Trojan.agent.CS

jeremy -  
bonjour a tous j'ai un probleme avec le virus Trojan.Agent.CS qui est loger dans c:\windows\system\antims.dll. Mon antivirus est BitDefender 8 professionnal plus. Celui-ci le detecte mais il ne peut ni le desinfecter ni le deplacer dans la quarantaine. Je ne sais plus quoi faire, aidez-moi svp
Configuration: windows xp

42 réponses

Résumé de la discussion

Une infection Trojan.Agent.CS est signalée sur un système Windows XP dans le fichier c:\windows\system\antims.dll et l'antivirus BitDefender 8 Professionnal Plus détecte le malware sans pouvoir le désinfecter ni le mettre en quarantaine. Plusieurs réponses proposent des solutions techniques, comme tester le fichier suspect via Jotti (viruscan.jotti.org), relancer HijackThis et tenter de supprimer les éléments indésirables, puis vérifier les services et les éléments de démarrage. D'autres interventions évoquent des outils comme KillBox et la suppression de sauvegardes, ainsi que l'examen de journaux HijackThis pour détecter les modifications de configuration, sans garantie de résolution immédiate. Certains éléments indiquent que la restauration des performances et la remise en ligne dépendent de la suppression complète des composantes et de la remise à jour des définitions antivirus, ce qui peut nécessiter plusieurs essais.

Bobot (l’IA à votre service)
  1. Utilisateur anonyme
    ok super pour toi
    recache tes fichiers caches + reactive ta restauration systeme

    a+
    0
    1. rastegui
      Merci regis c bon jsui libre... continue...a+
      0
      1. Utilisateur anonyme
        re
        rend toi ici et supprime le back up + poubelle alors
        C:\Documents and Settings\nouveau\Bureau\backups\backup-20051003-164430-488.dll

        a+
        0
        1. rastegui
          C:\Documents and Settings\nouveau\Bureau\backups\backup-20051003-164430-488.dll est infecté par Trojan.Agent.CS
          0
          2. Utilisateur anonyme
            salut
            en tout cas, il a l air supprimer

            ou te le detecte t il maintenant?

            a+
            0
            1. rastegui
              voila g fai tt ce ke tu ma di mon cher... voila le new log néanmoin bitdefender le detecte encor mai cette foi ci ds un autre fichier ki se trouve ds le dossier backups de hijackthis je pense...

              Logfile of HijackThis v1.99.1
              Scan saved at 17:09:23, on 03/10/2005
              Platform: Windows XP SP2 (WinNT 5.01.2600)
              MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

              Running processes:
              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\system32\spoolsv.exe
              C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
              C:\WINDOWS\System32\nvsvc32.exe
              C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
              C:\WINDOWS\System32\svchost.exe
              C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
              C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
              C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
              C:\WINDOWS\Explorer.EXE
              C:\Program Files\Softwin\BitDefender Professional Edition\vsserv.exe
              C:\Program Files\Apoint2K\Apoint.exe
              C:\WINDOWS\AGRSMMSG.exe
              C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
              C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
              C:\WINDOWS\System32\hphmon05.exe
              C:\Program Files\Real\RealPlayer\RealPlay.exe
              C:\progra~1\softwin\bitdef~1\bdmcon.exe
              C:\Program Files\Apoint2K\Apntex.exe
              C:\Program Files\Softwin\BitDefender Professional Edition\bdswitch.exe
              C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
              C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
              C:\Program Files\Internet Explorer\iexplore.exe
              C:\Program Files\iTunes\iTunesHelper.exe
              C:\Program Files\QuickTime\qttask.exe
              C:\WINDOWS\system32\ctfmon.exe
              C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
              c:\progra~1\intern~1\iexplore.exe
              C:\Program Files\iPod\bin\iPodService.exe
              C:\WINDOWS\system32\wscntfy.exe
              C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
              C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgalry.exe
              C:\Program Files\Mozilla Firefox\firefox.exe
              C:\Documents and Settings\nouveau\Bureau\HijackThis.exe

              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.dihksnmkxedg.com/oMrxtrH0PsiymbeL14DvDmNVGS_EmdgXDf_W0YpBRnUHzWhFdXuIbQ4r0gsGiaI0.html
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q304&bd=presario&pf=laptop
              R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q304&bd=presario&pf=laptop
              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
              O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
              O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
              O2 - BHO: (no name) - {BA29E4DD-02F6-5240-1670-020C327CFAC0} - C:\DOCUME~1\nouveau\APPLIC~1\STYLED~1\REAL GPL.exe
              O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
              O3 - Toolbar: Yahoo! Compagnon - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_18_0.dll (file missing)
              O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
              O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
              O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
              O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
              O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
              O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
              O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
              O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
              O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
              O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
              O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
              O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
              O4 - HKLM\..\Run: [BDMCon] C:\progra~1\softwin\bitdef~1\bdmcon.exe
              O4 - HKLM\..\Run: [BDNewsAgent] C:\progra~1\softwin\bitdef~1\bdnagent.exe
              O4 - HKLM\..\Run: [BDSwitchAgent] C:\Program Files\Softwin\BitDefender Professional Edition\bdswitch.exe
              O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
              O4 - HKLM\..\Run: [hidewmapingbash] C:\Documents and Settings\All Users\Application Data\Data Start Hide Wma\stupid corn.exe
              O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
              O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
              O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
              O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
              O4 - HKLM\..\Run: [Wincmd16] C:\Program Files\Active Key Logger\Active Key Logger.exe
              O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
              O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
              O4 - HKCU\..\Run: [FUNKWAY] C:\DOCUME~1\nouveau\APPLIC~1\LIVEFL~1\win save less.exe
              O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
              O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
              O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
              O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
              O9 - Extra button: NouvellesMP3 - {76DD9E77-F06C-4471-AB6C-CF03C5C6B5B0} - C:\WINDOWS\System32\NouvellesMP3 (file missing)
              O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
              O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
              O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
              O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q304&bd=presario&pf=laptop
              O17 - HKLM\System\CCS\Services\Tcpip\..\{C9CCEE2B-E37D-41AE-9780-E6247C5D6B61}: NameServer = 80.10.246.5 80.10.246.136
              O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
              O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
              O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Unknown owner - C:\Program Files\Norton AntiVirus\navapsvc.exe (file missing)
              O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
              O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
              O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
              O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
              O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender Professional Edition\vsserv.exe
              O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

              Merci pr la rapidité de ton aide...
              0
              1. Utilisateur anonyme
                Salut,

                Imprime, ou enregistre ceci dans le bloc note pour ne rien oublier.

                Désactive la restauration système
                Clic droit sur poste de travail > propriétés > onglet restauration système
                puis cocher "désactiver la restauration système".

                et reboot le pc normalement (pas en mode sans échec)

                1/

                télécharge : process xp ici:
                http://www.sysinternals.com/files/procexpnt.zip

                Télécharge: Pocket Killbox ici
                http://www.downloads.subratam.org/KillBox.exe

                *desinstalle msn+ et tu le reinstallera plus tard sans accepter les sponsors
                http://theroot.chez.tiscali.fr/imgs/tuto/msgplus.jpg

                2/

                Déconnecte toi du net.
                Ferme tous les programmes en cours (média player, internet explorer, ...etc)

                Dézippe (clic droit > extraire) process xp et double clic sur processxp.exe

                * Dans la fenêtre principale de processxp double clic sur winlogon.exe
                Dans la nouvelle fenêtre qui s'ouvre clique sur threads
                sélectionne seulement les lignes qui contiennent adwms.dll puis clique sur kill pour chacune des lignes trouvées.
                une fois fait, valide avec ok

                * Dans la fenêtre principale de processxp double clic sur explorer.exe
                Dans la nouvelle fenêtre qui s'ouvre clique sur threads
                sélectionner seulement les lignes qui contiennent adwms.dll puis clique sur kill pour chacune des lignes trouvées.
                une fois fait, valide avec ok

                3/

                puis lancer HijackThis:

                clique sur "do a system scan only"

                * Cocher la case au début de ces lignes:

                R3 - URLSearchHook: (no name) - {15651C7C-E812-44a2-A9AC-B467A2233E7D} - (no file)
                O1 - Hosts: imizer.com
                O1 - Hosts: ptimizer.com
                O1 - Hosts: roptimizer.com
                O1 - Hosts: feroptimizer.com
                O1 - Hosts: o.offeroptimizer.com
                O1 - Hosts: dso.offeroptimizer.com
                O1 - Hosts: 127.
                O1 - Hosts: c.whenu.com
                O1 - Hosts: c.whenu.com
                O1 - Hosts: inc.whenu.com
                O1 - Hosts: inc.whenu.com
                O1 - Hosts: om
                O1 - Hosts: om
                O1 - Hosts: com
                O1 - Hosts: .com
                O1 - Hosts: er.com
                O1 - Hosts: izer.com
                O1 - Hosts: imizer.com
                O1 - Hosts: ptimizer.com
                O1 - Hosts: roptimizer.com
                O1 - Hosts: feroptimizer.com
                O1 - Hosts: s.offeroptimizer.com
                O1 - Hosts: .xads.offeropt
                O1 - Hosts: w
                O1 - Hosts: w
                O1 - Hosts: w
                O1 - Hosts: 1
                O1 - Hosts: find.com
                O1 - Hosts: find.com
                O1 - Hosts: find.com

                O2 - BHO: MSEvents Object - {44240BB5-BD7D-4D49-A1AA-8AB0F3D3CB44} - C:\WINDOWS\Microsoft.NET\adwms.dll

                O4 - HKCU\..\Run: [NouvellesMP3] rundll32.exe C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:NouvellesMP3:t

                O16 - DPF: {15651C7C-E812-44A2-A9AC-B467A2233E7D} - http://portail.escritorioactivo.com/GIDCAI32.cab
                O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} - http://www.bocata.net/webs/FR_Pop1/laaplicacion.cab
                O16 - DPF: {92ABACFE-EF6E-42C7-A824-D50A914B5B70} (MastaCash Loader Class) - http://dx.mastacash.com/loader.cab
                O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab
                O16 - DPF: {9C5B2F29-1F46-4639-A6B4-828942301D3E} - http://portail.escritorioactivo.com/SIPSPI32.cab

                O20 - Winlogon Notify: adwms - C:\WINDOWS\Microsoft.NET\adwms.dll

                * Valider avec fix checked

                5/

                Double clic sur killbox.exe (Pocket Killbox)

                - coche: delete on reboot
                - Dans "Full Path of File to Delete"
                copie et colle:

                C:\WINDOWS\Microsoft.NET\adwms.dll

                - clique sur la croix rouge
                - une fenêtre va apparaître pour confirmation clique sur YES
                - une seconde fenêtre te demande si tu veux redémarrer clique sur YES

                Laisse le pc redémarrer.

                Et après reposte un log HijackThis.

                A+
                0
                1. rastegui
                  Salut à vous chasseur! je suis victime de ce gibier Trojan.agent.CS J'ai bien essayé de suivre les instructions de balltrap mais il est toujours là!! g bitdefender osi et il le détecte dans c:\windows\microsoft.net\adwms.dll
                  Je vous mets le log hijackthisen espérant que vous pourriez m'aider...Merci d'avance et bonne chasse!
                  Logfile of HijackThis v1.99.1
                  Scan saved at 14:42:40, on 03/10/2005
                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                  C:\WINDOWS\System32\nvsvc32.exe
                  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
                  C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
                  C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
                  C:\Program Files\Softwin\BitDefender Professional Edition\vsserv.exe
                  C:\WINDOWS\Explorer.EXE
                  C:\WINDOWS\system32\wscntfy.exe
                  C:\Program Files\Apoint2K\Apoint.exe
                  C:\WINDOWS\AGRSMMSG.exe
                  C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
                  C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
                  C:\WINDOWS\System32\hphmon05.exe
                  C:\Program Files\Real\RealPlayer\RealPlay.exe
                  C:\progra~1\softwin\bitdef~1\bdmcon.exe
                  C:\Program Files\Softwin\BitDefender Professional Edition\bdswitch.exe
                  C:\Program Files\Apoint2K\Apntex.exe
                  C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
                  C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
                  C:\Program Files\iTunes\iTunesHelper.exe
                  C:\Program Files\QuickTime\qttask.exe
                  C:\Program Files\Internet Explorer\iexplore.exe
                  C:\WINDOWS\system32\ctfmon.exe
                  c:\progra~1\intern~1\iexplore.exe
                  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
                  C:\Program Files\iPod\bin\iPodService.exe
                  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgalry.exe
                  C:\Program Files\Mozilla Firefox\firefox.exe
                  C:\Documents and Settings\nouveau\Bureau\HijackThis.exe

                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.dihksnmkxedg.com/oMrxtrH0PsiymbeL14DvDmNVGS_EmdgXDf_W0YpBRnUHzWhFdXuIbQ4r0gsGiaI0.html
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q304&bd=presario&pf=laptop
                  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q304&bd=presario&pf=laptop
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                  R3 - URLSearchHook: (no name) - {15651C7C-E812-44a2-A9AC-B467A2233E7D} - (no file)
                  O1 - Hosts: imizer.com
                  O1 - Hosts: ptimizer.com
                  O1 - Hosts: roptimizer.com
                  O1 - Hosts: feroptimizer.com
                  O1 - Hosts: o.offeroptimizer.com
                  O1 - Hosts: dso.offeroptimizer.com
                  O1 - Hosts: 127.
                  O1 - Hosts: c.whenu.com
                  O1 - Hosts: c.whenu.com
                  O1 - Hosts: inc.whenu.com
                  O1 - Hosts: inc.whenu.com
                  O1 - Hosts: om
                  O1 - Hosts: om
                  O1 - Hosts: com
                  O1 - Hosts: .com
                  O1 - Hosts: er.com
                  O1 - Hosts: izer.com
                  O1 - Hosts: imizer.com
                  O1 - Hosts: ptimizer.com
                  O1 - Hosts: roptimizer.com
                  O1 - Hosts: feroptimizer.com
                  O1 - Hosts: s.offeroptimizer.com
                  O1 - Hosts: .xads.offeropt
                  O1 - Hosts: w
                  O1 - Hosts: w
                  O1 - Hosts: w
                  O1 - Hosts: 1
                  O1 - Hosts: find.com
                  O1 - Hosts: find.com
                  O1 - Hosts: find.com
                  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
                  O2 - BHO: MSEvents Object - {44240BB5-BD7D-4D49-A1AA-8AB0F3D3CB44} - C:\WINDOWS\Microsoft.NET\adwms.dll
                  O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
                  O2 - BHO: (no name) - {BA29E4DD-02F6-5240-1670-020C327CFAC0} - C:\DOCUME~1\nouveau\APPLIC~1\STYLED~1\REAL GPL.exe
                  O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
                  O3 - Toolbar: Yahoo! Compagnon - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_18_0.dll (file missing)
                  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
                  O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
                  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
                  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
                  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
                  O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
                  O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
                  O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
                  O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
                  O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
                  O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
                  O4 - HKLM\..\Run: [BDMCon] C:\progra~1\softwin\bitdef~1\bdmcon.exe
                  O4 - HKLM\..\Run: [BDNewsAgent] C:\progra~1\softwin\bitdef~1\bdnagent.exe
                  O4 - HKLM\..\Run: [BDSwitchAgent] C:\Program Files\Softwin\BitDefender Professional Edition\bdswitch.exe
                  O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
                  O4 - HKLM\..\Run: [hidewmapingbash] C:\Documents and Settings\All Users\Application Data\Data Start Hide Wma\stupid corn.exe
                  O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
                  O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
                  O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
                  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                  O4 - HKLM\..\Run: [Wincmd16] C:\Program Files\Active Key Logger\Active Key Logger.exe
                  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                  O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
                  O4 - HKCU\..\Run: [NouvellesMP3] rundll32.exe C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:NouvellesMP3:t
                  O4 - HKCU\..\Run: [FUNKWAY] C:\DOCUME~1\nouveau\APPLIC~1\LIVEFL~1\win save less.exe
                  O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
                  O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
                  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
                  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
                  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
                  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
                  O9 - Extra button: NouvellesMP3 - {76DD9E77-F06C-4471-AB6C-CF03C5C6B5B0} - C:\WINDOWS\System32\NouvellesMP3 (file missing)
                  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
                  O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
                  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
                  O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q304&bd=presario&pf=laptop
                  O16 - DPF: {15651C7C-E812-44A2-A9AC-B467A2233E7D} - http://portail.escritorioactivo.com/GIDCAI32.cab
                  O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} - http://www.bocata.net/webs/FR_Pop1/laaplicacion.cab
                  O16 - DPF: {92ABACFE-EF6E-42C7-A824-D50A914B5B70} (MastaCash Loader Class) - http://dx.mastacash.com/loader.cab
                  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab
                  O16 - DPF: {9C5B2F29-1F46-4639-A6B4-828942301D3E} - http://portail.escritorioactivo.com/SIPSPI32.cab
                  O17 - HKLM\System\CCS\Services\Tcpip\..\{C9CCEE2B-E37D-41AE-9780-E6247C5D6B61}: NameServer = 80.10.246.5 80.10.246.136
                  O20 - Winlogon Notify: adwms - C:\WINDOWS\Microsoft.NET\adwms.dll
                  O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
                  O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
                  O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Unknown owner - C:\Program Files\Norton AntiVirus\navapsvc.exe (file missing)
                  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
                  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
                  O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender Professional Edition\vsserv.exe
                  O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

                  PS : sivous trouvez des trucs bizarres n'hésitez pas à le signaler...marci!
                  0
                  1. jeremy
                    en fait mon pc detecte mal mon modem, d foi sa va mai d fois il fo attendre asser lontemps. Je ne pense pa que ce soucis vienne de mes branchement mai bon c pa grave.
                    Peut etre que sa vient du modem et que le virus la endommager, ou c peut etre la ligne.

                    a+
                    0
                    1. Utilisateur anonyme
                      salut jeremy,
                      si je comprends tu as du mal a te connecter? De ton modem a la prise telephonique , ton cable doit etre court, c est le cas?

                      a+
                      0
                      1. jeremy
                        non g tjr qque problem mais c pa grave c peut mes branchement. tinkiete pa vou avez deja fai du bon boulot car mon pc ne rame plu.

                        merci encore.
                        0
                        1. Utilisateur anonyme
                          reinstaller ton modem

                          a+
                          0
                          1. jeremy
                            je dois reinstaller mon internet?
                            ba je vai essayer et je verai bien le résultat
                            Merci encore pour ton aide
                            a+
                            0
                            1. Utilisateur anonyme
                              salut,
                              tu as essayer de le reinstaller?
                              0
                              1. jeremy
                                g toujour des probleme de connexion mon modem deconne je peut me connecter que de temp en temp
                                0
                                1. jeremy
                                  au debut mon modem ne se connecte pa tjr mais je v reessayer, jte remerci pour ton aide qui ma été precieuse je te tien au courant. Merci encore vos explication st clair et precise, continuer ainsi.

                                  a+
                                  0
                                  1. jean38 Contributeur
                                    Salut dom,

                                    peux tu tester le fichier :

                                    C:\WINDOWS\System32\wupaderees.exe

                                    en te rendant sur le site

                                    http://virusscan.jotti.org

                                    tu parcours pour acceder au fichier puis tu cliques sur submit et colle les reponses

                                    @+

                                    jean
                                    0
                                    1. parada
                                      bonjour, j'ai des gros soucis avec mon PC depuis peu detemps j'ai des pubs intempestives, et mon PC ne detecte plus ma freebox et ma carte son, de plus j'ai plein de trojan qui essayent de rentré + des backdoor ?
                                      backdoor.win92.Rbot.gen
                                      backdoor.win32.Rbot.rk
                                      plus ca va et plus le PC debloque j'ai vraiment besoin d'aide surtoutr que je comprends pas trop l'informatique... merci de m'aider

                                      Logfile of HijackThis v1.99.1
                                      Scan saved at 12:57:10, on 04/06/2005
                                      Platform: Windows XP SP1 (WinNT 5.01.2600)
                                      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

                                      Running processes:
                                      C:\WINDOWS\System32\smss.exe
                                      C:\WINDOWS\system32\winlogon.exe
                                      C:\WINDOWS\system32\services.exe
                                      C:\WINDOWS\system32\lsass.exe
                                      C:\WINDOWS\System32\Ati2evxx.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\WINDOWS\System32\svchost.exe
                                      C:\WINDOWS\system32\spoolsv.exe
                                      C:\WINDOWS\Explorer.EXE
                                      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                                      C:\WINDOWS\system32\dla\tfswctrl.exe
                                      C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe
                                      C:\WINDOWS\System32\qttask.exe
                                      C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
                                      C:\WINDOWS\System32\hphmon03.exe
                                      C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe
                                      C:\WINDOWS\System32\LVCOMSX.EXE
                                      C:\Program Files\Logitech\Video\LogiTray.exe
                                      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                                      C:\WINDOWS\System32\wupaderees.exe
                                      C:\Program Files\Repair Registry Pro\RepairRegistryPro.exe
                                      C:\WINDOWS\System32\ctfmon.exe
                                      C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exe
                                      C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
                                      C:\WINDOWS\System32\svchost.exe
                                      C:\Program Files\Logitech\Video\FxSvr2.exe
                                      C:\WINDOWS\System32\HPHipm09.exe
                                      C:\Program Files\Outlook Express\msimn.exe
                                      C:\Program Files\Messenger\msmsgs.exe
                                      C:\Program Files\Internet Explorer\iexplore.exe
                                      C:\Documents and Settings\pinto\Mes documents\HijackThis.exe
                                      C:\WINDOWS\system32\cmd.exe

                                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.vhmxfovsroolxhojkeazmn.net/uSzQNuj0Szuyt229otBcR2wNpAM7JCffjVRbxr6HUf0wBBgerK0t6VVOxpVfQqw_.jsp
                                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.free.fr/
                                      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;;localhost;<local>
                                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
                                      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                                      O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
                                      O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
                                      O2 - BHO: (no name) - {96ED27CE-5D48-5433-74C8-4121DD96C2C1} - C:\DOCUME~1\pinto\APPLIC~1\KNOBLO~1\Default Bold.exe (file missing)
                                      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
                                      O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
                                      O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
                                      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                                      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
                                      O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
                                      O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                                      O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
                                      O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
                                      O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\System32\qttask.exe
                                      O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
                                      O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\System32\hphmon03.exe
                                      O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
                                      O4 - HKLM\..\Run: [HGTXPEI] C:\WINDOWS\System32\FirstReboot.exe
                                      O4 - HKLM\..\Run: [KAVPersonal50] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe /minimize
                                      O4 - HKLM\..\Run: [SearchUpgrader] C:\Program Files\Common files\SearchUpgrader\SearchUpgrader.exe
                                      O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"
                                      O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
                                      O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
                                      O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
                                      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                                      O4 - HKLM\..\RunServices: [Microsoft DDEs Control] wupaderees.exe
                                      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
                                      O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
                                      O4 - HKCU\..\Run: [LDM] \Program\
                                      O4 - HKCU\..\Run: [SAPO Messenger] "C:\Program Files\SAPO Messenger\sapoim.exe" /silent
                                      O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exe
                                      O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                                      O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
                                      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                                      O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
                                      O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
                                      O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
                                      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                                      O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
                                      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
                                      O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
                                      O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                                      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
                                      O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
                                      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by22fd.bay22.hotmail.msn.com/resources/MsnPUpld.cab
                                      O16 - DPF: {54C75FB0-6B8B-4278-BF7B-77036F15A69E} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1041_FR_XP.cab
                                      O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/268811b0bad9eb8c2021/netzip/RdxIE601_fr.cab
                                      O16 - DPF: {5DDCC37F-7C6B-48B8-9664-97C537920CA0} (aecviz Class) - http://www.maisonphenix.com/npaecviz.cab
                                      O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
                                      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                                      O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
                                      O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.dll
                                      O16 - DPF: {DF4F4ED9-420B-4F40-AEE6-A620460306E7} (CantocheLivingActorInstaller2 Class) - http://ak.cdiscount.com/plug-ins/LivingActorInstaller2.cab
                                      O16 - DPF: {DF7A9F1F-E06B-4BE7-A27E-1BE7EA5AFC1C} - http://www.infodialer3000.com/perfiles2/infosistemas3000.cab
                                      O18 - Protocol: bw+0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw+0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw-0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw-0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw00 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw00s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw10 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw10s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw20 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw20s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw30 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw30s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw40 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw40s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw50 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw50s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw60 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw60s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw70 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw70s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw80 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw80s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw90 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bw90s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwa0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwa0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwb0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwb0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwc0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwc0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwd0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwd0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwe0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwe0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwf0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwf0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                                      O18 - Protocol: bwg0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwg0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwh0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwh0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwi0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwi0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwj0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwj0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwk0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwk0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwl0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwl0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwm0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwm0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwn0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwn0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwo0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwo0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwp0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwp0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwq0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwq0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwr0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwr0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bws0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bws0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwt0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwt0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwu0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwu0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwv0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwv0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bww0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bww0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwx0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwx0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwy0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwy0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwz0 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: bwz0s - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O18 - Protocol: offline-8876480 - {C87B26E5-AA17-4D05-8743-5ECC242043DF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                      O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
                                      O23 - Service: kavsvc - Kaspersky Labs - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
                                      O23 - Service: Pml Driver - HP - C:\WINDOWS\System32\HPHipm09.exe
                                      O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
                                      O23 - Service: Windows Update Service (wuamgrd) - Unknown owner - C:\WINDOWS\System32\wuamgrd.exe (file missing)
                                      0
                                      1. balltrap34 Contributeur sécurité
                                        cela a l air bon tu as encore des soucis
                                        0
                                        1. jeremy
                                          voila mon log :

                                          Logfile of HijackThis v1.99.1
                                          Scan saved at 15:08:21, on 04/06/2005
                                          Platform: Windows XP SP2 (WinNT 5.01.2600)
                                          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                                          Running processes:
                                          C:\WINDOWS\System32\smss.exe
                                          C:\WINDOWS\system32\winlogon.exe
                                          C:\WINDOWS\system32\services.exe
                                          C:\WINDOWS\system32\lsass.exe
                                          C:\WINDOWS\system32\svchost.exe
                                          C:\WINDOWS\System32\svchost.exe
                                          C:\WINDOWS\system32\spoolsv.exe
                                          C:\WINDOWS\System32\nvsvc32.exe
                                          C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                                          C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
                                          C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
                                          C:\Program Files\Softwin\BitDefender8\vsserv.exe
                                          C:\WINDOWS\Explorer.EXE
                                          C:\WINDOWS\AGRSMMSG.exe
                                          C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
                                          C:\Program Files\QuickTime\qttask.exe
                                          C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
                                          C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
                                          C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
                                          C:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exe
                                          C:\WINDOWS\System32\hphmon05.exe
                                          C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                                          C:\Program Files\Softwin\BitDefender8\bdoesrv.exe
                                          C:\program files\softwin\bitdefender8\bdnagent.exe
                                          C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
                                          C:\Program Files\Winamp\winampa.exe
                                          C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe
                                          C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                                          C:\WINDOWS\system32\ctfmon.exe
                                          C:\WINDOWS\system32\rundll32.exe
                                          C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                                          C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                          C:\Program Files\Internet Explorer\iexplore.exe
                                          C:\Program Files\WinRAR\WinRAR.exe
                                          C:\DOCUME~1\JRMY~1\LOCALS~1\Temp\Rar$EX00.406\HijackThis.exe

                                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q304&bd=pavilion&pf=laptop
                                          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
                                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                          O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
                                          O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                                          O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
                                          O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
                                          O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
                                          O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
                                          O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
                                          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
                                          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                                          O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
                                          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                                          O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
                                          O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
                                          O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
                                          O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
                                          O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
                                          O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
                                          O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
                                          O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                                          O4 - HKLM\..\Run: [BDOESRV] C:\Program Files\Softwin\BitDefender8\\bdoesrv.exe
                                          O4 - HKLM\..\Run: [BDNewsAgent] "c:\program files\softwin\bitdefender8\bdnagent.exe"
                                          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                                          O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
                                          O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
                                          O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"
                                          O4 - HKLM\..\Run: [adiras] adiras.exe
                                          O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                                          O4 - HKLM\..\Run: [eDonkey2000] C:\Program Files\eDonkey2000\eDonkey2000.exe -t
                                          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                                          O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
                                          O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
                                          O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
                                          O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                                          O4 - Global Startup: GStartup.lnk = C:\Program Files\Fichiers communs\GMT\GMT.exe
                                          O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                                          O4 - Global Startup: PrecisionTime.lnk = C:\Program Files\PrecisionTime\PrecisionTime.exe
                                          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
                                          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
                                          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                          O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q304&bd=pavilion&pf=laptop
                                          O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguard.com/installation/Install.cab
                                          O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/inflaterball/miniclipGameLoader.dll
                                          O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
                                          O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
                                          O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v6.cab
                                          O17 - HKLM\System\CCS\Services\Tcpip\..\{19E19ACD-B52D-4D38-ADA3-6F95EB7019A2}: NameServer = 217.19.192.131 217.19.192.132
                                          O17 - HKLM\System\CS1\Services\Tcpip\..\{19E19ACD-B52D-4D38-ADA3-6F95EB7019A2}: NameServer = 217.19.192.131 217.19.192.132
                                          O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
                                          O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
                                          O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                                          O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender8\vsserv.exe
                                          O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
                                          0
                                          • 1
                                          • 2
                                          • 3