Sheriff !!!!!!!!!

Résolu
tskleon -  
Voilà
Salut Régis j'espere que c'etait bien comme ça qu'il fallait creer le nouveau post
Donc je suis toujours a la recherche d'aide pour me debarrasser de ce Sheriff !!!!
Je te remercie beaucoup pour ton aide

28 réponses

Résumé de la discussion

Le fil décrit une aide pour se débarrasser d’un malware nommé Sheriff et les difficultés rencontrées lors du démarrage avec des périphériques non détectés, tout en sollicitant une solution efficace. Des réponses proposées incluent l’utilisation de SmitFraudFix v1.92 qui nettoie les fichiers infectés et répare le registre, et des conseils sur la détection et la remise en état des composants Windows XP. D’autres messages soulignent l’importance d’un log HijackThis et de nettoyer les éléments au démarrage, avec des recommandations comme créer un point de restauration et partager un nouveau rapport pour identifier les restes. En conséquence, plusieurs intervenants encouragent à poursuivre le débogage via des logs supplémentaires et à vérifier les infections persistantes, sans conclure sur une résolution immédiate.

Bobot (l’IA à votre service)
  1. tskleon Auteur
    Apparement le lien pour ton nettoyeur il est mort en aurait tu un autre ?
    Par contre j'ai aussi une petite question concernant mon materiel DD et Lecteur Cd qui au demarage ne sont apparement pas detectés ça me mets NO device , ce qui n'empeche pas le fonctionnement apres mais est ce que ça ne limite pas l'utilisation ??
    Merci encore
    1. Utilisateur anonyme
      salut roussilon;
      clik sur (tout en haut) dans la section effectuer une action
      --->ecrire un nouveau message

      a+
      1. Utilisateur anonyme
        Bonjour roussillon,
        Il serait préférable que tu fasses ton message personnel, cela rendra les postes plus compréhensibles et la réponse à ton problème sera plus efficace
        Procèdes comme ceci :
        http://pageperso.aol.fr/balltrap34/demofairesontmessage.htm

        A bientôt

        ***
        Pour tskleon
        d=decoche c=coche

        psdrvcheck = d
        ccapp = d
        ccregvfy = d
        atiptaxx = c
        sndmon = d
        swtrayv4 = c
        realonemessagecenter = d
        qttask = c
        bhr4 = c
        ctfmon = c
        atitray = c
        backweb-8876480 = c
        adobegammaloader = d
        lancement rapide d'adobe reader = d

        ensuite, tu as des traces de norton, ton ancien antivirus je penses, as tu un nettoyeur de registre?
        sinon;
        jv16

        (ancienne version gratuite) http://www.puntocr.it/index.php?module=downloads_riz&func=display&pid=3&lid=26
        là tu le lances tu cliques sur outil registre/outil/nettoyage de registre/continuer /démarrer
        là tu le laisses faire c’est un peu long
        quand il a fini
        tu sélectionnes les ronds verts par paquet de 20 ou 30
        une fois que tu les a sélectionnés tu cliques sur supprimer en bas à droite
        et tu continues jusqu’à ce qu’il ne reste plus de ronds verts
        +coche ce que tu trouvera de norton et symantec

        a+
      2. tskleon Auteur
        Adresse toi à Regis59 c'est lui qui a résolu tout mes problemes
        Bonne chance tu verras c'est pas tres long
        2. Roussillon
          Bonsoir

          Moi aussi j'ai des problemes avec Sheriff si tu pouvait jetter un coup d'oeil a mon log
          Merci d 'avance

          Logfile of HijackThis v1.99.1
          Scan saved at 20:02:23, on 12/11/2005
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          D:\Program Files\InCD\InCDsrv.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
          C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
          C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
          C:\Program Files\F-Secure\Common\FSMA32.EXE
          C:\Program Files\F-Secure\Common\FSMB32.EXE
          C:\Program Files\F-Secure\Common\FCH32.EXE
          C:\Program Files\F-Secure\Common\FAMEH32.EXE
          C:\Program Files\F-Secure\Common\FNRB32.EXE
          C:\Program Files\F-Secure\Common\FIH32.EXE
          C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
          C:\WINDOWS\Explorer.EXE
          C:\Program Files\F-Secure\Common\FSM32.EXE
          C:\WINDOWS\SOUNDMAN.EXE
          C:\WINDOWS\system32\ctfmon.exe
          C:\Documents and Settings\Administrateur\Bureau\HijackThis.exe

          O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
          O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
          O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
          O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
          O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
          O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\Run: [ItLauncherAutoStart] C:\PROGRA~1\INSTAN~1\bin\ITLAUN~1.EXE -Embedding /AutoStart
          O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
          O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
          O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
          O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
          O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
          O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE (file missing)
          O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
          O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
          O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
          O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE
          O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
          O23 - Service: InCD Helper (InCDsrv) - AHEAD Software - D:\Program Files\InCD\InCDsrv.exe
          1. tskleon Auteur
            bin qd je vais ds Msconfig j'ai ça qui se met au demarrage:
            psdrvcheck
            ccapp
            ccregvfy
            atiptaxx
            sndmon
            swtrayv4
            realonemessagecenter
            qttask
            bhr4
            ctfmon
            atitray
            backweb-8876480
            adobegammaloader
            lancement rapide d'adobe reader

            voila c'est tout ce que j'ai d'actif
            Merci
            1. Utilisateur anonyme
              re,
              si tu as des doutes, donne nous les noms des elements de demarrage

              a+
              1. roussillon
                bonjour regis
                Moi aussi j ai des pb avec sheriff
                Si tu pouvait jeter un oeil cela serai sympa
                merci d'avance
                Logfile of HijackThis v1.99.1
                Scan saved at 09:55:01, on 13/11/2005
                Platform: Windows XP SP2 (WinNT 5.01.2600)
                MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                D:\Program Files\InCD\InCDsrv.exe
                C:\WINDOWS\system32\spoolsv.exe
                C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
                C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
                C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
                C:\Program Files\F-Secure\Common\FSMA32.EXE
                C:\Program Files\F-Secure\Common\FSMB32.EXE
                C:\Program Files\F-Secure\Common\FCH32.EXE
                C:\Program Files\F-Secure\Common\FAMEH32.EXE
                C:\Program Files\F-Secure\Common\FNRB32.EXE
                C:\Program Files\F-Secure\Common\FIH32.EXE
                C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
                C:\WINDOWS\Explorer.EXE
                C:\Program Files\F-Secure\Common\FSM32.EXE
                C:\WINDOWS\SOUNDMAN.EXE
                C:\WINDOWS\system32\ctfmon.exe
                D:\Program Files\eMule\emule.exe
                C:\Documents and Settings\Administrateur\Bureau\HijackThis.exe

                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
                O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
                O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
                O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
                O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
                O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
                O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
                O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
                O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
                O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
                O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
                O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
                O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE (file missing)
                O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
                O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
                O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
                O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE
                O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
                O23 - Service: InCD Helper (InCDsrv) - AHEAD Software - D:\Program Files\InCD\InCDsrv.exe
            2. tskleon Auteur
              Ok j'essaierai d'enlever ce qui n'est pas indispensable au demarage en esperant ne pas enlever des trucs qui sont utiles c'est toujours un peu la peur que ça ne redemarre pas nikel.
              Merci encore de ton aide ça m'a super depanné, j'espere ne plus avoir jamais à retrouver des trucs comme cette merde sur mon pc...
              bonne continuation à vous et longue vie à votre site
              1. Utilisateur anonyme
                Re,
                si tu n as plus de soucis
                recache tes fichiers caches et cree un point de restauration

                a+
                1. tskleon Auteur
                  Logfile of HijackThis v1.99.1
                  Scan saved at 12:32:02, on 12/11/2005
                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\System32\Ati2evxx.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                  C:\Program Files\Norton Internet Security\NISUM.EXE
                  C:\WINDOWS\system32\Ati2evxx.exe
                  C:\WINDOWS\Explorer.EXE
                  C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                  C:\Program Files\Norton Internet Security\ccPxySvc.exe
                  C:\WINDOWS\System32\CTsvcCDA.exe
                  C:\Program Files\Ahead\InCD\InCDsrv.exe
                  C:\Program Files\Norton AntiVirus\navapsvc.exe
                  F:\3dsmax6\sfmgr.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\WINDOWS\System32\MsPMSPSv.exe
                  C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
                  C:\PROGRA~1\MICROS~2\GAMECO~1\common\swtrayv4.exe
                  C:\Program Files\QuickTime\qttask.exe
                  C:\WINDOWS\system32\ctfmon.exe
                  C:\Program Files\Radeon Omega Drivers\v2.6.53\ATI Tray Tools\atitray.exe
                  C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                  C:\Program Files\Logitech\SetPoint\KEM.exe
                  C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
                  C:\Program Files\ABC\abc.exe
                  C:\Program Files\Adobe\Photoshop 7.0\Photoshop.exe
                  C:\Program Files\MSN Messenger\msnmsgr.exe
                  C:\Program Files\Internet Explorer\iexplore.exe
                  C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE
                  C:\Documents and Settings\TSK-Leon\Mes documents\hijack\HijackThis.exe
                  C:\Program Files\Messenger\msmsgs.exe

                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neuf.fr/espaceabonnes/efacture/
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
                  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                  O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
                  O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
                  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
                  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                  O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
                  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
                  O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"
                  O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
                  O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
                  O4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MICROS~2\GAMECO~1\common\swtrayv4.exe
                  O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe" -osboot
                  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                  O4 - HKLM\..\Run: [BHR4] C:\Program Files\Zamaan's Software\Browser Hijack Retaliator 4\BHR4.exe
                  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                  O4 - HKCU\..\Run: [AtiTrayTools] C:\Program Files\Radeon Omega Drivers\v2.6.53\ATI Tray Tools\atitray.exe
                  O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                  O4 - Startup: Registration-InstantCopy.lnk = C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\Pixie\RegTool.exe
                  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                  O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                  O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                  O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
                  O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
                  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
                  O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
                  O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
                  O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
                  O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
                  O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
                  O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
                  O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
                  O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
                  O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                  O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
                  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005102501/housecall.trendmicro.com/housecall/xscan53.cab
                  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                  O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
                  O17 - HKLM\System\CCS\Services\Tcpip\..\{8B115587-E009-43B5-9658-2B890B0C74A6}: NameServer = 80.118.192.110 80.118.196.40
                  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
                  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
                  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                  O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                  O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
                  O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPxySvc.exe
                  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
                  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                  O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
                  O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
                  O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
                  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
                  O23 - Service: CaReTaKeR-CT NetMgr 1.2.1 (sfmgr) - Unknown owner - F:\3dsmax6\sfmgr.exe
                  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
                  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe

                  Voila ce que j'ai en rapport, par contre au niveau soucis je ne pense pas en avoir pour l'instant tout à l'air clean.....
                  Merci encore
                  1. Utilisateur anonyme
                    re,
                    fixe celle ci
                    O20 - Winlogon Notify: msctl32.dll - C:\WINDOWS\system32\msctl32.dll

                    et dis moi ou en sont tes soucis

                    a+
                    1. tskleon Auteur
                      Logfile of HijackThis v1.99.1
                      Scan saved at 12:19:12, on 12/11/2005
                      Platform: Windows XP SP2 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\System32\Ati2evxx.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                      C:\Program Files\Norton Internet Security\NISUM.EXE
                      C:\WINDOWS\system32\Ati2evxx.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                      C:\Program Files\Norton Internet Security\ccPxySvc.exe
                      C:\WINDOWS\System32\CTsvcCDA.exe
                      C:\Program Files\Ahead\InCD\InCDsrv.exe
                      C:\Program Files\Norton AntiVirus\navapsvc.exe
                      F:\3dsmax6\sfmgr.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\WINDOWS\System32\MsPMSPSv.exe
                      C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
                      C:\PROGRA~1\MICROS~2\GAMECO~1\common\swtrayv4.exe
                      C:\Program Files\QuickTime\qttask.exe
                      C:\WINDOWS\system32\ctfmon.exe
                      C:\Program Files\Radeon Omega Drivers\v2.6.53\ATI Tray Tools\atitray.exe
                      C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                      C:\Program Files\Logitech\SetPoint\KEM.exe
                      C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
                      C:\Program Files\ABC\abc.exe
                      C:\Program Files\Adobe\Photoshop 7.0\Photoshop.exe
                      C:\Program Files\MSN Messenger\msnmsgr.exe
                      C:\Program Files\Internet Explorer\iexplore.exe
                      C:\Documents and Settings\TSK-Leon\Mes documents\hijack\HijackThis.exe
                      C:\Program Files\Messenger\msmsgs.exe

                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neuf.fr/espaceabonnes/efacture/
                      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
                      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                      O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
                      O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
                      O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
                      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                      O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
                      O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
                      O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"
                      O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
                      O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
                      O4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MICROS~2\GAMECO~1\common\swtrayv4.exe
                      O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe" -osboot
                      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                      O4 - HKLM\..\Run: [BHR4] C:\Program Files\Zamaan's Software\Browser Hijack Retaliator 4\BHR4.exe
                      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                      O4 - HKCU\..\Run: [AtiTrayTools] C:\Program Files\Radeon Omega Drivers\v2.6.53\ATI Tray Tools\atitray.exe
                      O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                      O4 - Startup: Registration-InstantCopy.lnk = C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\Pixie\RegTool.exe
                      O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                      O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                      O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
                      O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
                      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
                      O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
                      O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
                      O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
                      O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
                      O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
                      O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
                      O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
                      O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
                      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
                      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                      O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
                      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005102501/housecall.trendmicro.com/housecall/xscan53.cab
                      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
                      O17 - HKLM\System\CCS\Services\Tcpip\..\{8B115587-E009-43B5-9658-2B890B0C74A6}: NameServer = 80.118.192.110 80.118.196.40
                      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
                      O20 - Winlogon Notify: msctl32.dll - C:\WINDOWS\system32\msctl32.dll
                      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
                      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                      O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                      O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                      O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
                      O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPxySvc.exe
                      O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
                      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                      O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
                      O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
                      O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
                      O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
                      O23 - Service: CaReTaKeR-CT NetMgr 1.2.1 (sfmgr) - Unknown owner - F:\3dsmax6\sfmgr.exe
                      O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
                      O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe

                      Merci
                      2. tskleon Auteur
                        L2MFIX find log 1.04a
                        These are the registry keys present
                        **********************************************************************************
                        Winlogon/notify:
                        Windows Registry Editor Version 5.00

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
                        "DLLName"="Ati2evxx.dll"
                        "Asynchronous"=dword:00000000
                        "Impersonate"=dword:00000001
                        "Lock"="AtiLockEvent"
                        "Logoff"="AtiLogoffEvent"
                        "Logon"="AtiLogonEvent"
                        "Disconnect"="AtiDisConnectEvent"
                        "Reconnect"="AtiReConnectEvent"
                        "Safe"=dword:00000000
                        "Shutdown"="AtiShutdownEvent"
                        "StartScreenSaver"="AtiStartScreenSaverEvent"
                        "StartShell"="AtiStartShellEvent"
                        "Startup"="AtiStartupEvent"
                        "StopScreenSaver"="AtiStopScreenSaverEvent"
                        "Unlock"="AtiUnLockEvent"

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
                        "Asynchronous"=dword:00000000
                        "Impersonate"=dword:00000000
                        "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
                        6c,00,00,00
                        "Logoff"="ChainWlxLogoffEvent"

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
                        "Asynchronous"=dword:00000000
                        "Impersonate"=dword:00000000
                        "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
                        6c,00,6c,00,00,00
                        "Logoff"="CryptnetWlxLogoffEvent"

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
                        "DLLName"="cscdll.dll"
                        "Logon"="WinlogonLogonEvent"
                        "Logoff"="WinlogonLogoffEvent"
                        "ScreenSaver"="WinlogonScreenSaverEvent"
                        "Startup"="WinlogonStartupEvent"
                        "Shutdown"="WinlogonShutdownEvent"
                        "StartShell"="WinlogonStartShellEvent"
                        "Impersonate"=dword:00000000
                        "Asynchronous"=dword:00000001

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\msctl32.dll]
                        "DllName"="C:\\WINDOWS\\system32\\msctl32.dll"
                        "Startup"="Startup"
                        "Asynchronous"=dword:00000001
                        "Impersonate"=dword:00000000

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
                        "DLLName"="wlnotify.dll"
                        "Logon"="SCardStartCertProp"
                        "Logoff"="SCardStopCertProp"
                        "Lock"="SCardSuspendCertProp"
                        "Unlock"="SCardResumeCertProp"
                        "Enabled"=dword:00000001
                        "Impersonate"=dword:00000001
                        "Asynchronous"=dword:00000001

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
                        "Asynchronous"=dword:00000000
                        "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
                        6c,00,6c,00,00,00
                        "Impersonate"=dword:00000000
                        "StartShell"="SchedStartShell"
                        "Logoff"="SchedEventLogOff"

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
                        "Logoff"="WLEventLogoff"
                        "Impersonate"=dword:00000000
                        "Asynchronous"=dword:00000001
                        "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
                        6c,00,6c,00,00,00

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
                        "DLLName"="WlNotify.dll"
                        "Lock"="SensLockEvent"
                        "Logon"="SensLogonEvent"
                        "Logoff"="SensLogoffEvent"
                        "Safe"=dword:00000001
                        "MaxWait"=dword:00000258
                        "StartScreenSaver"="SensStartScreenSaverEvent"
                        "StopScreenSaver"="SensStopScreenSaverEvent"
                        "Startup"="SensStartupEvent"
                        "Shutdown"="SensShutdownEvent"
                        "StartShell"="SensStartShellEvent"
                        "PostShell"="SensPostShellEvent"
                        "Disconnect"="SensDisconnectEvent"
                        "Reconnect"="SensReconnectEvent"
                        "Unlock"="SensUnlockEvent"
                        "Impersonate"=dword:00000001
                        "Asynchronous"=dword:00000001

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
                        "Asynchronous"=dword:00000000
                        "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
                        6c,00,6c,00,00,00
                        "Impersonate"=dword:00000000
                        "Logoff"="TSEventLogoff"
                        "Logon"="TSEventLogon"
                        "PostShell"="TSEventPostShell"
                        "Shutdown"="TSEventShutdown"
                        "StartShell"="TSEventStartShell"
                        "Startup"="TSEventStartup"
                        "MaxWait"=dword:00000258
                        "Reconnect"="TSEventReconnect"
                        "Disconnect"="TSEventDisconnect"

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
                        "DLLName"="wlnotify.dll"
                        "Logon"="RegisterTicketExpiredNotificationEvent"
                        "Logoff"="UnregisterTicketExpiredNotificationEvent"
                        "Impersonate"=dword:00000001
                        "Asynchronous"=dword:00000001

                        RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
                        Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
                        This program is Freeware, use it on your own risk!

                        Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
                        (ID-NI) ALLOW Read BUILTIN\Utilisateurs
                        (ID-IO) ALLOW Read BUILTIN\Utilisateurs
                        (ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
                        (ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
                        (ID-NI) ALLOW Full access BUILTIN\Administrateurs
                        (ID-IO) ALLOW Full access BUILTIN\Administrateurs
                        (ID-NI) ALLOW Full access AUTORITE NT\SYSTEM
                        (ID-IO) ALLOW Full access AUTORITE NT\SYSTEM
                        (ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE

                        **********************************************************************************
                        useragent:
                        Windows Registry Editor Version 5.00

                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
                        "SV1"=""

                        **********************************************************************************
                        Shell Extension key:
                        Windows Registry Editor Version 5.00

                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
                        "{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"
                        "{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"
                        "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"
                        "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"
                        "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
                        "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
                        "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"
                        "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration"
                        "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"
                        "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"
                        "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚"
                        "{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement"
                        "{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"
                        "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows"
                        "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"
                        "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"
                        "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers"
                        "{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web"
                        "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
                        "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"
                        "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"
                        "{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal"
                        "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
                        "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
                        "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"
                        "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
                        "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
                        "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"
                        "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"
                        "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau"
                        "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau"
                        "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo"
                        "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo"
                        "{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo"
                        "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo"
                        "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo"
                        "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
                        "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
                        "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows"
                        "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft"
                        "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
                        "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
                        "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"
                        "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer"
                        "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher"
                        "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
                        "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
                        "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..."
                        "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
                        "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique"
                        "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices"
                        "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration"
                        "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
                        "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
                        "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
                        "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
                        "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
                        "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
                        "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"
                        "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement"
                        "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"
                        "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"
                        "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
                        "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"
                        "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche"
                        "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
                        "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"
                        "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"
                        "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"
                        "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
                        "{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"
                        "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"
                        "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
                        "{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"
                        "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"
                        "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
                        "{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"
                        "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses"
                        "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"
                        "{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"
                        "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"
                        "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"
                        "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
                        "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"
                        "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
                        "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"
                        "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"
                        "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
                        "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
                        "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
                        "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
                        "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
                        "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
                        "{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique"
                        "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
                        "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
                        "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
                        "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"
                        "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
                        "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
                        "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
                        "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
                        "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
                        "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
                        "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
                        "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
                        "{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache"
                        "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
                        "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
                        "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription"
                        "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
                        "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
                        "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
                        "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
                        "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
                        "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
                        "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
                        "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement"
                        "{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es"
                        "{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin"
                        "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
                        "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
                        "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI"
                        "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)"
                        "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML"
                        "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
                        "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web"
                        "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web"
                        "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell"
                        "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport"
                        "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs"
                        "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
                        "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
                        "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne"
                        "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne"
                        "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
                        "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
                        "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
                        "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
                        "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
                        "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
                        "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
                        "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
                        "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
                        "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
                        "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
                        "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
                        "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
                        "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
                        "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
                        "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
                        "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
                        "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
                        "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
                        "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
                        "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
                        "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"
                        "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
                        "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
                        "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
                        "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
                        "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
                        "{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."
                        "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
                        "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
                        "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
                        "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
                        "{F5D92341-0A64-11D0-9956-0000E8096023}"="CD Copy Shell Extension"
                        "{F5D92342-0A64-11D0-9956-0000E8096023}"="CD Wizard Shell Extension"
                        "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
                        "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
                        "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
                        "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
                        "{950FF917-7A57-46BC-8017-59D9BF474000}"="Shell Extension for CDRW"
                        "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
                        "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
                        "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
                        "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Dossiers Web"
                        "{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
                        "{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"
                        "{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
                        "{506F4668-F13E-4AA1-BB04-B43203AB3CC0}"="{506F4668-F13E-4AA1-BB04-B43203AB3CC0}"
                        "{D66DC78C-4F61-447F-942B-3FB6980118CF}"="{D66DC78C-4F61-447F-942B-3FB6980118CF}"

                        **********************************************************************************
                        HKEY ROOT CLASSIDS:
                        **********************************************************************************
                        Files Found are not all bad files:

                        C:\WINDOWS\SYSTEM32\
                        browseui.dll Sat 3 Sep 2005 1:06:12 A.... 1 020 416 996,50 K
                        cdfview.dll Sat 3 Sep 2005 1:06:12 A.... 152 064 148,50 K
                        cdosys.dll Sat 10 Sep 2005 2:55:14 A.... 2 067 968 1,97 M
                        danim.dll Sat 3 Sep 2005 1:06:12 A.... 1 056 256 1,00 M
                        dxtrans.dll Sat 3 Sep 2005 1:06:12 A.... 205 312 200,50 K
                        extmgr.dll Sat 3 Sep 2005 1:06:12 ..... 55 808 54,50 K
                        gdi32.dll Thu 6 Oct 2005 4:18:12 A.... 280 064 273,50 K
                        iepeers.dll Sat 3 Sep 2005 1:06:12 A.... 251 392 245,50 K
                        inseng.dll Sat 3 Sep 2005 1:06:12 A.... 96 768 94,50 K
                        linkinfo.dll Thu 1 Sep 2005 2:43:38 A.... 19 968 19,50 K
                        msctl32.dll Wed 9 Nov 2005 16:57:02 A.... 29 184 28,50 K
                        mshtml.dll Wed 5 Oct 2005 1:26:04 A.... 3 013 120 2,87 M
                        mshtmled.dll Sat 3 Sep 2005 1:06:12 A.... 448 512 438,00 K
                        msrating.dll Sat 3 Sep 2005 1:06:12 A.... 146 432 143,00 K
                        mstime.dll Sat 3 Sep 2005 1:06:12 A.... 530 432 518,00 K
                        netman.dll Mon 22 Aug 2005 19:35:10 A.... 197 632 193,00 K
                        pngfilt.dll Sat 3 Sep 2005 1:06:12 A.... 39 424 38,50 K
                        quartz.dll Tue 30 Aug 2005 4:55:44 A.... 1 293 312 1,23 M
                        shdocvw.dll Sat 3 Sep 2005 1:06:12 A.... 1 484 288 1,41 M
                        shell32.dll Fri 23 Sep 2005 4:07:00 A.... 8 506 880 8,11 M
                        shlwapi.dll Sat 3 Sep 2005 1:06:12 A.... 474 112 463,00 K
                        sirenacm.dll Thu 13 Oct 2005 8:11:06 A.... 118 784 116,00 K
                        umpnpmgr.dll Tue 23 Aug 2005 4:39:36 A.... 124 928 122,00 K
                        urlmon.dll Sat 3 Sep 2005 1:06:12 A.... 605 696 591,50 K
                        wininet.dll Sat 3 Sep 2005 1:06:12 A.... 662 528 647,00 K
                        winsrv.dll Thu 1 Sep 2005 2:43:38 A.... 292 352 285,50 K

                        26 items found: 26 files, 0 directories.
                        Total of file sizes: 23 173 632 bytes 22,10 M
                        Locate .tmp files:

                        No matches found.
                        **********************************************************************************
                        Directory Listing of system files:
                        Le volume dans le lecteur C n'a pas de nom.
                        Le num‚ro de s‚rie du volume est DCF1-F3ED

                        R‚pertoire de C:\WINDOWS\System32

                        12/11/2005 01:15 <REP> dllcache
                        10/08/2005 20:24 32 {E0B67EB8-CCA7-4139-A7E6-6CEBDFF8F5A3}.dat
                        10/08/2005 20:23 32 {520DDB1E-7B85-424C-8E10-1507520B71E7}.dat
                        05/08/2005 21:50 <REP> Microsoft
                        2 fichier(s) 64 octets
                        2 R‚p(s) 59ÿ153ÿ616ÿ896 octets libres
                        Merci
                        2. tskleon Auteur
                          Voila le fichier que j'ai apres avoir fait les manips que tu m'avait preconisées et apres reboot.
                          Encore Merci

                          Logfile of HijackThis v1.99.1
                          Scan saved at 01:16:03, on 12/11/2005
                          Platform: Windows XP SP2 (WinNT 5.01.2600)
                          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                          Running processes:
                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\System32\Ati2evxx.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                          C:\Program Files\Norton Internet Security\NISUM.EXE
                          C:\WINDOWS\system32\Ati2evxx.exe
                          C:\WINDOWS\Explorer.EXE
                          C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                          C:\Program Files\Norton Internet Security\ccPxySvc.exe
                          C:\WINDOWS\System32\CTsvcCDA.exe
                          C:\Program Files\Ahead\InCD\InCDsrv.exe
                          C:\Program Files\Norton AntiVirus\navapsvc.exe
                          F:\3dsmax6\sfmgr.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\System32\MsPMSPSv.exe
                          C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
                          C:\WINDOWS\system32\wscntfy.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
                          C:\PROGRA~1\MICROS~2\GAMECO~1\common\swtrayv4.exe
                          C:\Program Files\QuickTime\qttask.exe
                          C:\WINDOWS\system32\ctfmon.exe
                          C:\Program Files\Radeon Omega Drivers\v2.6.53\ATI Tray Tools\atitray.exe
                          C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                          C:\Program Files\Logitech\SetPoint\KEM.exe
                          C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
                          C:\Program Files\Messenger\msmsgs.exe
                          C:\Documents and Settings\TSK-Leon\Mes documents\hijack\HijackThis.exe

                          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neuf.fr/espaceabonnes/efacture/
                          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
                          R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
                          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                          O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                          O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                          O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
                          O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
                          O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
                          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                          O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
                          O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
                          O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"
                          O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
                          O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
                          O4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MICROS~2\GAMECO~1\common\swtrayv4.exe
                          O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe" -osboot
                          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                          O4 - HKLM\..\Run: [BHR4] C:\Program Files\Zamaan's Software\Browser Hijack Retaliator 4\BHR4.exe
                          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                          O4 - HKCU\..\Run: [AtiTrayTools] C:\Program Files\Radeon Omega Drivers\v2.6.53\ATI Tray Tools\atitray.exe
                          O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                          O4 - Startup: Registration-InstantCopy.lnk = C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\Pixie\RegTool.exe
                          O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                          O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                          O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                          O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
                          O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
                          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
                          O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
                          O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
                          O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
                          O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
                          O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
                          O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
                          O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
                          O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
                          O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
                          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                          O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
                          O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005102501/housecall.trendmicro.com/housecall/xscan53.cab
                          O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                          O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
                          O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
                          O20 - Winlogon Notify: msctl32.dll - C:\WINDOWS\system32\msctl32.dll
                          O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
                          O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                          O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                          O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                          O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
                          O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPxySvc.exe
                          O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
                          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                          O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
                          O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
                          O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
                          O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
                          O23 - Service: CaReTaKeR-CT NetMgr 1.2.1 (sfmgr) - Unknown owner - F:\3dsmax6\sfmgr.exe
                          O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
                          O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
                          1. Utilisateur anonyme
                            Bonjour,

                            Méthode à suivre dans l'ordre...

                            Dans ajout/suppression de programme, desinstalle ceci:
                            MyWebSearch
                            ----------------------------------------------------------------------------
                            ¤Télécharge ces logiciels mais que tu n‘utilises pas tout de suite:

                            1/

                            Spybot S&D 1.4 <<nouvelle version.
                            http://www.safer-networking.org/fr/index.html

                            Démo d’utilisation (merci à Balltrap34 pour cette réalisation).
                            http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm

                            2/

                            Ad-Aware SE 1.06 <<nouvelle version.
                            http://www.lavasoftusa.com/software/adaware/
                            -Une aide:
                            http://www.tutopat.com/viewtopic.php?t=1191
                            - installe le patch français, tu pourras le trouver ici:
                            http://download.lavasoft.de.edgesuite.net/public/pllangs.exe
                            et une petite vidéo d'utilisation ici:(merci à Moe31 pour cette réalisation).
                            http://pageperso.aol.fr/balltrap34/adawrevid.asf
                            ----------------------------------------------------------------------------
                            ¤Vide tes fichiers temps et temporary internet file:

                            :: Supprimer les fichiers temporaires ::
                            vider tout le contenu de ces dossiers.

                            * C:\Documents and Settings\ton compte\Local Settings\Temp
                            * C:\Documents and Settings\tous les autres comptes\Local Settings\Temp
                            * C:\Windows\Temp

                            :: Le contenu du dossier prefetch ::

                            * C:\WINDOWS\Prefetch <= sauf le fichier layout.ini

                            * Ne pas oublier de vider la corbeille !
                            ----------------------------------------------------------------------------
                            ¤Relance HijackThis, coche les cases devant ces lignes et ensuite clique sur fix checked :

                            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html

                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html

                            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html

                            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html

                            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html

                            R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL

                            O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL

                            O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL

                            O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

                            O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

                            O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE

                            O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE

                            O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZN

                            O16 - DPF: {5DDCC37F-7C6B-48B8-9664-97C537920CA0} (aecviz Class) - http://www.maisonphenix.com/npaecviz.cab
                            ----------------------------------------------------------------------------
                            ¤Vide tes fichiers temps et temporary internet file:

                            :: Supprimer les fichiers temporaires ::
                            vider tout le contenu de ces dossiers.

                            * C:\Documents and Settings\ton compte\Local Settings\Temp
                            * C:\Documents and Settings\tous les autres comptes\Local Settings\Temp
                            * C:\Windows\Temp

                            :: Le contenu du dossier prefetch ::

                            * C:\WINDOWS\Prefetch <= sauf le fichier layout.ini

                            * Ne pas oublier de vider la corbeille !
                            ----------------------------------------------------------------------------
                            ¤Recherche et supprime ceci:
                            attention seulement les fichiers (si présents).

                            C:\Program Files\MyWebSearch

                            ----------------------------------------------------------------------------
                            ¤ Passe Ad-Aware et supprime tout ce qu’il trouve + supprime les quarantaines…
                            ----------------------------------------------------------------------------
                            ¤ Passe Spybot et corrige tout ce qu’il trouve + vaccine + supprime les quarantaines…
                            ----------------------------------------------------------------------------
                            ¤ Vide ta Corbeille.
                            ----------------------------------------------------------------------------
                            ¤ Redémarre en mode normal, relance Hijackthis et copie/colle un nouveau rapport sur le forum.

                            Précise tes soucis s’il en reste....

                            +

                            Télécharge l2mfix ici:

                            http://www.downloads.subratam.org/l2mfix.exe

                            Double clic sur l2mfix.exe pour lancer l'extraction.
                            Dans le dossier l2mfix, double clic sur l2mfix.bat et choisis l'option #1 (et pas autre chose) et valide avec la touche entrée.
                            Le bloc note va s'ouvrir avec le résultat du scan.
                            Fais un copier coller du résultat sur le forum.

                            Tiens-moi au courant

                            A+
                            1. tskleon Auteur
                              Logfile of HijackThis v1.99.1
                              Scan saved at 19:43:32, on 11/11/2005
                              Platform: Windows XP SP2 (WinNT 5.01.2600)
                              MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                              Running processes:
                              C:\WINDOWS\System32\smss.exe
                              C:\WINDOWS\system32\winlogon.exe
                              C:\WINDOWS\system32\services.exe
                              C:\WINDOWS\system32\lsass.exe
                              C:\WINDOWS\System32\Ati2evxx.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\System32\svchost.exe
                              C:\WINDOWS\system32\spoolsv.exe
                              C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                              C:\Program Files\Norton Internet Security\NISUM.EXE
                              C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                              C:\Program Files\Norton Internet Security\ccPxySvc.exe
                              C:\WINDOWS\System32\CTsvcCDA.exe
                              C:\Program Files\Ahead\InCD\InCDsrv.exe
                              C:\Program Files\Norton AntiVirus\navapsvc.exe
                              F:\3dsmax6\sfmgr.exe
                              C:\WINDOWS\system32\Ati2evxx.exe
                              C:\WINDOWS\System32\svchost.exe
                              C:\WINDOWS\Explorer.EXE
                              C:\WINDOWS\System32\MsPMSPSv.exe
                              C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
                              C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
                              C:\PROGRA~1\MICROS~2\GAMECO~1\common\swtrayv4.exe
                              C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
                              C:\Program Files\QuickTime\qttask.exe
                              C:\WINDOWS\system32\ctfmon.exe
                              C:\Program Files\Radeon Omega Drivers\v2.6.53\ATI Tray Tools\atitray.exe
                              C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                              C:\Program Files\Logitech\SetPoint\KEM.exe
                              C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
                              C:\WINDOWS\System32\svchost.exe
                              C:\Program Files\MSN Messenger\msnmsgr.exe
                              C:\Program Files\Internet Explorer\iexplore.exe
                              C:\Program Files\ABC\abc.exe
                              C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe
                              C:\Program Files\Messenger\msmsgs.exe
                              C:\Documents and Settings\TSK-Leon\Mes documents\hijack\HijackThis.exe

                              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
                              R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
                              R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
                              R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                              R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
                              O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
                              O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                              O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
                              O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
                              O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
                              O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
                              O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
                              O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                              O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
                              O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
                              O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"
                              O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
                              O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
                              O4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MICROS~2\GAMECO~1\common\swtrayv4.exe
                              O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe" -osboot
                              O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
                              O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                              O4 - HKLM\..\Run: [BHR4] C:\Program Files\Zamaan's Software\Browser Hijack Retaliator 4\BHR4.exe
                              O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                              O4 - HKCU\..\Run: [AtiTrayTools] C:\Program Files\Radeon Omega Drivers\v2.6.53\ATI Tray Tools\atitray.exe
                              O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
                              O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                              O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
                              O4 - Startup: Registration-InstantCopy.lnk = C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\Pixie\RegTool.exe
                              O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                              O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                              O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                              O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
                              O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
                              O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZN
                              O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
                              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
                              O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
                              O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
                              O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
                              O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
                              O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
                              O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
                              O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
                              O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
                              O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
                              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                              O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                              O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
                              O16 - DPF: {5DDCC37F-7C6B-48B8-9664-97C537920CA0} (aecviz Class) - http://www.maisonphenix.com/npaecviz.cab
                              O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005102501/housecall.trendmicro.com/housecall/xscan53.cab
                              O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                              O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
                              O17 - HKLM\System\CCS\Services\Tcpip\..\{8B115587-E009-43B5-9658-2B890B0C74A6}: NameServer = 80.118.192.112 80.118.196.42
                              O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
                              O20 - Winlogon Notify: msctl32.dll - C:\WINDOWS\system32\msctl32.dll
                              O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
                              O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                              O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                              O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                              O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
                              O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPxySvc.exe
                              O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
                              O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                              O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
                              O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
                              O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
                              O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
                              O23 - Service: CaReTaKeR-CT NetMgr 1.2.1 (sfmgr) - Unknown owner - F:\3dsmax6\sfmgr.exe
                              O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
                              O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
                              1. Utilisateur anonyme
                                re,
                                do a scan and save a logfile

                                en mode normal ! <<----toujours !!!

                                En mode sans echec, ce log ne sert strictement a rien car tout ce qui st mauvais n y apparaitra pas

                                a+
                                1. tskleon Auteur
                                  Sur Hijack je fais quoi ??
                                  do a system scan and save a log file
                                  ou
                                  Do a system scan only ??
                                  En mode normal ou sans echec ???
                                  Merci encore
                                  1. ^^Marie^^
                                    clique sur "do a system scan and save logfile" (cf démo)
                                • 1
                                • 2

                                Discussions similaires

                                Logiciel gratuit graphisme, DRAW Sheriff??
                                nitrocarbone

                                4 réponses
                                cosplay x-or space sheriff fabrication armure
                                maverick.83

                                1 réponse