Icône e-rouge dans le systray

Résolu
tamara007 -  
Bonjour à tous,

J'espère que l'un de vous pourra m'aider parce que ca fait quelques mois que je cherche une solution à mon problème.

J'ai eu le virus instant access et ai suivi toutes les indications pour virer les dossiers... mais depuis, une icone ressemblant à celle d'explorer mais en rouge apparait dans mon systray quand je ne bouge plus la souris pendant quelques minutes!!

Merci d'avance à tous

29 réponses

Résumé de la discussion

Le sujet porte sur l’apparition d’une icône rouge dans le systray, ressemblant à Explorer, après une période d’inactivité et d’infection supposée par Instant Access, avec impossibilité de cliquer tant que la souris demeure immobile. Des conseils portent sur la gestion des notifications et l’examen des programmes au démarrage, notamment la désinstallation de Popup Eclair et l’utilisation d’outils comme HijackThis pour générer un StartupList. La discussion inclut aussi des détails techniques issus des rapports StartupList et des entrées Run, montrant des éléments légitimes et potentiellement indésirables, et suggère de vérifier les extensions et les services actifs. En cas de doute, l’analyse de la configuration autorun et des programmes actifs peut aider à identifier des éléments suspects et à prévenir des redémarrages automatisés non souhaités.

Bobot (l’IA à votre service)
  1. balltrap34 Contributeur sécurité
    c est bizzard se truc d un seul coup
    si tu na pas instaler de prog pour optimise ta souris ou autre
    1. tamara007 Auteur
      non, j'ai toujours la meme!!
      Ecoute c'est pas grave, visiblement mon ordi n'en souffre pas alors je v arreter de t'ennuyer, c'est bien gentil d'y avoir consacré 1 peu de temps. MERCI

      tam
      1. k zo
        bonjour j'ai eu ce problème que j'ai résolu en désinstallant pop up eclair.
        si tu as ce logiciel je te conseille de le désinstaller
    2. balltrap34 Contributeur sécurité
      a tu installer une nouvelle souris ces derniers temp
      parce que la je vois pas lol
      1. tamara007 Auteur
        StartupList report, 12/11/2005, 15:43:11
        StartupList version: 1.52.2
        Started from : C:\hijackthis\HijackThis.EXE
        Detected: Windows XP SP2 (WinNT 5.01.2600)
        Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
        * Using default options
        * Including empty and uninteresting sections
        * Showing rarely important sections
        ==================================================

        Running processes:

        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
        C:\Program Files\Norton AntiVirus\navapsvc.exe
        C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
        C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
        C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
        C:\Program Files\Norton AntiVirus\SAVScan.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
        C:\Program Files\Microsoft IntelliPoint\point32.exe
        C:\Program Files\Microsoft IntelliType Pro\type32.exe
        C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
        C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
        C:\Program Files\Messenger Plus! 3\MsgPlus.exe
        C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Popup Eclair\popupeclair.exe
        C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
        C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
        C:\Program Files\Extensis\Suitcase\Suitcase.exe
        C:\Program Files\MSN Messenger\msnmsgr.exe
        C:\Program Files\Messenger\msmsgs.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\hijackthis\HijackThis.exe

        --------------------------------------------------

        Listing of startup folders:

        Shell folders Startup:
        [C:\Documents and Settings\Frédérique Matthys\Menu Démarrer\Programmes\Démarrage]
        *No files*

        Shell folders AltStartup:
        *Folder not found*

        User shell folders Startup:
        *Folder not found*

        User shell folders AltStartup:
        *Folder not found*

        Shell folders Common Startup:
        [C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]
        Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
        Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
        Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
        Suitcase Startup.lnk = ?

        Shell folders Common AltStartup:
        *Folder not found*

        User shell folders Common Startup:
        *Folder not found*

        User shell folders Alternate Common Startup:
        *Folder not found*

        --------------------------------------------------

        Checking Windows NT UserInit:

        [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
        UserInit = C:\WINDOWS\system32\userinit.exe,

        [HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
        *Registry key not found*

        [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
        *Registry value not found*

        [HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
        *Registry key not found*

        --------------------------------------------------

        Autorun entries from Registry:
        HKLM\Software\Microsoft\Windows\CurrentVersion\Run

        ccApp = "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
        Advanced Tools Check = C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
        IntelliPoint = "C:\Program Files\Microsoft IntelliPoint\point32.exe"
        type32 = "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
        HPDJ Taskbar Utility = C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
        Share-to-Web Namespace Daemon = C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
        MessengerPlus3 = "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
        Symantec NetDriver Monitor = C:\PROGRA~1\SYMNET~1\SNDMon.exe
        MediaFace Integration = C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
        PinnacleDriverCheck = C:\WINDOWS\system32\PSDrvCheck.exe
        SunJavaUpdateSched = C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
        iTunesHelper = "C:\Program Files\iTunes\iTunesHelper.exe"
        QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime

        --------------------------------------------------

        Autorun entries from Registry:
        HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

        *No values found*

        --------------------------------------------------

        Autorun entries from Registry:
        HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

        *No values found*

        --------------------------------------------------

        Autorun entries from Registry:
        HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

        *Registry key not found*

        --------------------------------------------------

        Autorun entries from Registry:
        HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

        *Registry key not found*

        --------------------------------------------------

        Autorun entries from Registry:
        HKCU\Software\Microsoft\Windows\CurrentVersion\Run

        CTFMON.EXE = C:\WINDOWS\system32\ctfmon.exe
        popupeclair = C:\Program Files\Popup Eclair\popupeclair.exe
        H/PC Connection Agent = "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"

        --------------------------------------------------

        Autorun entries from Registry:
        HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

        *Registry key not found*

        --------------------------------------------------

        Autorun entries from Registry:
        HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

        *Registry key not found*

        --------------------------------------------------

        Autorun entries from Registry:
        HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

        *Registry key not found*

        --------------------------------------------------

        Autorun entries from Registry:
        HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

        *Registry key not found*

        --------------------------------------------------

        Autorun entries from Registry:
        HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

        *Registry key not found*

        --------------------------------------------------

        Autorun entries from Registry:
        HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

        *Registry key not found*

        --------------------------------------------------

        Autorun entries in Registry subkeys of:
        HKLM\Software\Microsoft\Windows\CurrentVersion\Run

        [OptionalComponents]
        *No values found*

        --------------------------------------------------

        Autorun entries in Registry subkeys of:
        HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
        *No subkeys found*

        --------------------------------------------------

        Autorun entries in Registry subkeys of:
        HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
        *No subkeys found*

        --------------------------------------------------

        Autorun entries in Registry subkeys of:
        HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
        *Registry key not found*

        --------------------------------------------------

        Autorun entries in Registry subkeys of:
        HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
        *Registry key not found*

        --------------------------------------------------

        Autorun entries in Registry subkeys of:
        HKCU\Software\Microsoft\Windows\CurrentVersion\Run
        *No subkeys found*

        --------------------------------------------------

        Autorun entries in Registry subkeys of:
        HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
        *Registry key not found*

        --------------------------------------------------

        Autorun entries in Registry subkeys of:
        HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
        *Registry key not found*

        --------------------------------------------------

        Autorun entries in Registry subkeys of:
        HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
        *Registry key not found*

        --------------------------------------------------

        Autorun entries in Registry subkeys of:
        HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
        *Registry key not found*

        --------------------------------------------------

        Autorun entries in Registry subkeys of:
        HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
        *Registry key not found*

        --------------------------------------------------

        Autorun entries in Registry subkeys of:
        HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
        *Registry key not found*

        --------------------------------------------------

        File association entry for .EXE:
        HKEY_CLASSES_ROOT\exefile\shell\open\command

        (Default) = "%1" %*

        --------------------------------------------------

        File association entry for .COM:
        HKEY_CLASSES_ROOT\comfile\shell\open\command

        (Default) = "%1" %*

        --------------------------------------------------

        File association entry for .BAT:
        HKEY_CLASSES_ROOT\batfile\shell\open\command

        (Default) = "%1" %*

        --------------------------------------------------

        File association entry for .PIF:
        HKEY_CLASSES_ROOT\piffile\shell\open\command

        (Default) = "%1" %*

        --------------------------------------------------

        File association entry for .SCR:
        HKEY_CLASSES_ROOT\scrfile\shell\open\command

        (Default) = "%1" /S

        --------------------------------------------------

        File association entry for .HTA:
        HKEY_CLASSES_ROOT\htafile\shell\open\command

        (Default) = C:\WINDOWS\System32\mshta.exe "%1" %*

        --------------------------------------------------

        File association entry for .TXT:
        HKEY_CLASSES_ROOT\txtfile\shell\open\command

        (Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

        --------------------------------------------------

        Enumerating Active Setup stub paths:
        HKLM\Software\Microsoft\Active Setup\Installed Components
        (* = disabled by HKCU twin)

        [>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
        StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

        [>{26923b43-4d38-484f-9b9e-de460746276c}] *
        StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

        [>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
        StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

        [>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
        StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

        [{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
        StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

        [{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
        StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

        [{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
        StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

        [{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
        StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

        [{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
        StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub

        [{7790769C-0471-11d2-AF11-00C04FA35D02}] *
        StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

        [{89820200-ECBD-11cf-8B85-00AA005B4340}] *
        StubPath = regsvr32.exe /s /n /i:U shell32.dll

        [{89820200-ECBD-11cf-8B85-00AA005B4383}] *
        StubPath = %SystemRoot%\system32\ie4uinit.exe

        --------------------------------------------------

        Enumerating ICQ Agent Autostart apps:
        HKCU\Software\Mirabilis\ICQ\Agent\Apps

        *Registry key not found*

        --------------------------------------------------

        Load/Run keys from C:\WINDOWS\WIN.INI:

        load=*INI section not found*
        run=*INI section not found*

        Load/Run keys from Registry:

        HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
        HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
        HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
        HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
        HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
        HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
        HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
        HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
        HKCU\..\Windows NT\CurrentVersion\Windows: load=
        HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
        HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
        HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
        HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=MsgPlusLoader.dll

        --------------------------------------------------

        Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

        Shell=*INI section not found*
        SCRNSAVE.EXE=*INI section not found*
        drivers=*INI section not found*

        Shell & screensaver key from Registry:

        Shell=Explorer.exe
        SCRNSAVE.EXE=C:\WINDOWS\System32\ssstars.scr
        drivers=*Registry value not found*

        Policies Shell key:

        HKCU\..\Policies: Shell=*Registry key not found*
        HKLM\..\Policies: Shell=*Registry value not found*

        --------------------------------------------------

        Checking for EXPLORER.EXE instances:

        C:\WINDOWS\Explorer.exe: PRESENT!

        C:\Explorer.exe: not present
        C:\WINDOWS\Explorer\Explorer.exe: not present
        C:\WINDOWS\System\Explorer.exe: not present
        C:\WINDOWS\System32\Explorer.exe: not present
        C:\WINDOWS\Command\Explorer.exe: not present
        C:\WINDOWS\Fonts\Explorer.exe: not present

        --------------------------------------------------

        Checking for superhidden extensions:

        .lnk: HIDDEN! (arrow overlay: yes)
        .pif: HIDDEN! (arrow overlay: yes)
        .exe: not hidden
        .com: not hidden
        .bat: not hidden
        .hta: not hidden
        .scr: not hidden
        .shs: HIDDEN!
        .shb: HIDDEN!
        .vbs: not hidden
        .vbe: not hidden
        .wsh: not hidden
        .scf: HIDDEN! (arrow overlay: NO!)
        .url: HIDDEN! (arrow overlay: yes)
        .js: not hidden
        .jse: not hidden

        --------------------------------------------------

        Verifying REGEDIT.EXE integrity:

        - Regedit.exe found in C:\WINDOWS
        - .reg open command is normal (regedit.exe %1)
        - Regedit.exe has no CompanyName property! It is either missing or named something else.
        - Regedit.exe has no OriginalFilename property! It is either missing or named something else.
        - Regedit.exe has no FileDescription property! It is either missing or named something else.

        Registry check failed!

        --------------------------------------------------

        Enumerating Browser Helper Objects:

        (no name) - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
        (no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
        (no name) - (no file) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB}
        (no name) - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll - {AE7CD045-E861-484f-8273-0445EE161910}
        NAV Helper - C:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}

        --------------------------------------------------

        Enumerating Task Scheduler jobs:

        Norton AntiVirus - Scan my computer.job
        Symantec NetDetect.job
        XoftSpy.job

        --------------------------------------------------

        Enumerating Download Program Files:

        [DirectAnimation Java Classes]
        CODEBASE = file://C:\WINDOWS\Java\classes\dajava.cab
        OSD = C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd

        [Microsoft XML Parser for Java]
        CODEBASE = file://C:\WINDOWS\Java\classes\xmldso.cab
        OSD = C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd

        [Shockwave ActiveX Control]
        InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll
        CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

        [BDSCANONLINE Control]
        InProcServer32 = C:\WINDOWS\DOWNLO~1\oscan8.ocx
        CODEBASE = http://www.bitdefender.fr/scan8/oscan8.cab

        [WUWebControl Class]
        InProcServer32 = C:\WINDOWS\System32\wuweb.dll
        CODEBASE = http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1119863864265

        [Java Plug-in 1.5.0_04]
        InProcServer32 = C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
        CODEBASE = http://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab

        [MsnMessengerSetupDownloadControl Class]
        InProcServer32 = C:\WINDOWS\Downloaded Program Files\MsnMessengerSetupDownloader.ocx
        CODEBASE = http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

        [Java Plug-in 1.5.0_02]
        InProcServer32 = C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
        CODEBASE = http://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab

        [Java Plug-in 1.5.0_04]
        InProcServer32 = C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
        CODEBASE = http://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab

        [Shockwave Flash Object]
        InProcServer32 = C:\WINDOWS\system32\macromed\flash\Flash.ocx
        CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

        --------------------------------------------------

        Enumerating Winsock LSP files:

        NameSpace #1: C:\WINDOWS\System32\mswsock.dll
        NameSpace #2: C:\WINDOWS\System32\winrnr.dll
        NameSpace #3: C:\WINDOWS\System32\mswsock.dll
        Protocol #1: C:\WINDOWS\system32\mswsock.dll
        Protocol #2: C:\WINDOWS\system32\mswsock.dll
        Protocol #3: C:\WINDOWS\system32\mswsock.dll
        Protocol #4: C:\WINDOWS\system32\rsvpsp.dll
        Protocol #5: C:\WINDOWS\system32\rsvpsp.dll
        Protocol #6: C:\WINDOWS\system32\mswsock.dll
        Protocol #7: C:\WINDOWS\system32\mswsock.dll
        Protocol #8: C:\WINDOWS\system32\mswsock.dll
        Protocol #9: C:\WINDOWS\system32\mswsock.dll
        Protocol #10: C:\WINDOWS\system32\mswsock.dll
        Protocol #11: C:\WINDOWS\system32\mswsock.dll

        --------------------------------------------------

        Enumerating Windows NT/2000/XP services

        Pilote ACPI Microsoft: System32\DRIVERS\ACPI.sys (system)
        Adobe LM Service: "C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe" (manual start)
        aeaudio: system32\drivers\aeaudio.sys (manual start)
        Suppresseur d'écho acoustique (Noyau Microsoft): system32\drivers\aec.sys (manual start)
        Environnement de prise en charge de réseau AFD: \SystemRoot\System32\drivers\afd.sys (system)
        Filtre de bus AGP Intel: System32\DRIVERS\agp440.sys (system)
        Avertissement: %SystemRoot%\System32\svchost.exe -k LocalService (disabled)
        Service de la passerelle de la couche Application: %SystemRoot%\System32\alg.exe (manual start)
        Gestion d'applications: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
        ASAPIW2K: System32\Drivers\ASAPIW2K.sys (manual start)
        Aspi32: System32\drivers\aspi32.sys (autostart)
        Pilote de média asynchrone RAS: System32\DRIVERS\asyncmac.sys (manual start)
        Contrôleur de disque dur IDE/ESDI standard: System32\DRIVERS\atapi.sys (system)
        Protocole client ATM ARP: System32\DRIVERS\atmarpc.sys (manual start)
        Audio Windows: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
        Pilote audio Stub: System32\DRIVERS\audstub.sys (manual start)
        Service de transfert intelligent en arrière-plan: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
        Explorateur d'ordinateur: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
        Symantec Event Manager: "C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe" (autostart)
        Symantec Password Validation: "C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe" (manual start)
        Symantec Settings Manager: "C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe" (autostart)
        Cdrdrv: System32\Drivers\Cdrdrv.sys (manual start)
        Pilote de CD-ROM: System32\DRIVERS\cdrom.sys (system)
        Service d'indexation: %SystemRoot%\system32\cisvc.exe (manual start)
        Gestionnaire de l'Album: %SystemRoot%\system32\clipsrv.exe (disabled)
        Application système COM+: C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
        Services de cryptographie: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
        Lanceur de processus serveur DCOM: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
        Client DHCP: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
        Pilote de disque: System32\DRIVERS\disk.sys (system)
        Service d'administration du Gestionnaire de disque logique: %SystemRoot%\System32\dmadmin.exe /com (manual start)
        dmboot: System32\drivers\dmboot.sys (disabled)
        Pilote de Gestionnaire de disque logique: System32\drivers\dmio.sys (system)
        dmload: System32\drivers\dmload.sys (system)
        Gestionnaire de disque logique: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
        Synthétiseur DLS du noyau Microsoft: system32\drivers\DMusic.sys (manual start)
        Client DNS: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart)
        Filtre de décodeur DRM (Noyau Microsoft): system32\drivers\drmkaud.sys (manual start)
        Service de rapport d'erreurs: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
        Journal des événements: %SystemRoot%\system32\services.exe (autostart)
        Système d'événements de COM+: C:\WINDOWS\System32\svchost.exe -k netsvcs (manual start)
        Compatibilité avec le Changement rapide d'utilisateur: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
        Pilote de contrôleur de lecteur de disquettes: System32\DRIVERS\fdc.sys (manual start)
        Pilote de lecteur de disquettes: System32\DRIVERS\flpydisk.sys (manual start)
        FltMgr: system32\drivers\fltmgr.sys (system)
        Pilote du Gestionnaire de volume: System32\DRIVERS\ftdisk.sys (system)
        Énumérateur de port jeu: System32\DRIVERS\gameenum.sys (manual start)
        GEAR CDRom Filter: SYSTEM32\DRIVERS\GEARAspiWDM.sys (manual start)
        Classificateur de paquets générique: System32\DRIVERS\msgpc.sys (manual start)
        Aide et support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
        Accès du périphérique d'interface utilisateur: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
        Pilote de classe HID Microsoft: System32\DRIVERS\hidusb.sys (manual start)
        HTTP: System32\Drivers\HTTP.sys (manual start)
        HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)
        Pilote pour clavier i8042 et souris sur port PS/2: System32\DRIVERS\i8042prt.sys (system)
        InstallDriver Table Manager: "C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe" (manual start)
        Pilote de filtre de gravure CD: System32\DRIVERS\imapi.sys (system)
        Service COM de gravage de CD IMAPI: C:\WINDOWS\System32\imapi.exe (manual start)
        IntelIde: System32\DRIVERS\intelide.sys (system)
        Pilote de processeur Intel: System32\DRIVERS\intelppm.sys (system)
        Pilote du pare-feu Windows IPv6: system32\drivers\ip6fw.sys (manual start)
        Pilote de filtre de trafic IP: System32\DRIVERS\ipfltdrv.sys (manual start)
        Pilote de tunnelage IP dans IP: System32\DRIVERS\ipinip.sys (manual start)
        Traducteur d'adresses réseau IP: System32\DRIVERS\ipnat.sys (manual start)
        iPodService: C:\Program Files\iPod\bin\iPodService.exe (manual start)
        Pilote IPSEC: System32\DRIVERS\ipsec.sys (system)
        Service énumérateur IR: System32\DRIVERS\irenum.sys (manual start)
        Pilote de bus Plug-and-Play ISA/EISA: System32\DRIVERS\isapnp.sys (system)
        Pilote de la classe Clavier: System32\DRIVERS\kbdclass.sys (system)
        Mélangeur audio Wave de noyau Microsoft: system32\drivers\kmixer.sys (manual start)
        Serveur: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
        Station de travail: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
        Assistance TCP/IP NetBIOS: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
        Macromedia Licensing Service: "C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe" (manual start)
        Affichage des messages: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
        Partage de Bureau à distance NetMeeting: C:\WINDOWS\System32\mnmsrvc.exe (manual start)
        Pilote de la classe Souris: System32\DRIVERS\mouclass.sys (system)
        Pilote HID de souris: System32\DRIVERS\mouhid.sys (manual start)
        Redirecteur client WebDav: System32\DRIVERS\mrxdav.sys (manual start)
        MRXSMB: System32\DRIVERS\mrxsmb.sys (system)
        Distributed Transaction Coordinator: C:\WINDOWS\System32\msdtc.exe (manual start)
        Windows Installer: C:\WINDOWS\system32\msiexec.exe /V (manual start)
        Proxy de service de répartition Microsoft: system32\drivers\MSKSSRV.sys (manual start)
        Proxy d'horloge de répartition Microsoft: system32\drivers\MSPCLOCK.sys (manual start)
        Proxy de gestion de qualité de répartition Microsoft: system32\drivers\MSPQM.sys (manual start)
        Pilote BIOS de gestion de systèmes Microsoft: System32\DRIVERS\mssmbios.sys (manual start)
        Norton AntiVirus Auto Protect Service: "C:\Program Files\Norton AntiVirus\navapsvc.exe" (autostart)
        NAVENG: \??\C:\PROGRA~1\FICHIE~1\SYMANT~1\VIRUSD~1\20051110.009\NAVENG.Sys (manual start)
        NAVEX15: \??\C:\PROGRA~1\FICHIE~1\SYMANT~1\VIRUSD~1\20051110.009\NavEx15.Sys (manual start)
        Pilote TAPI NDIS d'accès distant: System32\DRIVERS\ndistapi.sys (manual start)
        NDIS mode utilisateur E/S Protocole: System32\DRIVERS\ndisuio.sys (manual start)
        Pilote réseau étendu NDIS d'accès distant: System32\DRIVERS\ndiswan.sys (manual start)
        Interface NetBIOS: System32\DRIVERS\netbios.sys (system)
        NetBT: System32\DRIVERS\netbt.sys (system)
        DDE réseau: %SystemRoot%\system32\netdde.exe (disabled)
        DSDM DDE réseau: %SystemRoot%\system32\netdde.exe (disabled)
        Ouverture de session réseau: %SystemRoot%\System32\lsass.exe (manual start)
        Connexions réseau: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
        NLA (Network Location Awareness): %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
        Norton Unerase Protection Driver: \??\C:\WINDOWS\System32\Drivers\NPDRIVER.SYS (manual start)
        Norton Unerase Protection: C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE (autostart)
        Fournisseur de la prise en charge de sécurité LM NT: %SystemRoot%\System32\lsass.exe (manual start)
        Stockage amovible: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
        nv: System32\DRIVERS\nv4_mini.sys (manual start)
        NVIDIA NDIS IO Control Driver: \??\C:\WINDOWS\system32\Drivers\NvNdis.sys (autostart)
        Pilote de filtre de trafic IPX: System32\DRIVERS\nwlnkflt.sys (manual start)
        Pilote de transfert de trafic IPX: System32\DRIVERS\nwlnkfwd.sys (manual start)
        Pilote de port parallèle: System32\DRIVERS\parport.sys (manual start)
        Pilote de bus PCI: System32\DRIVERS\pci.sys (system)
        Low level access layer for CD devices: System32\Drivers\Pcouffin.sys (manual start)
        Padus ASPI Shell: system32\drivers\pfc.sys (manual start)
        Plug-and-Play: %SystemRoot%\system32\services.exe (autostart)
        Microsoft IntelliPoint Filter Driver: System32\DRIVERS\point32.sys (manual start)
        Services IPSEC: %SystemRoot%\System32\lsass.exe (autostart)
        Miniport réseau étendu (PPTP): System32\DRIVERS\raspptp.sys (manual start)
        Pilote processeur: System32\DRIVERS\processr.sys (system)
        Emplacement protégé: %SystemRoot%\system32\lsass.exe (autostart)
        Planificateur de paquets QoS: System32\DRIVERS\psched.sys (manual start)
        Pilote de liaison parallèle directe: System32\DRIVERS\ptilink.sys (manual start)
        Pilote de connexion automatique d'accès distant: System32\DRIVERS\rasacd.sys (system)
        Gestionnaire de connexion automatique d'accès distant: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
        Miniport réseau étendu (L2TP): System32\DRIVERS\rasl2tp.sys (manual start)
        Gestionnaire de connexions d'accès distant: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
        Pilote PPPOE d'accès à distance: System32\DRIVERS\raspppoe.sys (manual start)
        Parallèle direct: System32\DRIVERS\raspti.sys (manual start)
        Rdbss: System32\DRIVERS\rdbss.sys (system)
        RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
        Pilote de redirecteur de périphérique Terminal Server: System32\DRIVERS\rdpdr.sys (manual start)
        Gestionnaire de session d'aide sur le Bureau à distance: C:\WINDOWS\system32\sessmgr.exe (manual start)
        Pilote de filtre de lecture digitale de CD audio: System32\DRIVERS\redbook.sys (system)
        Routage et accès distant: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
        Accès à distance au Registre: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
        Localisateur d'appels de procédure distante (RPC): %SystemRoot%\System32\locator.exe (manual start)
        Appel de procédure distante (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
        QoS RSVP: %SystemRoot%\System32\rsvp.exe (manual start)
        Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C): System32\DRIVERS\RTL8139.SYS (manual start)
        Gestionnaire de comptes de sécurité: %SystemRoot%\system32\lsass.exe (autostart)
        SAVRT: \??\C:\Program Files\Norton AntiVirus\SAVRT.SYS (manual start)
        SAVRTPEL: \??\C:\Program Files\Norton AntiVirus\SAVRTPEL.SYS (system)
        SAVScan: C:\Program Files\Norton AntiVirus\SAVScan.exe (manual start)
        ScriptBlocking Service: C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe (autostart)
        Carte à puce: %SystemRoot%\System32\SCardSvr.exe (manual start)
        Planificateur de tâches: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
        Secdrv: System32\DRIVERS\secdrv.sys (manual start)
        Connexion secondaire: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
        Notification d'événement système: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
        Pilote de filtre Serenum: System32\DRIVERS\serenum.sys (manual start)
        Pilote de port série: System32\DRIVERS\serial.sys (system)
        Pare-feu Windows / Partage de connexion Internet: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
        Détection matériel noyau: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
        smwdm: system32\drivers\smwdm.sys (manual start)
        Symantec Network Drivers Service: "C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe" (manual start)
        Splitter audio du noyau Microsoft: system32\drivers\splitter.sys (manual start)
        Spouleur d'impression: %SystemRoot%\system32\spoolsv.exe (autostart)
        Pilote de filtre de restauration système: System32\DRIVERS\sr.sys (system)
        Service de restauration système: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
        Srv: System32\DRIVERS\srv.sys (manual start)
        Service de découvertes SSDP: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)
        Acquisition d'image Windows (WIA): %SystemRoot%\System32\svchost.exe -k imgsvc (autostart)
        Pilote de bus logiciel: System32\DRIVERS\swenum.sys (manual start)
        Synthétiseur de table de sons GC noyau Microsoft: system32\drivers\swmidi.sys (manual start)
        MS Software Shadow Copy Provider: C:\WINDOWS\System32\dllhost.exe /Processid:{CE82915E-C89D-485A-8A40-7369E1CC0140} (manual start)
        Symantec Core LC: C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe (autostart)
        SymEvent: \??\C:\Program Files\Symantec\SYMEVENT.SYS (manual start)
        symlcbrd: \??\C:\WINDOWS\System32\drivers\symlcbrd.sys (autostart)
        SYMREDRV: \SystemRoot\System32\Drivers\SYMREDRV.SYS (manual start)
        SYMTDI: \SystemRoot\System32\Drivers\SYMTDI.SYS (system)
        SymWMI Service: "C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe" (autostart)
        Périphérique audio système du noyau Microsoft: system32\drivers\sysaudio.sys (manual start)
        Journaux et alertes de performance: %SystemRoot%\system32\smlogsvc.exe (manual start)
        Téléphonie: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
        Pilote du protocole TCP/IP: System32\DRIVERS\tcpip.sys (system)
        Pilote de périphérique terminal: System32\DRIVERS\termdd.sys (system)
        Services Terminal Server: %SystemRoot%\System32\svchost -k DComLaunch (manual start)
        Thèmes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
        Telnet: C:\WINDOWS\System32\tlntsvr.exe (disabled)
        Client de suivi de lien distribué: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
        Windows User Mode Driver Framework: C:\WINDOWS\system32\wdfmgr.exe (autostart)
        Pilote de mise à jour microcode: System32\DRIVERS\update.sys (manual start)
        Hôte de périphérique universel Plug-and-Play: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)
        Onduleur: %SystemRoot%\System32\ups.exe (manual start)
        Pilote miniport de contrôleur hôte amélioré USB 2.0 Microsoft: System32\DRIVERS\usbehci.sys (manual start)
        Concentrateur USB2: System32\DRIVERS\usbhub.sys (manual start)
        Classe d'imprimantes USB Microsoft: System32\DRIVERS\usbprint.sys (manual start)
        Pilote de scanneur USB: System32\DRIVERS\usbscan.sys (manual start)
        Pilote de stockage de masse USB: System32\DRIVERS\USBSTOR.SYS (manual start)
        Pilote miniport de contrôleur hôte universel USB Microsoft: System32\DRIVERS\usbuhci.sys (manual start)
        Carte vidéo VGA.: \SystemRoot\System32\drivers\vga.sys (system)
        VOBID: system32\DRIVERS\vobid.sys (system)
        Cliché instantané de volume: %SystemRoot%\System32\vssvc.exe (manual start)
        Horloge Windows: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
        Pilote ARP IP d'accès distant: System32\DRIVERS\wanarp.sys (manual start)
        Windows CE USB Serial Host Driver: system32\DRIVERS\wceusbsh.sys (manual start)
        Pilote WINMM de compatibilité audio WDM Microsoft: system32\drivers\wdmaud.sys (manual start)
        WebClient: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
        Infrastructure de gestion Windows: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
        Service de numéro de série du lecteur multimédia portable: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
        Extensions du pilote WMI: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
        Carte de performance WMI: C:\WINDOWS\System32\wbem\wmiapsrv.exe (manual start)
        Centre de sécurité: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
        Mises à jour automatiques: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
        Configuration automatique sans fil: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
        Service d'approvisionnement réseau: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

        --------------------------------------------------

        Enumerating Windows NT logon/logoff scripts:
        *No scripts set to run*

        Windows NT checkdisk command:
        BootExecute = autocheck autochk *

        Windows NT 'Wininit.ini':
        PendingFileRenameOperations: *Registry value not found*

        --------------------------------------------------

        Enumerating ShellServiceObjectDelayLoad items:

        PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
        CDBurn: C:\WINDOWS\system32\SHELL32.dll
        WebCheck: C:\WINDOWS\System32\webcheck.dll
        SysTray: C:\WINDOWS\System32\stobject.dll

        --------------------------------------------------
        Autorun entries from Registry:
        HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

        *Registry key not found*

        --------------------------------------------------

        Autorun entries from Registry:
        HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

        *Registry key not found*

        --------------------------------------------------

        End of report, 36.506 bytes
        Report generated in 0,140 seconds

        Command line options:
        /verbose - to add additional info on each section
        /complete - to include empty sections and unsuspicious data
        /full - to include several rarely-important sections
        /force9x - to include Win9x-only startups even if running on WinNT
        /forcent - to include WinNT-only startups even if running on Win9x
        /forceall - to include all Win9x and WinNT startups, regardless of platform
        /history - to list version history only
        2. balltrap34 Contributeur sécurité
          salut
          relance hijack et clik sur open the misck tools
          ensuite coche les deux case a cote de generate startup list et ensuite cik dessus

          et donne le rapport
          1. tamara007 Auteur
            il n'est pas dedans, j'ai regardé, par contre dans la partie éléments précédents il y a un dossier access instant noté : toujours masqué!!
            1. Utilisateur anonyme
              re,
              clik droit sur la barre des taches
              personnalisation des notifications....
              retrouve tu ton e rouge?

              a+
              1. tamara007 Auteur
                Alors description,

                c'est un "e rouge", qui ressemble à l'icone d'internet explorer mais sansl'ellipse autour.
                Il apparait après environ 1 min d'inactivité de souris.
                Il m'est impossilbe de cliquer dessus parce que dès que je rebouge la souris, elle disparait!!

                voilà
                1. Utilisateur anonyme
                  re,
                  toujours cette icone, tu peux la decrire plus stp?
                  quand tu fais clik droit dessu, qu indique t elle

                  a+
                  1. tamara007 Auteur
                    oui oui je l'ai fait, d'ailleurs il m'a trouvé pas mal de fichier dans le dossier quarantaine de mon norton antivirus qu'il a viré.
                    1. Utilisateur anonyme
                      salut tamara
                      avais tu fais le scan en ligne sur bitdefender?

                      a+
                      1. tamara007 Auteur
                        "Silent Runners.vbs", revision 41, http://www.silentrunners.org/
                        Operating System: Windows XP SP2
                        Output limited to non-default values, except where indicated by "{++}"

                        Startup items buried in registry:
                        ---------------------------------

                        HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
                        "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
                        "popupeclair" = "C:\Program Files\Popup Eclair\popupeclair.exe" [null data]
                        "H/PC Connection Agent" = ""C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"" [MS]

                        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
                        "ccApp" = ""C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]
                        "Advanced Tools Check" = "C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE" ["Symantec Corporation"]
                        "IntelliPoint" = ""C:\Program Files\Microsoft IntelliPoint\point32.exe"" [MS]
                        "type32" = ""C:\Program Files\Microsoft IntelliType Pro\type32.exe"" [MS]
                        "HPDJ Taskbar Utility" = "C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe" ["HP"]
                        "Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]
                        "MessengerPlus3" = ""C:\Program Files\Messenger Plus! 3\MsgPlus.exe"" ["Patchou"]
                        "Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe" [file not found]
                        "MediaFace Integration" = "C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe" ["Fellowes, Inc."]
                        "PinnacleDriverCheck" = "C:\WINDOWS\system32\PSDrvCheck.exe" [empty string]
                        "UserFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -u" [MS]
                        "SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" ["Sun Microsystems, Inc."]
                        "iTunesHelper" = ""C:\Program Files\iTunes\iTunesHelper.exe"" ["Apple Computer, Inc."]
                        "QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]

                        HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
                        {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
                        {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
                        -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
                        {AE7CD045-E861-484f-8273-0445EE161910}\(Default) = "AcroIEToolbarHelper Class" [from CLSID]
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll" [null data]
                        {BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper"
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

                        HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
                        "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"
                        -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
                        "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"
                        -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
                        "{20082881-FC36-4E47-9A7A-644C95FF749F}" = "IntelliPoint Wireless Control Panel Property Page"
                        -> {CLSID}\InProcServer32\(Default) = ""C:\Program Files\Microsoft IntelliPoint\ipcplwir.dll"" [MS]
                        "{AF90F543-6A3A-4C1B-8B16-ECEC073E69BE}" = "IntelliPoint Wheel Control Panel Property Page"
                        -> {CLSID}\InProcServer32\(Default) = ""C:\Program Files\Microsoft IntelliPoint\ipcplwhl.dll"" [MS]
                        "{653DCCC2-13DB-45B2-A389-427885776CFE}" = "IntelliPoint Activities Control Panel Property Page"
                        -> {CLSID}\InProcServer32\(Default) = ""C:\Program Files\Microsoft IntelliPoint\ipcplact.dll"" [MS]
                        "{124597D8-850A-41AE-849C-017A4FA99CA2}" = "IntelliPoint Buttons Control Panel Property Page"
                        -> {CLSID}\InProcServer32\(Default) = ""C:\Program Files\Microsoft IntelliPoint\ipcplbtn.dll"" [MS]
                        "{A2569D1F-4E06-43EC-9825-0088B471BE47}" = "IntelliType Pro Wireless Control Panel Property Page"
                        -> {CLSID}\InProcServer32\(Default) = ""C:\Program Files\Microsoft IntelliType Pro\itcplwir.dll"" [MS]
                        "{111D8120-25EB-4E1C-A4DF-C9EE5FCA35CB}" = "IntelliType Pro Scrolling Control Panel Property Page"
                        -> {CLSID}\InProcServer32\(Default) = ""C:\Program Files\Microsoft IntelliType Pro\itcplwhl.dll"" [MS]
                        "{ED6E87C6-8A83-43aa-8208-8DBC8247F4D2}" = "IntelliType Pro Key Settings Control Panel Property Page"
                        -> {CLSID}\InProcServer32\(Default) = ""C:\Program Files\Microsoft IntelliType Pro\itcplkey.dll"" [MS]
                        "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]
                        "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}" = "Adobe.Acrobat.ContextMenu"
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."]
                        "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
                        "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
                        -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
                        "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
                        -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
                        "{6E3C607A-B99C-4FA8-98F5-1AC1ADF7F5B9}" = "MediaFace extension"
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fellowes\MediaFACE 4.0\MFShlExt.dll" ["Fellowes, Inc."]
                        "{1EBC3533-B289-409F-9924-B84B3F0717D2}" = "AceFTP Context Menu Shell Extension"
                        -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\VISICO~1\FTPEXP~1\FTPCNT~1.DLL" ["Visicom Media Inc."]
                        "{F5D92341-0A64-11D0-9956-0000E8096023}" = "CD Copy Shell Extension"
                        -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Shellext\CDWshext.dll" ["Pinnacle Systems, Inc."]
                        "{F5D92342-0A64-11D0-9956-0000E8096023}" = "CD Wizard Shell Extension"
                        -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Shellext\CDWshext.dll" ["Pinnacle Systems, Inc."]
                        "{F5D92344-0A64-11D0-9956-0000E8096023}" = "InstantWrite Shellextension"
                        -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ShellExt\iwshex.dll" ["VOB Computersysteme GmbH"]
                        "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes"
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Computer, Inc."]

                        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\
                        INFECTION WARNING! "AppInit_DLLs" = "MsgPlusLoader.dll" ["Patchou"]

                        HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
                        Adobe.Acrobat.ContextMenu\(Default) = "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."]
                        FTP Expert\(Default) = "{1EBC3533-B289-409F-9924-B84B3F0717D2}"
                        -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\VISICO~1\FTPEXP~1\FTPCNT~1.DLL" ["Visicom Media Inc."]
                        MediaFaceExtension\(Default) = "{6E3C607A-B99C-4FA8-98F5-1AC1ADF7F5B9}"
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fellowes\MediaFACE 4.0\MFShlExt.dll" ["Fellowes, Inc."]
                        Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
                        WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

                        HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
                        FTP Expert\(Default) = "{1EBC3533-B289-409F-9924-B84B3F0717D2}"
                        -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\VISICO~1\FTPEXP~1\FTPCNT~1.DLL" ["Visicom Media Inc."]
                        MediaFaceExtension\(Default) = "{6E3C607A-B99C-4FA8-98F5-1AC1ADF7F5B9}"
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fellowes\MediaFACE 4.0\MFShlExt.dll" ["Fellowes, Inc."]
                        WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

                        HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
                        Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
                        WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

                        Active Desktop and Wallpaper:
                        -----------------------------

                        Active Desktop is disabled at this entry:
                        HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

                        HKCU\Control Panel\Desktop\
                        "Wallpaper" = "C:\Documents and Settings\Frédérique Matthys\Bureau\image net\Sans titre.bmp"

                        Enabled Screen Saver:
                        ---------------------

                        HKCU\Control Panel\Desktop\
                        "SCRNSAVE.EXE" = "C:\WINDOWS\System32\ssstars.scr" [MS]

                        Startup items in "Frédérique Matthys" & "All Users" startup folders:
                        --------------------------------------------------------------------

                        C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
                        "Adobe Gamma Loader" -> shortcut to: "C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]
                        "Assistant d'Acrobat" -> shortcut to: "C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe" ["Adobe Systems Inc."]
                        "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS]
                        "Suitcase Startup" -> shortcut to: "C:\Program Files\Extensis\Suitcase\Suitcase.exe -Startup" ["Extensis Products Group"]

                        Enabled Scheduled Tasks:
                        ------------------------

                        "Norton AntiVirus - Scan my computer" -> launches: "C:\PROGRA~1\NORTON~1\Navw32.exe /task:"C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"]
                        "Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]
                        "XoftSpy" -> launches: "C:\Program Files\XoftSpy\XoftSpy.exe -t" ["ParetoLogic Inc."]

                        Winsock2 Service Provider DLLs:
                        -------------------------------

                        Namespace Service Providers

                        HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
                        000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
                        000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
                        000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

                        Transport Service Providers

                        HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
                        0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
                        %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 11
                        %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

                        Toolbars, Explorer Bars, Extensions:
                        ------------------------------------

                        Toolbars

                        HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
                        "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

                        "{47833539-D0C5-4125-9FA8-0819E2EAAC93}" = "Adobe PDF" [from CLSID]
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll" [null data]

                        HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
                        "{47833539-D0C5-4125-9FA8-0819E2EAAC93}" = "Adobe PDF" [from CLSID]
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll" [null data]

                        HKLM\Software\Microsoft\Internet Explorer\Toolbar\
                        "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus"
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

                        "{47833539-D0C5-4125-9FA8-0819E2EAAC93}" = "Adobe PDF" [from CLSID]
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll" [null data]

                        Explorer Bars

                        HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
                        {182EC0BE-5110-49C8-A062-BEB1D02A220B}\ = "Adobe PDF" [from CLSID]
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll" [null data]

                        Extensions (Tools menu items, main toolbar menu buttons)

                        HKLM\Software\Microsoft\Internet Explorer\Extensions\
                        {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
                        "MenuText" = "Console Java (Sun)"
                        "CLSIDExtension" = "{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}"
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll" ["Sun Microsystems, Inc."]

                        {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\
                        "ButtonText" = "Créer un Favori de l'appareil mobile"
                        "CLSIDExtension" = "{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F}"
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft ActiveSync\INETREPL.DLL" [MS]

                        {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\
                        "MenuText" = "Créer un Favori de l'appareil mobile..."
                        "CLSIDExtension" = "{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F}"
                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft ActiveSync\INETREPL.DLL" [MS]

                        {85D1F590-48F4-11D9-9669-0800200C9A66}\
                        "MenuText" = "Uninstall BitDefender Online Scanner v8"
                        "Exec" = "%windir%\bdoscandel.exe" [null data]

                        {ECC5777A-6E88-BFCE-13CE-81F134789E7B}\
                        "ButtonText" = "Popup Eclair Bypass"
                        "MenuText" = "Popup Eclair Bypass"
                        "Exec" = "C:\Program Files\Popup Eclair\addbypass.exe" [null data]

                        {FB5F1910-F110-11D2-BB9E-00C04F795683}\
                        "ButtonText" = "Messenger"
                        "MenuText" = "Windows Messenger"
                        "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]

                        Miscellaneous IE Hijack Points
                        ------------------------------

                        C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

                        Added lines (compared with English-language version):
                        [Strings]: SAFESITE_VALUE="http://home.microsoft.com/intl/fr/"

                        Missing lines (compared with English-language version):
                        [Strings]: 1 line

                        HOSTS file
                        ----------

                        HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\
                        HIJACK WARNING! "DataBasePath" = "%SystemRoot%\System32\drivers\etc"

                        Running Services (Display Name, Service Name, Path {Service DLL}):
                        ------------------------------------------------------------------

                        iPodService, iPodService, "C:\Program Files\iPod\bin\iPodService.exe" ["Apple Computer, Inc."]
                        Norton AntiVirus Auto Protect Service, navapsvc, ""C:\Program Files\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"]
                        Norton Unerase Protection, NProtectService, "C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE" ["Symantec Corporation"]
                        SAVScan, SAVScan, "C:\Program Files\Norton AntiVirus\SAVScan.exe" ["Symantec Corporation"]
                        Symantec Core LC, Symantec Core LC, "C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe" ["Symantec Corporation"]
                        Symantec Event Manager, ccEvtMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]
                        Symantec Settings Manager, ccSetMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"]
                        SymWMI Service, SymWSC, ""C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe"" ["Symantec Corporation"]
                        Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]

                        Print Monitors:
                        ---------------

                        HKLM\System\CurrentControlSet\Control\Print\Monitors\
                        Adobe PDF Port\Driver = "C:\WINDOWS\system32\AdobePDF.dll" ["Adobe Systems Incorporated."]
                        hpzlnt07\Driver = "hpzlnt07.dll" ["HP"]

                        ----------
                        + This report excludes default entries except where indicated.
                        + To see *everywhere* the script checks and *everything* it finds,
                        launch it from a command prompt or a shortcut with the -all parameter.
                        + To search all directories of local fixed drives for DESKTOP.INI
                        DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
                        use the -supp parameter or answer "No" at the first message box.
                        ---------- (total run time: 50 seconds, including 11 seconds for message boxes)

                        voilà le log
                        En tout cas merci de me consacrer tout ce temps!!
                        tamara007
                        2. tamara007 Auteur
                          SmitFraudFix v1.93

                          Rapport fait à 19:53:17,95 le ven. 11/11/2005
                          Executé à partir de C:\Documents and Settings\Fr‚d‚rique Matthys\Bureau\SmitfraudFix
                          OS: Microsoft Windows XP [version 5.1.2600]

                          »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\

                          »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS

                          »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system

                          »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web

                          »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32

                          »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32\LogFiles

                          »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Documents and Settings\Fr‚d‚rique Matthys\Application Data

                          »»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer

                          »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Documents and Settings\Fr‚d‚rique Matthys\Bureau

                          »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files

                          »»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues

                          »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

                          »»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport
                          2. tamara007 Auteur
                            Logfile of HijackThis v1.99.1
                            Scan saved at 19:42:30, on 11/11/2005
                            Platform: Windows XP SP2 (WinNT 5.01.2600)
                            MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                            Running processes:
                            C:\WINDOWS\System32\smss.exe
                            C:\WINDOWS\system32\winlogon.exe
                            C:\WINDOWS\system32\services.exe
                            C:\WINDOWS\system32\lsass.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\system32\spoolsv.exe
                            C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
                            C:\Program Files\Norton AntiVirus\navapsvc.exe
                            C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
                            C:\WINDOWS\System32\svchost.exe
                            C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
                            C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                            C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
                            C:\Program Files\Norton AntiVirus\SAVScan.exe
                            C:\WINDOWS\Explorer.EXE
                            C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
                            C:\Program Files\Microsoft IntelliPoint\point32.exe
                            C:\Program Files\Microsoft IntelliType Pro\type32.exe
                            C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
                            C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
                            C:\Program Files\Messenger Plus! 3\MsgPlus.exe
                            C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
                            C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
                            C:\Program Files\iTunes\iTunesHelper.exe
                            C:\WINDOWS\system32\ctfmon.exe
                            C:\Program Files\Popup Eclair\popupeclair.exe
                            C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
                            C:\Program Files\iPod\bin\iPodService.exe
                            C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
                            C:\Program Files\Extensis\Suitcase\Suitcase.exe
                            C:\Program Files\Messenger\msmsgs.exe
                            C:\Program Files\MSN Messenger\msnmsgr.exe
                            C:\Program Files\Internet Explorer\iexplore.exe
                            C:\hijackthis\HijackThis.exe

                            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
                            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
                            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Protégé par : Popup Éclair v.2
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                            O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
                            O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                            O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
                            O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
                            O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
                            O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
                            O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
                            O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
                            O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
                            O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
                            O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
                            O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
                            O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
                            O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
                            O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
                            O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
                            O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
                            O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
                            O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
                            O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                            O4 - HKCU\..\Run: [popupeclair] C:\Program Files\Popup Eclair\popupeclair.exe
                            O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
                            O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                            O4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
                            O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                            O4 - Global Startup: Suitcase Startup.lnk = ?
                            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
                            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
                            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
                            O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
                            O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
                            O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
                            O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                            O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                            O9 - Extra button: Popup Eclair Bypass - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Popup Eclair\addbypass.exe
                            O9 - Extra 'Tools' menuitem: Popup Eclair Bypass - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Popup Eclair\addbypass.exe
                            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                            O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
                            O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1119863864265
                            O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
                            O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
                            O20 - AppInit_DLLs: MsgPlusLoader.dll
                            O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                            O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                            O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
                            O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
                            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                            O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
                            O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
                            O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
                            O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
                            O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
                            O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
                            O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
                            O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
                            O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe

                            voilà voilà, j'ai fait juste avant ce log:

                            bitdéfender, il m'a viré pas mal de truc, ensuite j'ai fait un xoftspy et un ad-aware
                            et ce fichu e rouge est toujours là
                            3. Utilisateur anonyme
                              salut moe
                              ca va?
                              merci de m avoir repondu au fait

                              PS/ desole pour la parenthese sur le poste
                              • 1
                              • 2

                              Discussions similaires

                              JetonRouge.com : Arnaque ou bon plan casino ?
                              Yvan6775

                              15 réponses
                              Freebox Crystal, plug rouge, plus de connexion
                              Pineaaple

                              3 réponses
                              Kman metre le "e" en exposant dans un do
                              rachel49

                              6 réponses
                              Plus de WiFi avec fibre SFR
                              Ameliedu45

                              3 réponses
                              Réglage télécommande Freebox pop
                              Jacques

                              5 réponses