe
03/04/2005 07:58 <REP> Ahead
13/11/2005 12:12 <REP> AIM
13/03/2006 17:42 <REP> Algominds
27/11/2005 14:49 <REP> Alice_Triway_WiFi
19/10/2005 15:26 <REP> Alwil Software
24/10/2005 09:09 <REP> AOL 9.0
24/10/2005 09:09 <REP> AOL Compagnon
24/10/2005 09:09 <REP> AOL Toolbar
26/10/2005 15:28 <REP> Atari
24/02/2006 22:02 <REP> ATI Multimedia
20/01/2005 17:33 <REP> ATI Technologies
13/11/2006 20:49 <REP> BFG
07/02/2007 08:07 <REP> BitDownload
03/01/2007 10:12 <REP> Boonty
07/11/2006 04:05 <REP> BoontyGames
12/03/2006 20:03 <REP> Call of Duty
20/01/2005 17:50 <REP> Cardreader Software
16/01/2006 15:43 <REP> CCleaner
07/02/2007 08:06 <REP> CdromWait
08/02/2006 16:51 <REP> Codemasters
05/02/2005 18:14 <REP> Common Files
04/04/2005 02:40 <REP> ComPlus Applications
08/02/2006 16:53 <REP> Creative
03/04/2005 07:58 <REP> CyberLink
04/12/2006 03:49 <REP> DaemonTools_WhenUSave_Installer
04/04/2005 02:40 <REP> directx
01/02/2006 20:21 <REP> Disney Interactive
03/04/2005 07:58 <REP> DivX
03/12/2006 10:35 <REP> D-Tools
04/02/2007 17:57 <REP> DVD Region+CSS Free
25/08/2006 15:34 <REP> DVD Shrink
02/03/2006 18:28 <REP> EA GAMES
26/09/2005 19:19 <REP> EA SPORTS
27/06/2005 19:45 <REP> EACOM
27/01/2006 03:34 <REP> eBay
25/08/2006 22:27 <REP> Elaborate Bytes
24/04/2005 17:57 <REP> emme - Langues
07/02/2007 08:15 <REP> eMule
26/01/2005 10:23 <REP> Encarta
17/01/2007 19:10 <REP> eoRezo
03/11/2005 16:16 <REP> FaxTools
04/02/2007 21:20 <REP> Fichiers communs
28/03/2005 14:44 <REP> Fox
13/11/2006 20:56 <REP> Gamenext
12/03/2006 20:07 <REP> GameSpy Arcade
04/02/2007 21:20 <REP> Google
29/03/2005 17:37 <REP> Hewlett-Packard
20/01/2005 19:01 <REP> HighMAT CD Writing Wizard
07/02/2007 08:39 <REP> Hijackthis Version Fran‡aise
05/02/2005 18:41 <REP> Home Cinema
04/04/2005 13:31 <REP> HP
09/05/2006 18:13 <REP> IncrediMail
20/01/2005 15:49 <REP> Intel
16/12/2006 07:43 <REP> Internet Explorer
26/01/2005 12:18 <REP> IVT Corporation
09/01/2007 04:44 <REP> Java
30/11/2006 17:34 <REP> Kartracing
07/02/2007 07:08 <REP> Lavasoft
26/01/2005 13:08 <REP> Learn2.com
01/02/2007 12:39 <REP> Lexmark X1100 Series
19/11/2005 17:32 <REP> Logitech
28/02/2006 18:14 <REP> LucasArts
27/03/2006 02:50 <REP> Maxis
02/10/2006 16:54 <REP> MediaMobsters
22/10/2005 13:18 <REP> Medion
07/11/2006 04:05 <REP> Mes Jeux T‚l‚charg‚s
24/03/2005 17:37 <REP> Messenger
23/01/2007 13:06 <REP> Messenger Plus! Live
26/01/2005 10:25 <REP> Microsoft AutoRoute
20/01/2005 14:33 <REP> microsoft frontpage
15/04/2006 11:59 <REP> Microsoft Games
21/10/2006 10:51 <REP> Microsoft Money 2005
26/01/2005 10:16 <REP> Microsoft Office
05/02/2005 17:04 <REP> Microsoft Visual Studio
26/01/2005 10:17 <REP> Microsoft Works
26/01/2005 10:13 <REP> Microsoft Works Suite 2005
28/08/2006 11:22 <REP> Mihov Image Resizer
20/01/2005 14:32 <REP> Movie Maker
07/02/2007 16:03 <REP> Mozilla Firefox
14/07/2006 19:35 <REP> MP3 Player Utilities
09/04/2005 20:08 <REP> MSN
20/01/2005 14:31 <REP> MSN Gaming Zone
28/11/2006 11:56 <REP> MSN Messenger
18/11/2006 23:27 <REP> MSXML 4.0
26/01/2005 12:33 <REP> Musicmatch
26/01/2005 19:43 <REP> muvee Technologies
30/06/2006 16:52 <REP> NEC
30/06/2006 16:54 <REP> NEC Synchronization
20/01/2005 17:57 <REP> NetMeeting
23/12/2005 20:13 <REP> Nikon
12/07/2005 18:47 <REP> N-Side Software
01/07/2006 08:03 <REP> Oberon Media
05/02/2005 17:50 <REP> OfficeUpdate11
20/01/2005 14:31 <REP> Online Services
16/12/2006 07:42 <REP> Outlook Express
06/11/2006 19:08 <REP> PhotoFiltre Studio
24/11/2006 22:18 <REP> Picture It! Premium 10
27/09/2005 15:45 <REP> PopCap Games
12/07/2005 18:56 <REP> Publisher
13/03/2006 18:08 <REP> PureBasic
29/08/2005 11:26 <REP> QuickTime
26/01/2005 19:29 <REP> RALINK
26/01/2005 11:44 <REP> Real
10/09/2005 22:05 <REP> Red Storm Entertainment
20/05/2006 01:52 <REP> ReflexiveArcade
06/02/2007 17:23 <REP> RegistrySmart
02/10/2006 16:54 <REP> Rockstar Games
09/10/2005 22:06 <REP> SAGEM
20/01/2005 14:32 <REP> Services en ligne
14/07/2005 14:21 <REP> Sierra On-Line
24/11/2005 03:33 <REP> Singles
05/10/2006 21:44 <REP> SlySoft
10/11/2006 14:12 <REP> SM
16/01/2006 20:26 <REP> Spybot - Search & Destroy
06/02/2007 17:33 <REP> Spyware Doctor
01/07/2006 08:03 <REP> Strike Ball 2
15/05/2005 11:11 <REP> Surreal
25/03/2005 18:42 <REP> The Gift
27/09/2005 15:45 <REP> Trymedia
26/09/2005 19:15 <REP> Ubi Soft
26/07/2005 18:27 <REP> ubi.com
06/05/2006 11:40 <REP> Ubisoft
25/03/2005 20:55 <REP> Valusoft
26/01/2005 13:08 <REP> Viewpoint
29/08/2005 11:27 <REP> Virtual Look
12/05/2006 15:33 <REP> VSO
23/01/2007 17:01 <REP> WebMediaPlayer
20/01/2005 17:43 <REP> Winbond Electronics Corp
20/01/2005 14:36 <REP> Windows Journal Viewer
28/11/2006 11:53 <REP> Windows Live Safety Center
20/01/2005 19:02 <REP> Windows Media Connect
22/12/2006 11:26 <REP> Windows Media Connect 2
22/12/2006 11:59 <REP> Windows Media Player
20/01/2005 14:31 <REP> Windows NT
08/09/2005 13:37 <REP> WinRAR
05/02/2005 18:14 <REP> X10 Hardware
20/01/2005 14:33 <REP> xerox
09/12/2005 20:33 <REP> Yahoo!
02/01/2007 18:31 <REP> Zylom Games
0 fichier(s) 0 octets
147 R‚p(s) 10ÿ822ÿ103ÿ040 octets libres
******************************************
## Popups autorisées
* Internet Explorer
! REG.EXE VERSION 3.0
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow
*.zylom.com REG_BINARY 00000000
dns-look-up.com REG_SZ
www.dns-look-up.com REG_SZ
netsearchsoft.com REG_SZ
www.netsearchsoft.com REG_SZ
* Mozilla Firefox (1 autorisé 2 interdit)
******************************************
## Registre
* [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
mix enc REG_SZ C:\DOCUME~1\DESCAM~1\APPLIC~1\CDROMW~1\Camp Mail.exe
******************************************
## Zones de sécurité
* HKCU Domains (4)
* P3P History (5)
******************************************
## Recherche C:\WINDOWS\*.htm, "C:\WINDOWS\*.gif"
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\WINDOWS
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\WINDOWS
*************** Fin du rapport **************** -
¤ Clic sur C:, program files et supprime ces dossiers :
- eoRezo < n'installe plus ça c'est une saloprie
- AdwareAlert
¤ Fait ceci :
Pour afficher tous les dossiers et fichiers cachés :
Clique sur "démarrer", "panneau de configuration", "outils" ,"option des dossiers", "affichage"
"
Coche:
¤ afficher les fichiers et dossiers cachés
- Clique sur "appliquer" puis "ok"
---------------------------------------------------------------------
Clic sur C:\Documents and Settings\All Users\Application Data et supprime ce dossier :
- Mail ace itch download
Clic sur C:\Documents and Settings\cristine\Application Data et supprime ces dossiers
-CdromWait
- EoRezo
-MessengerSkinner < n'installe plus ça c'est une saloprie
**Si un fichier/dossier persiste lors de la suppression fait ceci:
- Redémarre ton PC. Dès l'allumage de celui-ci tapote la touche F8 (ou F5 si F8 ne fonctionne pas), à l'écran qui va apparaître choisis "mode sans echec" attends un peu..
Puis va supprimer les fichiers/dossiers, vide ta corbeille et redémarre ton PC normalement.
----------------------------------------------------------------
¤ Ouvre le bloc-note. Tu fais un copier coller du texte que je vais t'indiquer ci-dessous, tu le mettras dans le bloc-note.
Ensuite, tu l'enregistres : clic sur fichier , enregistrer sous , clic sur le bureau présent dans la colonne de gauche.
Nom du fichier : ab.reg
Type choisis : tous les fichiers
Puis clic sur "enregistrer"
Dès que tu l'as sur ton bureau double clic dessus et accepte la fusion.
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow]
"dns-look-up.com REG_SZ=-
"www.dns-look-up.com REG_SZ=-
"netsearchsoft.com REG_SZ=-
"www.netsearchsoft.com REG_SZ=-
¤ Dès que tu as fait ça remet un rapport lopxp et hijackthis stp
-
encore merci car c est compliqué pour moi je vous fait confiance voici ce que vous m avez demande
Logfile of HijackThis v1.99.1
Scan saved at 17:39:47, on 07/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Media Connect\mswmcls.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Media Connect\mswmc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\PROGRA~1\Medion\KeyStat\KeyStat.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\Dit.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\WINDOWS\system32\XCSyncML.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\DVDREG~1\DVDRegionFree.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.aldi.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Keyboard Status] C:\PROGRA~1\Medion\KeyStat\KeyStat.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [XCSyncML] C:\WINDOWS\system32\XCSyncML.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [AdwareAlert] C:\Program Files\AdwareAlert\AdwareAlert.exe -boot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [mix enc] C:\DOCUME~1\DESCAM~1\APPLIC~1\CDROMW~1\Camp Mail.exe
O4 - Startup: Ubisoft register.lnk = ?
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.aldi.com/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: DirectX Service (DirectKalg) - Unknown owner - C:\WINDOWS\
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
## Répertoires Application Data
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\All Users\Application Data
20/01/2005 15:26 <REP> .
20/01/2005 15:26 <REP> ..
25/01/2005 15:41 <REP> Adobe
25/01/2005 17:27 <REP> Ahead
26/01/2005 13:08 <REP> AOL
25/02/2006 00:12 <REP> ATI MMC
26/01/2005 12:24 <REP> Bluetooth
09/02/2006 03:20 <REP> BOONTY
24/03/2005 16:22 <REP> BVRP Software
05/02/2005 18:41 <REP> CyberLink
25/08/2006 15:34 <REP> DVD Shrink
01/12/2006 18:54 <REP> espionServerData
25/09/2006 17:40 <REP> Google
04/04/2005 13:31 <REP> Hewlett-Packard
16/06/2005 16:59 <REP> Macrovision
24/03/2006 20:39 <REP> Mail ace itch download
20/01/2005 15:26 <REP> Microsoft
26/01/2005 19:43 <REP> muvee Technologies
26/01/2005 11:41 <REP> QuickTime
20/01/2005 14:53 <REP> SBSI
16/01/2006 20:24 <REP> Spybot - Search & Destroy
04/02/2007 21:18 <REP> Symantec
05/02/2007 16:16 <REP> TEMP
13/11/2006 20:50 <REP> Trymedia
26/01/2005 13:08 <REP> Viewpoint
30/06/2006 02:22 <REP> Windows Genuine Advantage
09/12/2005 20:41 <REP> Yahoo! Companion
30/12/2006 15:02 <REP> Zylom
06/02/2007 04:07 3ÿ120 118300.34
20/01/2005 15:26 62 desktop.ini
29/03/2005 17:33 2ÿ698 hpzinstall.log
3 fichier(s) 5ÿ880 octets
28 R‚p(s) 10ÿ758ÿ565ÿ888 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\Default User\Application Data
20/01/2005 15:26 <REP> .
20/01/2005 15:26 <REP> ..
24/03/2005 16:16 <REP> Adobe
24/03/2005 16:16 <REP> AOL
24/03/2005 16:16 <REP> CyberLink
20/01/2005 14:33 <REP> Identities
24/03/2005 16:16 <REP> Macromedia
20/01/2005 15:26 <REP> Microsoft
24/03/2005 16:16 <REP> Real
24/03/2005 16:16 <REP> Sun
24/03/2005 16:16 <REP> You've Got Pictures Screensaver
20/01/2005 15:26 62 desktop.ini
1 fichier(s) 62 octets
11 R‚p(s) 10ÿ758ÿ565ÿ888 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\Default User\Local Settings\Application Data
20/01/2005 15:26 <REP> .
20/01/2005 15:26 <REP> ..
24/03/2005 16:16 <REP> {3248F0A6-6813-11D6-A77B-00B0D0150010}
24/03/2005 16:16 <REP> Adobe
24/03/2005 16:16 <REP> ApplicationHistory
20/01/2005 14:33 <REP> Microsoft
24/03/2005 16:16 <REP> PowerCinema
24/03/2005 16:16 <REP> WMTools Downloaded Files
24/03/2005 16:16 4ÿ608 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
24/03/2005 16:16 135 fusioncache.dat
24/03/2005 16:16 64ÿ152 GDIPFONTCACHEV1.DAT
24/03/2005 16:16 5ÿ876ÿ804 IconCache.db
4 fichier(s) 5ÿ945ÿ699 octets
8 R‚p(s) 10ÿ758ÿ565ÿ888 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\descamps christine\Application Data
24/03/2005 16:18 <REP> .
24/03/2005 16:18 <REP> ..
24/03/2005 16:18 <REP> Adobe
14/07/2005 20:06 <REP> AdobeUM
14/03/2006 18:37 <REP> Ahead
28/03/2005 13:38 <REP> Aim
19/05/2006 17:14 <REP> Alawar
24/03/2005 16:18 <REP> AOL
16/01/2006 22:24 <REP> ArcSoft
12/03/2006 20:03 <REP> ATI MMC
07/02/2007 08:06 <REP> BitDownload
24/03/2005 16:18 <REP> CyberLink
25/08/2006 16:57 <REP> Elaborate Bytes
17/01/2007 18:41 <REP> EoRezo
24/12/2005 10:49 <REP> Google
08/04/2005 18:46 <REP> Help
24/03/2005 16:18 <REP> Identities
10/09/2005 09:59 <REP> La Bataille pour la Terre du Milieu
24/03/2005 21:57 <REP> Lavasoft
20/11/2006 18:11 <REP> Leadertech
24/03/2005 16:18 <REP> Macromedia
24/03/2005 16:18 <REP> Microsoft
24/03/2005 21:16 <REP> Mozilla
02/12/2006 11:41 <REP> Opera
05/02/2007 16:16 <REP> PC Tools
24/03/2005 16:18 <REP> Real
11/05/2006 02:07 <REP> SlySoft
24/03/2005 16:18 <REP> Sun
29/04/2005 16:17 <REP> Talkback
18/10/2005 15:25 <REP> WholeSecurity
30/06/2006 16:57 <REP> XCPCSync.OEM
24/03/2005 16:18 <REP> You've Got Pictures Screensaver
30/12/2006 15:03 <REP> Zylom
25/08/2006 16:52 125 .zreglib
24/03/2005 16:18 62 desktop.ini
31/03/2005 18:33 64ÿ944 GDIPFONTCACHEV1.DAT
25/06/2006 19:50 7ÿ512 GdiplusUpgrade_MSIApproach_Wrapper.log
23/01/2007 16:59 1ÿ858 HPCOM_48BitScanUpdate.log
05/02/2007 04:01 262 WinssCookie.txt
24/03/2005 16:48 29ÿ538 wklnhst.dat
7 fichier(s) 104ÿ301 octets
33 R‚p(s) 10ÿ758ÿ561ÿ792 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\descamps christine\Local Settings\Application Data
24/03/2005 16:18 <REP> .
24/03/2005 16:18 <REP> ..
24/03/2005 16:18 <REP> {3248F0A6-6813-11D6-A77B-00B0D0150010}
20/05/2005 22:24 <REP> ABBYY
24/03/2005 16:18 <REP> Adobe
13/07/2005 15:32 <REP> Ahead
23/01/2007 13:16 <REP> Alice ADSL
24/03/2005 16:18 <REP> ApplicationHistory
05/04/2005 06:33 <REP> Google
08/04/2005 18:46 <REP> Help
29/03/2005 18:14 <REP> HP
28/03/2005 18:26 <REP> Identities
09/05/2006 18:11 <REP> IM
29/03/2005 18:14 <REP> IsolatedStorage
19/11/2005 18:57 <REP> Logitech-LS
24/03/2005 16:18 <REP> Microsoft
07/03/2006 21:24 <REP> Mozilla
02/03/2006 18:31 <REP> NFS Underground 2
23/12/2005 20:21 <REP> Nikon
23/12/2005 20:21 <REP> Pixology
24/03/2005 16:18 <REP> PowerCinema
02/07/2006 13:09 <REP> SM
28/03/2005 13:38 <REP> Wildtangent
24/03/2005 16:18 <REP> WMTools Downloaded Files
24/03/2005 16:18 115ÿ200 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
24/03/2005 16:18 141 fusioncache.dat
24/03/2005 16:18 67ÿ376 GDIPFONTCACHEV1.DAT
24/03/2005 16:18 2ÿ113ÿ830 IconCache.db
4 fichier(s) 2ÿ296ÿ547 octets
24 R‚p(s) 10ÿ758ÿ561ÿ792 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\le compte de didine\Application Data
23/08/2006 14:09 <REP> .
23/08/2006 14:09 <REP> ..
23/08/2006 14:09 <REP> Adobe
23/08/2006 17:48 <REP> Aim
23/08/2006 14:09 <REP> AOL
23/08/2006 14:09 <REP> CyberLink
01/11/2006 16:12 <REP> Google
23/08/2006 14:09 <REP> Identities
23/08/2006 14:09 <REP> Macromedia
23/08/2006 14:09 <REP> Microsoft
23/08/2006 20:35 <REP> Mozilla
23/08/2006 14:09 <REP> Real
23/08/2006 14:09 <REP> Sun
23/08/2006 20:37 <REP> Talkback
23/08/2006 14:10 <REP> WholeSecurity
23/08/2006 14:09 <REP> You've Got Pictures Screensaver
23/08/2006 14:09 62 desktop.ini
1 fichier(s) 62 octets
16 R‚p(s) 10ÿ758ÿ557ÿ696 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\le compte de didine\Local Settings\Application Data
23/08/2006 14:09 <REP> .
23/08/2006 14:09 <REP> ..
23/08/2006 14:09 <REP> {3248F0A6-6813-11D6-A77B-00B0D0150010}
23/08/2006 14:09 <REP> Adobe
23/08/2006 14:09 <REP> ApplicationHistory
01/11/2006 16:12 <REP> Google
23/08/2006 14:10 <REP> HP
13/09/2006 22:46 <REP> Identities
23/08/2006 14:10 <REP> IsolatedStorage
23/08/2006 14:10 <REP> Logitech-LS
23/08/2006 14:09 <REP> Microsoft
23/08/2006 20:35 <REP> Mozilla
23/08/2006 14:09 <REP> PowerCinema
23/08/2006 14:09 <REP> WMTools Downloaded Files
23/08/2006 14:09 4ÿ608 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
23/08/2006 14:09 142 fusioncache.dat
23/08/2006 14:09 64ÿ944 GDIPFONTCACHEV1.DAT
23/08/2006 14:09 5ÿ876ÿ804 IconCache.db
4 fichier(s) 5ÿ946ÿ498 octets
14 R‚p(s) 10ÿ758ÿ557ÿ696 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\LocalService\Application Data
20/01/2005 14:35 <REP> .
20/01/2005 14:35 <REP> ..
30/03/2005 10:38 <REP> Help
30/03/2005 10:41 <REP> Macromedia
20/01/2005 14:35 <REP> Microsoft
12/09/2005 20:35 <REP> Mozilla
12/09/2005 20:35 <REP> Talkback
26/01/2005 19:22 <REP> X10 Commander
0 fichier(s) 0 octets
8 R‚p(s) 10ÿ758ÿ557ÿ696 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\LocalService\Local Settings\Application Data
20/01/2005 14:35 <REP> .
20/01/2005 14:35 <REP> ..
30/03/2005 10:38 <REP> Help
20/01/2005 14:35 <REP> Microsoft
08/03/2006 14:57 <REP> Mozilla
0 fichier(s) 0 octets
5 R‚p(s) 10ÿ758ÿ557ÿ696 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\NetworkService\Application Data
20/01/2005 14:35 <REP> .
20/01/2005 14:35 <REP> ..
20/01/2005 14:35 <REP> Microsoft
23/06/2006 03:45 <REP> X10 Commander
0 fichier(s) 0 octets
4 R‚p(s) 10ÿ758ÿ557ÿ696 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\NetworkService\Local Settings\Application Data
20/01/2005 14:35 <REP> .
20/01/2005 14:35 <REP> ..
30/04/2005 01:59 <REP> ApplicationHistory
20/01/2005 14:35 <REP> Microsoft
30/04/2005 01:59 137 fusioncache.dat
1 fichier(s) 137 octets
4 R‚p(s) 10ÿ758ÿ557ÿ696 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Documents and Settings\Propri‚taire\Application Data
27/03/2005 22:02 <REP> .
27/03/2005 22:02 <REP> ..
09/06/2005 10:22 <REP> Real
27/03/2005 22:02 <REP> You've Got Pictures Screensaver
0 fichier(s) 0 octets
4 R‚p(s) 10ÿ758ÿ553ÿ600 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\WINDOWS\system32\config\systemprofile\Application Data
20/01/2005 14:35 <REP> .
20/01/2005 14:35 <REP> ..
24/03/2005 16:18 <REP> Adobe
24/03/2005 16:18 <REP> AOL
24/03/2005 16:18 <REP> CyberLink
20/01/2005 14:35 <REP> Identities
24/03/2005 16:18 <REP> Macromedia
20/01/2005 14:35 <REP> Microsoft
24/03/2005 16:18 <REP> Real
24/03/2005 16:18 <REP> Sun
24/03/2005 19:33 <REP> X10 Commander
24/03/2005 16:18 <REP> You've Got Pictures Screensaver
20/01/2005 14:35 62 desktop.ini
1 fichier(s) 62 octets
12 R‚p(s) 10ÿ758ÿ553ÿ600 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data
20/01/2005 14:35 <REP> .
20/01/2005 14:35 <REP> ..
24/03/2005 16:18 <REP> {3248F0A6-6813-11D6-A77B-00B0D0150010}
24/03/2005 16:18 <REP> Adobe
24/03/2005 16:18 <REP> ApplicationHistory
20/01/2005 14:35 <REP> Microsoft
24/03/2005 16:18 <REP> PowerCinema
24/03/2005 16:18 <REP> WMTools Downloaded Files
24/03/2005 16:18 4ÿ608 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
24/03/2005 16:18 135 fusioncache.dat
24/03/2005 16:18 64ÿ152 GDIPFONTCACHEV1.DAT
24/03/2005 16:18 5ÿ876ÿ804 IconCache.db
4 fichier(s) 5ÿ945ÿ699 octets
8 R‚p(s) 10ÿ758ÿ553ÿ600 octets libres
******************************************
Recherche des taches planifiées dans C:\WINDOWS\tasks
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\WINDOWS\Tasks
07/02/2007 08:07 296 AF1F836791C43387.job
26/10/2005 17:08 348 At14.job
26/10/2005 17:08 348 At13.job
26/10/2005 17:08 340 At12.job
21/10/2005 17:05 348 At6.job
21/10/2005 17:05 348 At5.job
21/10/2005 17:04 340 At3.job
03/04/2005 17:49 386 WebReg 20050403184959.job
20/01/2005 14:35 6 SA.DAT
20/01/2005 14:32 <REP> .
20/01/2005 14:32 <REP> ..
20/01/2005 14:21 65 desktop.ini
10 fichier(s) 2ÿ825 octets
2 R‚p(s) 10ÿ758ÿ553ÿ600 octets libres
******************************************
## Répertoires de Program files
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\Program Files
07/02/2007 17:14 <REP> .
07/02/2007 17:14 <REP> ..
11/03/2006 15:25 <REP> 2015
12/03/2006 20:04 <REP> ABBYY FineReader 5.0 Sprint
08/10/2005 15:09 <REP> ABBYY FineReader 5.0 Sprint(2)
04/04/2005 02:40 <REP> ABBYY FineReader 6.0
28/01/2006 19:50 <REP> Activision
04/01/2007 04:11 <REP> Adobe
03/04/2005 07:58 <REP> Ahead
13/11/2005 12:12 <REP> AIM
13/03/2006 17:42 <REP> Algominds
27/11/2005 14:49 <REP> Alice_Triway_WiFi
19/10/2005 15:26 <REP> Alwil Software
24/10/2005 09:09 <REP> AOL 9.0
24/10/2005 09:09 <REP> AOL Compagnon
24/10/2005 09:09 <REP> AOL Toolbar
26/10/2005 15:28 <REP> Atari
24/02/2006 22:02 <REP> ATI Multimedia
20/01/2005 17:33 <REP> ATI Technologies
13/11/2006 20:49 <REP> BFG
07/02/2007 08:07 <REP> BitDownload
03/01/2007 10:12 <REP> Boonty
07/11/2006 04:05 <REP> BoontyGames
12/03/2006 20:03 <REP> Call of Duty
20/01/2005 17:50 <REP> Cardreader Software
16/01/2006 15:43 <REP> CCleaner
07/02/2007 08:06 <REP> CdromWait
08/02/2006 16:51 <REP> Codemasters
05/02/2005 18:14 <REP> Common Files
04/04/2005 02:40 <REP> ComPlus Applications
08/02/2006 16:53 <REP> Creative
03/04/2005 07:58 <REP> CyberLink
04/12/2006 03:49 <REP> DaemonTools_WhenUSave_Installer
04/04/2005 02:40 <REP> directx
01/02/2006 20:21 <REP> Disney Interactive
03/04/2005 07:58 <REP> DivX
03/12/2006 10:35 <REP> D-Tools
04/02/2007 17:57 <REP> DVD Region+CSS Free
25/08/2006 15:34 <REP> DVD Shrink
02/03/2006 18:28 <REP> EA GAMES
26/09/2005 19:19 <REP> EA SPORTS
27/06/2005 19:45 <REP> EACOM
27/01/2006 03:34 <REP> eBay
25/08/2006 22:27 <REP> Elaborate Bytes
24/04/2005 17:57 <REP> emme - Langues
07/02/2007 08:15 <REP> eMule
26/01/2005 10:23 <REP> Encarta
03/11/2005 16:16 <REP> FaxTools
04/02/2007 21:20 <REP> Fichiers communs
28/03/2005 14:44 <REP> Fox
13/11/2006 20:56 <REP> Gamenext
12/03/2006 20:07 <REP> GameSpy Arcade
04/02/2007 21:20 <REP> Google
29/03/2005 17:37 <REP> Hewlett-Packard
20/01/2005 19:01 <REP> HighMAT CD Writing Wizard
07/02/2007 17:39 <REP> Hijackthis Version Fran‡aise
05/02/2005 18:41 <REP> Home Cinema
04/04/2005 13:31 <REP> HP
09/05/2006 18:13 <REP> IncrediMail
20/01/2005 15:49 <REP> Intel
16/12/2006 07:43 <REP> Internet Explorer
26/01/2005 12:18 <REP> IVT Corporation
09/01/2007 04:44 <REP> Java
30/11/2006 17:34 <REP> Kartracing
07/02/2007 07:08 <REP> Lavasoft
26/01/2005 13:08 <REP> Learn2.com
01/02/2007 12:39 <REP> Lexmark X1100 Series
19/11/2005 17:32 <REP> Logitech
28/02/2006 18:14 <REP> LucasArts
27/03/2006 02:50 <REP> Maxis
02/10/2006 16:54 <REP> MediaMobsters
22/10/2005 13:18 <REP> Medion
07/11/2006 04:05 <REP> Mes Jeux T‚l‚charg‚s
24/03/2005 17:37 <REP> Messenger
23/01/2007 13:06 <REP> Messenger Plus! Live
26/01/2005 10:25 <REP> Microsoft AutoRoute
20/01/2005 14:33 <REP> microsoft frontpage
15/04/2006 11:59 <REP> Microsoft Games
21/10/2006 10:51 <REP> Microsoft Money 2005
26/01/2005 10:16 <REP> Microsoft Office
05/02/2005 17:04 <REP> Microsoft Visual Studio
26/01/2005 10:17 <REP> Microsoft Works
26/01/2005 10:13 <REP> Microsoft Works Suite 2005
28/08/2006 11:22 <REP> Mihov Image Resizer
20/01/2005 14:32 <REP> Movie Maker
07/02/2007 17:11 <REP> Mozilla Firefox
14/07/2006 19:35 <REP> MP3 Player Utilities
09/04/2005 20:08 <REP> MSN
20/01/2005 14:31 <REP> MSN Gaming Zone
28/11/2006 11:56 <REP> MSN Messenger
18/11/2006 23:27 <REP> MSXML 4.0
26/01/2005 12:33 <REP> Musicmatch
26/01/2005 19:43 <REP> muvee Technologies
30/06/2006 16:52 <REP> NEC
30/06/2006 16:54 <REP> NEC Synchronization
20/01/2005 17:57 <REP> NetMeeting
23/12/2005 20:13 <REP> Nikon
12/07/2005 18:47 <REP> N-Side Software
01/07/2006 08:03 <REP> Oberon Media
05/02/2005 17:50 <REP> OfficeUpdate11
20/01/2005 14:31 <REP> Online Services
16/12/2006 07:42 <REP> Outlook Express
06/11/2006 19:08 <REP> PhotoFiltre Studio
24/11/2006 22:18 <REP> Picture It! Premium 10
27/09/2005 15:45 <REP> PopCap Games
12/07/2005 18:56 <REP> Publisher
13/03/2006 18:08 <REP> PureBasic
29/08/2005 11:26 <REP> QuickTime
26/01/2005 19:29 <REP> RALINK
26/01/2005 11:44 <REP> Real
10/09/2005 22:05 <REP> Red Storm Entertainment
20/05/2006 01:52 <REP> ReflexiveArcade
06/02/2007 17:23 <REP> RegistrySmart
02/10/2006 16:54 <REP> Rockstar Games
09/10/2005 22:06 <REP> SAGEM
20/01/2005 14:32 <REP> Services en ligne
14/07/2005 14:21 <REP> Sierra On-Line
24/11/2005 03:33 <REP> Singles
05/10/2006 21:44 <REP> SlySoft
10/11/2006 14:12 <REP> SM
16/01/2006 20:26 <REP> Spybot - Search & Destroy
06/02/2007 17:33 <REP> Spyware Doctor
01/07/2006 08:03 <REP> Strike Ball 2
15/05/2005 11:11 <REP> Surreal
25/03/2005 18:42 <REP> The Gift
27/09/2005 15:45 <REP> Trymedia
26/09/2005 19:15 <REP> Ubi Soft
26/07/2005 18:27 <REP> ubi.com
06/05/2006 11:40 <REP> Ubisoft
25/03/2005 20:55 <REP> Valusoft
26/01/2005 13:08 <REP> Viewpoint
29/08/2005 11:27 <REP> Virtual Look
12/05/2006 15:33 <REP> VSO
23/01/2007 17:01 <REP> WebMediaPlayer
20/01/2005 17:43 <REP> Winbond Electronics Corp
20/01/2005 14:36 <REP> Windows Journal Viewer
28/11/2006 11:53 <REP> Windows Live Safety Center
20/01/2005 19:02 <REP> Windows Media Connect
22/12/2006 11:26 <REP> Windows Media Connect 2
22/12/2006 11:59 <REP> Windows Media Player
20/01/2005 14:31 <REP> Windows NT
08/09/2005 13:37 <REP> WinRAR
05/02/2005 18:14 <REP> X10 Hardware
20/01/2005 14:33 <REP> xerox
09/12/2005 20:33 <REP> Yahoo!
02/01/2007 18:31 <REP> Zylom Games
0 fichier(s) 0 octets
146 R‚p(s) 10ÿ758ÿ537ÿ216 octets libres
******************************************
## Popups autorisées
* Internet Explorer
! REG.EXE VERSION 3.0
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow
*.zylom.com REG_BINARY 00000000
dns-look-up.com REG_SZ
www.dns-look-up.com REG_SZ
netsearchsoft.com REG_SZ
www.netsearchsoft.com REG_SZ
* Mozilla Firefox (1 autorisé 2 interdit)
******************************************
## Registre
* [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
mix enc REG_SZ C:\DOCUME~1\DESCAM~1\APPLIC~1\CDROMW~1\Camp Mail.exe
******************************************
## Zones de sécurité
* HKCU Domains (4)
* P3P History (5)
******************************************
## Recherche C:\WINDOWS\*.htm, "C:\WINDOWS\*.gif"
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\WINDOWS
Le volume dans le lecteur C s'appelle BOOT
Le num‚ro de s‚rie du volume est 9860-C872
R‚pertoire de C:\WINDOWS
*************** Fin du rapport ****************
-
-
¤ Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked"
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [AdwareAlert] C:\Program Files\AdwareAlert\AdwareAlert.exe -boot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [mix enc] C:\DOCUME~1\DESCAM~1\APPLIC~1\CDROMW~1\Camp Mail.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
¤ Clic sur "démarrer", "exécuter", tape: services.msc
Cherche dans la liste les lignes ci-dessous, tu fais un clic droit dessus choisis "propriétés" et régle les sur "désactivé"
DirectX Service
Google Updater Service
InstallDriver Table Manager
¤ Clic sur le lien. Clic sur " clik here for start dowload" télécharge le fichier ou tu le retrouveras puis double clic dessus et accepte la fusion avec le registre (pour supprimer la modif du registre suite à ton infection)
http://www.mediafire.com/?2uyjhnfzdoz
¤ Clic sur C:, WINDOWS et vide complétement ce dossier :
- Tasks (une seule ligne devrait persister c'est normal)
¤ Tu as quoi comme anti-spyware ?
