Look2Me

Résolu
tom54 -  
Bonjour,

Quelqun peut me dire comment supprimer Look2Me car ewido et a² le detecte mais quand je le supprime il reapparait...
J'ai aussi quelques trojans dans la quarantaine de CounterSpy: RBot.Windows, Trojan.vxgame, Small.136, Trojan.Delf.MM et Krepper. Dois je les supprimer ou pas?

Voila le rapport d' HijackThis

Logfile of HijackThis v1.99.1
Scan saved at 14:02:38, on 08/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software (Avast)\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software (Avast)\Avast4\ashServ.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Alwil Software (Avast)\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software (Avast)\Avast4\ashWebSv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\CounterSpy\sunserver.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OpenOffice.org1.1.3\program\soffice.exe
C:\Program Files\CounterSpy\sunThreatEngine.exe
C:\Program Files\CounterSpy\SunProtectionServer.exe
C:\Documents and Settings\Chris\Mes documents\Mes images\Antipub\antipub.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\CounterSpy\CounterSpy.exe
C:\Documents and Settings\Chris\Mes documents\Mes images\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://free.fr/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=ZillaPopupKiller:8100
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: (no name) - {98C92840-EB1C-40bd-B6A5-395EC9CD6510} - (no file)
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunServer] C:\Program Files\CounterSpy\sunserver.exe
O4 - HKLM\..\RunServices: [Windows Update] msnmgr.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Anti-Pub.lnk = Mes images\Antipub\antipub.exe
O4 - Startup: OpenOffice.org 1.1.3.lnk = C:\Program Files\OpenOffice.org1.1.3\program\quickstart.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Télécharger avec InstantGet - res://C:\Documents and Settings\Chris\Mes documents\Mes images\InstantGet(accelerateur)\IGCatcher.dll/IGLink.htm
O8 - Extra context menu item: Télécharger tout &avec InstantGet - res://C:\Documents and Settings\Chris\Mes documents\Mes images\InstantGet(accelerateur)\IGCatcher.dll/IGAll.htm
O9 - Extra button: Run InstantGet - {6DDFE91C-A45C-4812-8F57-098932C9D88D} - C:\Documents and Settings\Chris\Mes documents\Mes images\InstantGet(accelerateur)\InstantGet.exe
O9 - Extra 'Tools' menuitem: &InstantGet - {6DDFE91C-A45C-4812-8F57-098932C9D88D} - C:\Documents and Settings\Chris\Mes documents\Mes images\InstantGet(accelerateur)\InstantGet.exe
O14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {45E83043-1F6F-4D22-A5E7-0138EA171B49} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fr/filesharingctrl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136639565703
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F8858BF-5322-4127-8A7A-2212185399C1}: NameServer = 212.27.32.176,212.27.32.177
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: ThemeManager - C:\WINDOWS\system32\gpjml3111.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Merci de votre aide

25 réponses

Résumé de la discussion

Infection Look2Me et plusieurs trojans détectés par ewido et CounterSpy, avec un rapport HijackThis détaillé et des conseils pour nettoyer le système et éliminer les composants persistants. Les meilleures réponses recommandent Look2Me Remover et l2mfix, puis des guides alternatifs sur BernieClub et des méthodes pour désactiver la restauration système, redémarrer, puis établir un nouveau point de restauration. D'autres conseils insistent sur la relance de HijackThis, la suppression ciblée de fichiers DLL indésirables et la vérification des éléments Winlogon Notify et des entrées host, puis une nouvelle analyse pour confirmer le nettoyage. Des éléments comme des lignes de démarrage ou des services persistants peuvent réapparaître après redémarrage, d'où l'importance d'une suppression complète et d'un nouveau contrôle post-nettoyage.

Bobot (l’IA à votre service)
  2. tom54 Auteur
    J'ai réussi a virer Look2Me!!!
    En fait j'avais mal fait l'option 2 avant.
    J'ai supprimé la ligne 020 et maintenant elle ne revient plus.

    Logfile of HijackThis v1.99.1
    Scan saved at 20:22:59, on 08/01/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Alwil Software (Avast)\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software (Avast)\Avast4\ashServ.exe
    C:\WINDOWS\system32\ZoneLabs\isafe.exe
    C:\Documents and Settings\Chris\Mes documents\Mes images\ewido anti-malware\ewidoctrl.exe
    C:\Documents and Settings\Chris\Mes documents\Mes images\ewido anti-malware\ewidoguard.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\CounterSpy\sunserver.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Documents and Settings\Chris\Mes documents\Mes images\Antipub\antipub.exe
    C:\Program Files\OpenOffice.org1.1.3\program\soffice.exe
    C:\Program Files\Alwil Software (Avast)\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software (Avast)\Avast4\ashWebSv.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Chris\Mes documents\Mes images\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://free.fr/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=ZillaPopupKiller:8100
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SunServer] C:\Program Files\CounterSpy\sunserver.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Startup: Anti-Pub.lnk = Mes images\Antipub\antipub.exe
    O4 - Startup: OpenOffice.org 1.1.3.lnk = C:\Program Files\OpenOffice.org1.1.3\program\quickstart.exe
    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {45E83043-1F6F-4D22-A5E7-0138EA171B49} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fr/filesharingctrl.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136639565703
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{4F8858BF-5322-4127-8A7A-2212185399C1}: NameServer = 212.27.32.176,212.27.32.177
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\Chris\Mes documents\Mes images\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Documents and Settings\Chris\Mes documents\Mes images\ewido anti-malware\ewidoguard.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

    Merci beaucoup de ton aide bernie :-)
    1. bernie61
      ok
      option 2 alors

      puis refais un hijack

      sinon regardes aussi après ça

      3. Effacer ces programmes .EXE et .DLL( et à la fin vider la corbeille)
      g2402chmgf4a2.dll
      dnpo0173e.dll
      c4000edmeh0a0.dll
      updinst.exe
      installer.exe
      upd210.exe
      no.exe
      et
      systemroot+\system32\msg{b9a9ac6a-2cc9-4a24-a250-bea974703ff8}0110.dll
      systemroot+\system32\msg{aac5700f-954a-47b7-9746-871ae8e634e4}0115.dll
      systemroot+\system32\msg{9d4f5b7c-2a4b-46c5-99a7-4c775b688d45}0111.dll
      systemroot+\system32\msg{9d4f5b7c-2a4b-46c5-99a7-4c775b688d45}0110.dll
      systemroot+\system32\msg{93396c3f-aea3-4ac0-bb55-81f0f0414a24}0113.dll
      systemroot+\system32\msg{63de1ad9-f0c6-4dac-886a-5a9707b0d23c}0111.dll
      systemroot+\system32\msg{63de1ad9-f0c6-4dac-886a-5a9707b0d23c}0110.dll
      systemroot+\system32\msg{5bef546a-e3c1-489c-996a-c9688d985ae0}0111.dll
      systemroot+\system32\msg{5bef546a-e3c1-489c-996a-c9688d985ae0}0110.dll
      systemroot+\system32\msg{46b08877-2be4-4f35-8e77-034c2142321c}0115.dll
      systemroot+\system32\msg{1e253d5d-6add-4fe9-829c-f51038158be5}0111.dll
      systemroot+\system32\msg{1e253d5d-6add-4fe9-829c-f51038158be5}0110.dll
      systemroot+\system32\allui.dll
      systemroot+\system\msg{15dd85c0-1b81-11d8-a1e4-00a0cc251329}0113.dll
      mixml2.dll
      esprod.dll
      systemroot+\system32\msg{e8d8ffef-30a4-4df1-a618-e0599a0d0a15}0110.dll
      systemroot+\system32\msg{e01b47a7-a499-4fee-83c2-b0684ca28e6b}0115.dll
      systemroot+\system32\msg{d331b768-d6da-41e8-a7b6-78ed724126c0}0115.dll
      systemroot+\system32\msg{b9a9ac6a-2cc9-4a24-a250-bea974703ff8}0111.dll
      systemroot+\system32\msg{e8d8ffef-30a4-4df1-a618-e0599a0d0a15}0111.dll
      4. fais Démarrer/exécuter et là tappes SERVICES.MSC pour arrêter les services suivants :
      (double cliq sur le service incriminé puis cliq ARRETER et DESACTIVER à type de démarrage)
      Pour look2ME, Ouvre regedit et va là
      HKEY_CURRENT_USER\software\look2me
      Efface la clef look2me

      5. vider les répertoires temps et la corbeille, en lançant Ccleaner
      Refais un hijackthis de contrôle et dis nous où en sont les problèmes
      a+
      1. tom54 Auteur
        L2MFIX find log 010406
        These are the registry keys present
        **********************************************************************************
        Winlogon/notify:
        Windows Registry Editor Version 5.00

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\BITS]
        "Asynchronous"=dword:00000000
        "DllName"="C:\\WINDOWS\\system32\\irl4l53q1.dll"
        "Impersonate"=dword:00000000
        "Logon"="WinLogon"
        "Logoff"="WinLogoff"
        "Shutdown"="WinShutdown"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
        "Asynchronous"=dword:00000000
        "Impersonate"=dword:00000000
        "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
        6c,00,00,00
        "Logoff"="ChainWlxLogoffEvent"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
        "Asynchronous"=dword:00000000
        "Impersonate"=dword:00000000
        "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
        6c,00,6c,00,00,00
        "Logoff"="CryptnetWlxLogoffEvent"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
        "DLLName"="cscdll.dll"
        "Logon"="WinlogonLogonEvent"
        "Logoff"="WinlogonLogoffEvent"
        "ScreenSaver"="WinlogonScreenSaverEvent"
        "Startup"="WinlogonStartupEvent"
        "Shutdown"="WinlogonShutdownEvent"
        "StartShell"="WinlogonStartShellEvent"
        "Impersonate"=dword:00000000
        "Asynchronous"=dword:00000001

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
        "DLLName"="wlnotify.dll"
        "Logon"="SCardStartCertProp"
        "Logoff"="SCardStopCertProp"
        "Lock"="SCardSuspendCertProp"
        "Unlock"="SCardResumeCertProp"
        "Enabled"=dword:00000001
        "Impersonate"=dword:00000001
        "Asynchronous"=dword:00000001

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
        "Asynchronous"=dword:00000000
        "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
        6c,00,6c,00,00,00
        "Impersonate"=dword:00000000
        "StartShell"="SchedStartShell"
        "Logoff"="SchedEventLogOff"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
        "Logoff"="WLEventLogoff"
        "Impersonate"=dword:00000000
        "Asynchronous"=dword:00000001
        "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
        6c,00,6c,00,00,00

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
        "DLLName"="WlNotify.dll"
        "Lock"="SensLockEvent"
        "Logon"="SensLogonEvent"
        "Logoff"="SensLogoffEvent"
        "Safe"=dword:00000001
        "MaxWait"=dword:00000258
        "StartScreenSaver"="SensStartScreenSaverEvent"
        "StopScreenSaver"="SensStopScreenSaverEvent"
        "Startup"="SensStartupEvent"
        "Shutdown"="SensShutdownEvent"
        "StartShell"="SensStartShellEvent"
        "PostShell"="SensPostShellEvent"
        "Disconnect"="SensDisconnectEvent"
        "Reconnect"="SensReconnectEvent"
        "Unlock"="SensUnlockEvent"
        "Impersonate"=dword:00000001
        "Asynchronous"=dword:00000001

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
        "Asynchronous"=dword:00000000
        "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
        6c,00,6c,00,00,00
        "Impersonate"=dword:00000000
        "Logoff"="TSEventLogoff"
        "Logon"="TSEventLogon"
        "PostShell"="TSEventPostShell"
        "Shutdown"="TSEventShutdown"
        "StartShell"="TSEventStartShell"
        "Startup"="TSEventStartup"
        "MaxWait"=dword:00000258
        "Reconnect"="TSEventReconnect"
        "Disconnect"="TSEventDisconnect"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
        "DLLName"="wlnotify.dll"
        "Logon"="RegisterTicketExpiredNotificationEvent"
        "Logoff"="UnregisterTicketExpiredNotificationEvent"
        "Impersonate"=dword:00000001
        "Asynchronous"=dword:00000001

        **********************************************************************************
        useragent:
        Windows Registry Editor Version 5.00

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
        "{B3C64340-062B-8345-17E0-FEB19ACAEB5E}"=""

        **********************************************************************************
        Shell Extension key:
        Windows Registry Editor Version 5.00

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
        "{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"
        "{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"
        "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"
        "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"
        "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
        "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
        "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"
        "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration"
        "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"
        "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"
        "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚"
        "{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement"
        "{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"
        "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows"
        "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"
        "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"
        "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers"
        "{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web"
        "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
        "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"
        "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"
        "{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal"
        "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
        "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
        "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"
        "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
        "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
        "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"
        "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"
        "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau"
        "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau"
        "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo"
        "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo"
        "{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo"
        "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo"
        "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo"
        "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
        "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
        "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows"
        "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft"
        "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
        "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
        "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"
        "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer"
        "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher"
        "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
        "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
        "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..."
        "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
        "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique"
        "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices"
        "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration"
        "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
        "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
        "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
        "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
        "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
        "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
        "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"
        "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement"
        "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"
        "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"
        "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
        "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"
        "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche"
        "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
        "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"
        "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"
        "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"
        "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
        "{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"
        "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"
        "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
        "{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"
        "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"
        "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
        "{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"
        "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses"
        "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"
        "{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"
        "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"
        "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"
        "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
        "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"
        "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
        "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"
        "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"
        "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
        "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
        "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
        "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
        "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
        "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
        "{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique"
        "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
        "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
        "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
        "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"
        "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
        "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
        "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
        "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
        "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
        "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
        "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
        "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
        "{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache"
        "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
        "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
        "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription"
        "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
        "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
        "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
        "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
        "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
        "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
        "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
        "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement"
        "{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es"
        "{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin"
        "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
        "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
        "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI"
        "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)"
        "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML"
        "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
        "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web"
        "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web"
        "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell"
        "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport"
        "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs"
        "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
        "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
        "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne"
        "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne"
        "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
        "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
        "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
        "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
        "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
        "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
        "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
        "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
        "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
        "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
        "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
        "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
        "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
        "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
        "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
        "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
        "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
        "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
        "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
        "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
        "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
        "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"
        "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
        "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
        "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
        "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
        "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
        "{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."
        "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
        "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
        "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
        "{D3581EB7-5E16-4182-9F58-86FA713B42F9}"="AOL Partenaire de Packard Bell"
        "{DEE12703-6333-4D4E-8F34-738C4DCC2E04}"="RecordNow! SendToExt"
        "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
        "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Dossiers Web"
        "{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
        "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
        "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
        "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
        "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
        "{63542C48-9552-494A-84F7-73AA6A7C99C1}"="OpenOffice Property Sheet Handler"
        "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
        "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
        "{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
        "{AB77609F-2178-4E6F-9C4B-44AC179D937A}"="aý Context Menu Shell Extension"
        "{23170F69-40C1-278A-1000-000100020000}"="7-Zip Shell Extension"
        "{21569614-B795-46b1-85F4-E737A8DC09AD}"="Shell Search Band"
        "{D9872D13-7651-4471-9EEE-F0A00218BEBB}"="Multiscan"
        "{472083B0-C522-11CF-8763-00608CC02F24}"="avast"
        "{DA57BCD1-CD8B-4CA3-9B32-BEBE1BC9153C}"=""
        "{6F481C2A-C774-4FDA-9DBF-50003821E4CB}"=""
        "{CADBF68A-85D5-4F11-B07C-9D334DD68B34}"=""
        "{C177EC17-C652-4685-923B-054CC6081548}"=""
        "{5016D3D9-A322-449B-8B42-120E23867249}"=""
        "{21890A25-2308-4845-9858-A69DB9FE8444}"=""

        **********************************************************************************
        HKEY ROOT CLASSIDS:
        Windows Registry Editor Version 5.00

        [HKEY_CLASSES_ROOT\CLSID\{DA57BCD1-CD8B-4CA3-9B32-BEBE1BC9153C}]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{DA57BCD1-CD8B-4CA3-9B32-BEBE1BC9153C}\Implemented Categories]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{DA57BCD1-CD8B-4CA3-9B32-BEBE1BC9153C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{DA57BCD1-CD8B-4CA3-9B32-BEBE1BC9153C}\InprocServer32]
        @="C:\\WINDOWS\\system32\\guard.tmp"
        "ThreadingModel"="Apartment"

        Windows Registry Editor Version 5.00

        [HKEY_CLASSES_ROOT\CLSID\{6F481C2A-C774-4FDA-9DBF-50003821E4CB}]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{6F481C2A-C774-4FDA-9DBF-50003821E4CB}\Implemented Categories]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{6F481C2A-C774-4FDA-9DBF-50003821E4CB}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{6F481C2A-C774-4FDA-9DBF-50003821E4CB}\InprocServer32]
        @="C:\\WINDOWS\\system32\\dGd8thk.dll"
        "ThreadingModel"="Apartment"

        Windows Registry Editor Version 5.00

        [HKEY_CLASSES_ROOT\CLSID\{CADBF68A-85D5-4F11-B07C-9D334DD68B34}]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{CADBF68A-85D5-4F11-B07C-9D334DD68B34}\Implemented Categories]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{CADBF68A-85D5-4F11-B07C-9D334DD68B34}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{CADBF68A-85D5-4F11-B07C-9D334DD68B34}\InprocServer32]
        @="C:\\WINDOWS\\system32\\dmuiext.dll"
        "ThreadingModel"="Apartment"

        Windows Registry Editor Version 5.00

        [HKEY_CLASSES_ROOT\CLSID\{C177EC17-C652-4685-923B-054CC6081548}]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{C177EC17-C652-4685-923B-054CC6081548}\Implemented Categories]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{C177EC17-C652-4685-923B-054CC6081548}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{C177EC17-C652-4685-923B-054CC6081548}\InprocServer32]
        @="C:\\WINDOWS\\system32\\mM64lgjq16oe.dll"
        "ThreadingModel"="Apartment"

        Windows Registry Editor Version 5.00

        [HKEY_CLASSES_ROOT\CLSID\{5016D3D9-A322-449B-8B42-120E23867249}]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{5016D3D9-A322-449B-8B42-120E23867249}\Implemented Categories]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{5016D3D9-A322-449B-8B42-120E23867249}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{5016D3D9-A322-449B-8B42-120E23867249}\InprocServer32]
        @="C:\\WINDOWS\\system32\\guard.tmp"
        "ThreadingModel"="Apartment"

        Windows Registry Editor Version 5.00

        [HKEY_CLASSES_ROOT\CLSID\{21890A25-2308-4845-9858-A69DB9FE8444}]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{21890A25-2308-4845-9858-A69DB9FE8444}\Implemented Categories]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{21890A25-2308-4845-9858-A69DB9FE8444}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
        @=""

        [HKEY_CLASSES_ROOT\CLSID\{21890A25-2308-4845-9858-A69DB9FE8444}\InprocServer32]
        @="C:\\WINDOWS\\system32\\kodno.dll"
        "ThreadingModel"="Apartment"

        **********************************************************************************
        Files Found are not all bad files:
        Locate .tmp files:
        **********************************************************************************
        Directory Listing of system files:
        Le volume dans le lecteur C s'appelle HDD
        Le num‚ro de s‚rie du volume est 9CCA-4D0F

        R‚pertoire de C:\WINDOWS\System32

        08/01/2006 19:45 233ÿ916 kodno.dll
        08/01/2006 19:45 235ÿ741 ir28l5fu1.dll
        08/01/2006 19:32 233ÿ916 irl4l53q1.dll
        07/01/2006 03:19 <REP> dllcache
        06/02/2004 06:46 <REP> Microsoft
        16/08/2003 20:56 579ÿ584 cd.exe
        4 fichier(s) 1ÿ283ÿ157 octets
        2 R‚p(s) 41ÿ402ÿ458ÿ112 octets libres
        3. tom54 Auteur
          J'ai fixer les deux lignes et j'ai effacé C:\WINDOWS\system32\azaol9d31.dll mais il revient avec un autre nom.

          "Effacer ces programmes .EXE et .DLL( et à la fin vider la corbeille)"

          C'est quels programmes qu'il faut j'efface?

          Logfile of HijackThis v1.99.1
          Scan saved at 19:55:34, on 08/01/2006
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\Ati2evxx.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Alwil Software (Avast)\Avast4\aswUpdSv.exe
          C:\Program Files\Alwil Software (Avast)\Avast4\ashServ.exe
          C:\WINDOWS\system32\rundll32.exe
          C:\WINDOWS\system32\ZoneLabs\isafe.exe
          C:\Documents and Settings\Chris\Mes documents\Mes images\ewido anti-malware\ewidoctrl.exe
          C:\Documents and Settings\Chris\Mes documents\Mes images\ewido anti-malware\ewidoguard.exe
          C:\WINDOWS\Explorer.EXE
          C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
          C:\WINDOWS\system32\slserv.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
          C:\WINDOWS\system32\ZoneLabs\vsmon.exe
          C:\WINDOWS\wanmpsvc.exe
          C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
          C:\Program Files\HP\HP Software Update\HPWuSchd.exe
          C:\Program Files\QuickTime\qttask.exe
          C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          C:\Program Files\CounterSpy\sunserver.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\Alwil Software (Avast)\Avast4\ashMaiSv.exe
          C:\Program Files\Alwil Software (Avast)\Avast4\ashWebSv.exe
          C:\Documents and Settings\Chris\Mes documents\Mes images\Antipub\antipub.exe
          C:\Program Files\OpenOffice.org1.1.3\program\soffice.exe
          C:\Program Files\Internet Explorer\iexplore.exe
          C:\Documents and Settings\Chris\Mes documents\Mes images\HijackThis.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://free.fr/
          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=ZillaPopupKiller:8100
          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
          O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
          O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          O4 - HKLM\..\Run: [SunServer] C:\Program Files\CounterSpy\sunserver.exe
          O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
          O4 - Startup: Anti-Pub.lnk = Mes images\Antipub\antipub.exe
          O4 - Startup: OpenOffice.org 1.1.3.lnk = C:\Program Files\OpenOffice.org1.1.3\program\quickstart.exe
          O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
          O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
          O14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/
          O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
          O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
          O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
          O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
          O16 - DPF: {45E83043-1F6F-4D22-A5E7-0138EA171B49} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fr/filesharingctrl.cab
          O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
          O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136639565703
          O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
          O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
          O17 - HKLM\System\CCS\Services\Tcpip\..\{4F8858BF-5322-4127-8A7A-2212185399C1}: NameServer = 212.27.32.176,212.27.32.177
          O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
          O20 - Winlogon Notify: BITS - C:\WINDOWS\system32\irl4l53q1.dll
          O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\aswUpdSv.exe
          O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
          O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
          O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\ashServ.exe
          O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\ashMaiSv.exe" /service (file missing)
          O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\ashWebSv.exe" /service (file missing)
          O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
          O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\Chris\Mes documents\Mes images\ewido anti-malware\ewidoctrl.exe
          O23 - Service: ewido security suite guard - ewido networks - C:\Documents and Settings\Chris\Mes documents\Mes images\ewido anti-malware\ewidoguard.exe
          O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
          O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
          O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
          O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
          1. bernie61
            re
            2. Relances Hijackthis et coche (puis FIX)
            O3 - Toolbar: (no name) - {98C92840-EB1C-40bd-B6A5-395EC9CD6510} - (no file)
            O20 - Winlogon Notify: RunOnceEx - C:\WINDOWS\system32\azaol9d31.dll
            3. Effacer ces programmes .EXE et .DLL( et à la fin vider la corbeille)
            C:\WINDOWS\system32\azaol9d31.dll > effacer avec l’effaceur hijackthis

            5. vider les répertoires temps et la corbeille, en lançant Ccleaner
            Refais un hijackthis de contrôle et dis nous où en sont les problèmes
            a+
            1. tom54 Auteur
              Logfile of HijackThis v1.99.1
              Scan saved at 18:41:26, on 08/01/2006
              Platform: Windows XP SP2 (WinNT 5.01.2600)
              MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

              Running processes:
              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\Ati2evxx.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\system32\spoolsv.exe
              C:\WINDOWS\system32\rundll32.exe
              C:\Program Files\Alwil Software (Avast)\Avast4\aswUpdSv.exe
              C:\Program Files\Alwil Software (Avast)\Avast4\ashServ.exe
              C:\WINDOWS\system32\ZoneLabs\isafe.exe
              C:\WINDOWS\Explorer.EXE
              C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
              C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
              C:\Program Files\HP\HP Software Update\HPWuSchd.exe
              C:\Program Files\QuickTime\qttask.exe
              C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
              C:\Program Files\CounterSpy\sunserver.exe
              C:\WINDOWS\system32\ctfmon.exe
              C:\Documents and Settings\Chris\Mes documents\Mes images\Antipub\antipub.exe
              C:\Program Files\OpenOffice.org1.1.3\program\soffice.exe
              C:\WINDOWS\system32\slserv.exe
              C:\WINDOWS\System32\svchost.exe
              C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
              C:\WINDOWS\system32\ZoneLabs\vsmon.exe
              C:\WINDOWS\wanmpsvc.exe
              C:\Program Files\Alwil Software (Avast)\Avast4\ashMaiSv.exe
              C:\Program Files\Alwil Software (Avast)\Avast4\ashWebSv.exe
              C:\Documents and Settings\Chris\Mes documents\Mes images\ewido anti-malware\ewidoguard.exe
              C:\Documents and Settings\Chris\Mes documents\Mes images\ewido anti-malware\ewidoctrl.exe
              C:\Program Files\Internet Explorer\iexplore.exe
              C:\Documents and Settings\Chris\Mes documents\Mes images\HijackThis.exe

              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://free.fr/
              R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=ZillaPopupKiller:8100
              R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
              O3 - Toolbar: (no name) - {98C92840-EB1C-40bd-B6A5-395EC9CD6510} - (no file)
              O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
              O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
              O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
              O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
              O4 - HKLM\..\Run: [SunServer] C:\Program Files\CounterSpy\sunserver.exe
              O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
              O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
              O4 - Startup: Anti-Pub.lnk = Mes images\Antipub\antipub.exe
              O4 - Startup: OpenOffice.org 1.1.3.lnk = C:\Program Files\OpenOffice.org1.1.3\program\quickstart.exe
              O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
              O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
              O14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/
              O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
              O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
              O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
              O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
              O16 - DPF: {45E83043-1F6F-4D22-A5E7-0138EA171B49} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fr/filesharingctrl.cab
              O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
              O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136639565703
              O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
              O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
              O17 - HKLM\System\CCS\Services\Tcpip\..\{4F8858BF-5322-4127-8A7A-2212185399C1}: NameServer = 212.27.32.176,212.27.32.177
              O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
              O20 - Winlogon Notify: RunOnceEx - C:\WINDOWS\system32\azaol9d31.dll
              O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\aswUpdSv.exe
              O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
              O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
              O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\ashServ.exe
              O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\ashMaiSv.exe" /service (file missing)
              O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\ashWebSv.exe" /service (file missing)
              O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
              O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\Chris\Mes documents\Mes images\ewido anti-malware\ewidoctrl.exe
              O23 - Service: ewido security suite guard - ewido networks - C:\Documents and Settings\Chris\Mes documents\Mes images\ewido anti-malware\ewidoguard.exe
              O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
              O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
              O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
              O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
              2. tom54 Auteur
                ---------------------------------------------------------
                ewido anti-malware - Rapport de scan
                ---------------------------------------------------------

                + Créé le: 17:54:25, 08/01/2006
                + Somme de contrôle: BD892A92

                + Résultats du scan:

                [1324] C:\WINDOWS\system32\mM64lgjq16oe.dll -> Spyware.Look2Me : Erreur durant le nettoyage
                C:\Documents and Settings\Chris\Cookies\chris@247realmedia[1].txt -> Spyware.Cookie.247realmedia : Nettoyer et sauvegarder
                C:\Documents and Settings\Chris\Cookies\chris@ad.yieldmanager[2].txt -> Spyware.Cookie.Yieldmanager : Nettoyer et sauvegarder
                C:\Documents and Settings\Chris\Cookies\chris@bluestreak[1].txt -> Spyware.Cookie.Bluestreak : Nettoyer et sauvegarder
                C:\Documents and Settings\Chris\Cookies\chris@data1.perf.overture[1].txt -> Spyware.Cookie.Overture : Nettoyer et sauvegarder
                C:\Documents and Settings\Chris\Cookies\chris@paypopup[2].txt -> Spyware.Cookie.Paypopup : Nettoyer et sauvegarder
                C:\Documents and Settings\Chris\Cookies\chris@perf.overture[1].txt -> Spyware.Cookie.Overture : Nettoyer et sauvegarder
                C:\Documents and Settings\Chris\Cookies\chris@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Nettoyer et sauvegarder
                C:\Documents and Settings\Chris\Cookies\chris@www.smartadserver[1].txt -> Spyware.Cookie.Smartadserver : Nettoyer et sauvegarder
                C:\Documents and Settings\Chris\Local Settings\Temporary Internet Files\Content.IE5\6OXCRK33\ErrorSafeScannerInstall_fr[1].exe -> Not-A-Virus.Downloader.Agent.d : Nettoyer et sauvegarder
                C:\WINDOWS\system32\dGd8thk.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
                C:\WINDOWS\system32\dmuiext.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
                C:\WINDOWS\system32\fprs0397e.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
                C:\WINDOWS\system32\gp6sl3j71.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
                C:\WINDOWS\system32\guard.tmp -> Spyware.Look2Me : Nettoyer et sauvegarder
                C:\WINDOWS\system32\h0l20a3oed.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
                C:\WINDOWS\system32\ktrul7991.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
                C:\WINDOWS\system32\m664lgjq16oe.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
                C:\WINDOWS\system32\mv0ol9d31.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
                C:\WINDOWS\system32\o0840alqedqe0.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
                C:\WINDOWS\system32\__delete_on_reboot__mM64lgjq16oe.dll -> Spyware.Look2Me : Nettoyer et sauvegarder

                ::Fin du rapport
                1. tom54 Auteur
                  Tu m'avait dit avant:
                  avec l'effaceur de hijack tu effaces ces 3 dll
                  lv0o09d3e.dll
                  gp6sl3j71.dll
                  gpjml3111.dll

                  J'ai effacer gp6sl3j71.dll mais c'est revenu et les 2 autres je ne l'ai ai pas trouvés.

                  Ensuite j'ai fixé O4 - HKLM\..\RunServices: [Windows Update] msnmgr.exe et O20 - Winlogon Notify: RunOnceEx - C:\WINDOWS\system32\azaol9d31.dll (il a changé mais il revient toujours)

                  "ensuite efface avec l'effaceur hijack
                  c:... msnmgr.exe
                  et
                  en8ql1l51.dll"

                  Je n'ai trouvé aucun des deux...

                  "re
                  il a redémarré tout seul suite à la procédure de effaceur hijack non?"

                  Non, mon ordi a redemarrer avant la procédure et il continu de redemarrer quand il a envie :(

                  Logfile of HijackThis v1.99.1
                  Scan saved at 17:15:47, on 08/01/2006
                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\Ati2evxx.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\WINDOWS\system32\rundll32.exe
                  C:\Program Files\Alwil Software (Avast)\Avast4\aswUpdSv.exe
                  C:\Program Files\Alwil Software (Avast)\Avast4\ashServ.exe
                  C:\WINDOWS\system32\ZoneLabs\isafe.exe
                  C:\WINDOWS\Explorer.EXE
                  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                  C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
                  C:\Program Files\HP\HP Software Update\HPWuSchd.exe
                  C:\Program Files\QuickTime\qttask.exe
                  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                  C:\Program Files\CounterSpy\sunserver.exe
                  C:\WINDOWS\system32\ctfmon.exe
                  C:\Documents and Settings\Chris\Mes documents\Mes images\Antipub\antipub.exe
                  C:\Program Files\OpenOffice.org1.1.3\program\soffice.exe
                  C:\WINDOWS\system32\slserv.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
                  C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                  C:\WINDOWS\wanmpsvc.exe
                  C:\Program Files\Alwil Software (Avast)\Avast4\ashMaiSv.exe
                  C:\Program Files\Alwil Software (Avast)\Avast4\ashWebSv.exe
                  C:\Program Files\Internet Explorer\iexplore.exe
                  C:\Documents and Settings\Chris\Mes documents\Mes images\HijackThis.exe

                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://free.fr/
                  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=ZillaPopupKiller:8100
                  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                  O3 - Toolbar: (no name) - {98C92840-EB1C-40bd-B6A5-395EC9CD6510} - (no file)
                  O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
                  O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
                  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                  O4 - HKLM\..\Run: [SunServer] C:\Program Files\CounterSpy\sunserver.exe
                  O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
                  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                  O4 - Startup: Anti-Pub.lnk = Mes images\Antipub\antipub.exe
                  O4 - Startup: OpenOffice.org 1.1.3.lnk = C:\Program Files\OpenOffice.org1.1.3\program\quickstart.exe
                  O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
                  O14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/
                  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
                  O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
                  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                  O16 - DPF: {45E83043-1F6F-4D22-A5E7-0138EA171B49} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fr/filesharingctrl.cab
                  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
                  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136639565703
                  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
                  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                  O17 - HKLM\System\CCS\Services\Tcpip\..\{4F8858BF-5322-4127-8A7A-2212185399C1}: NameServer = 212.27.32.176,212.27.32.177
                  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
                  O20 - Winlogon Notify: RunOnceEx - C:\WINDOWS\system32\azaol9d31.dll
                  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\aswUpdSv.exe
                  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                  O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\ashServ.exe
                  O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\ashMaiSv.exe" /service (file missing)
                  O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\ashWebSv.exe" /service (file missing)
                  O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
                  O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
                  O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
                  O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                  O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

                  Je vais essayer l'antitrojan ewido maintenant.
                  2. bernie61
                    re
                    il a redémarré tout seul suite à la procédure de effaceur hijack non?
                    refais un rapport hijackthis
                    a+
                    1. tom54 Auteur
                      Mon ordinateur redémarre tout seul maintenant :((
                      Et j'ai toujours le message "winlogon.exe a rencontré un probleme et doit être fermé."
                      2. tom54 Auteur
                        J'ai fait ce que tu m'a dit mais la ligne 020 reapparait...

                        Logfile of HijackThis v1.99.1
                        Scan saved at 16:17:18, on 08/01/2006
                        Platform: Windows XP SP2 (WinNT 5.01.2600)
                        MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                        Running processes:
                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\Ati2evxx.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\system32\spoolsv.exe
                        C:\WINDOWS\system32\rundll32.exe
                        C:\Program Files\Alwil Software (Avast)\Avast4\aswUpdSv.exe
                        C:\Program Files\Alwil Software (Avast)\Avast4\ashServ.exe
                        C:\WINDOWS\Explorer.EXE
                        C:\WINDOWS\system32\ZoneLabs\isafe.exe
                        C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                        C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
                        C:\Program Files\HP\HP Software Update\HPWuSchd.exe
                        C:\Program Files\QuickTime\qttask.exe
                        C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                        C:\Program Files\CounterSpy\sunserver.exe
                        C:\WINDOWS\system32\ctfmon.exe
                        C:\Documents and Settings\Chris\Mes documents\Mes images\Antipub\antipub.exe
                        C:\Program Files\OpenOffice.org1.1.3\program\soffice.exe
                        C:\WINDOWS\system32\slserv.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
                        C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                        C:\WINDOWS\wanmpsvc.exe
                        C:\Program Files\Internet Explorer\iexplore.exe
                        C:\Program Files\Alwil Software (Avast)\Avast4\ashMaiSv.exe
                        C:\Program Files\Alwil Software (Avast)\Avast4\ashWebSv.exe
                        C:\Documents and Settings\Chris\Mes documents\Mes images\HijackThis.exe

                        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://free.fr/
                        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=ZillaPopupKiller:8100
                        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                        O3 - Toolbar: (no name) - {98C92840-EB1C-40bd-B6A5-395EC9CD6510} - (no file)
                        O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
                        O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
                        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                        O4 - HKLM\..\Run: [SunServer] C:\Program Files\CounterSpy\sunserver.exe
                        O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
                        O4 - HKLM\..\RunServices: [Windows Update] msnmgr.exe
                        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                        O4 - Startup: Anti-Pub.lnk = Mes images\Antipub\antipub.exe
                        O4 - Startup: OpenOffice.org 1.1.3.lnk = C:\Program Files\OpenOffice.org1.1.3\program\quickstart.exe
                        O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                        O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
                        O14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/
                        O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                        O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
                        O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
                        O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                        O16 - DPF: {45E83043-1F6F-4D22-A5E7-0138EA171B49} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fr/filesharingctrl.cab
                        O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
                        O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136639565703
                        O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
                        O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                        O17 - HKLM\System\CCS\Services\Tcpip\..\{4F8858BF-5322-4127-8A7A-2212185399C1}: NameServer = 212.27.32.176,212.27.32.177
                        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
                        O20 - Winlogon Notify: Run - C:\WINDOWS\system32\en8ql1l51.dll
                        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\aswUpdSv.exe
                        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                        O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                        O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\ashServ.exe
                        O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\ashMaiSv.exe" /service (file missing)
                        O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\ashWebSv.exe" /service (file missing)
                        O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
                        O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
                        O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
                        O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                        O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
                        1. bernie61
                          oups
                          effacer aussi
                          C:\Documents and Settings\Chris\Mes documents\Mes images\InstantGet > le répertoire

                          a+
                          2. bernie61
                            re
                            relances hijack
                            coche ces lignes et fixe
                            O8 - Extra context menu item: Télécharger avec InstantGet - res://C:\Documents and Settings\Chris\Mes documents\Mes images\InstantGet(accelerateur)\IGCatcher.dll/IGLink.htm
                            O8 - Extra context menu item: Télécharger tout &avec InstantGet - res://C:\Documents and Settings\Chris\Mes documents\Mes images\InstantGet(accelerateur)\IGCatcher.dll/IGAll.htm
                            O9 - Extra button: Run InstantGet - {6DDFE91C-A45C-4812-8F57-098932C9D88D} - C:\Documents and Settings\Chris\Mes documents\Mes images\InstantGet(accelerateur)\InstantGet.exe
                            O9 - Extra 'Tools' menuitem: &InstantGet - {6DDFE91C-A45C-4812-8F57-098932C9D88D} - C:\Documents and Settings\Chris\Mes documents\Mes images\InstantGet(accelerateur)\InstantGet.exe
                            O20 - Winlogon Notify: MSSYCLM - C:\WINDOWS\system32\en8ql1l51.dll

                            avec l'effaceur de hijack tu effaces ces 3 dll
                            lv0o09d3e.dll
                            gp6sl3j71.dll
                            gpjml3111.dll

                            effaceur Hijackthis
                            ouvrir Hijackthis là en bas droite CONFIG puis onglet MISCtools, là « Delete a file on reboot », cliq dessus et suivre chemin de fichier à effacer, il indique alors « voulez-vous redémarrer maintenant », cliq sur NON si d’autres fichiers sont à sélectionner et à nouveau « Delete a file on reboot » .. puis cliq OUI quand tous les fichiers sont sélectionnés

                            puis refais un hijack
                            a+
                            1. tom54 Auteur
                              J'ai fait l'option 2 et apres le redemarrage j'ai eu un message d'erreur de winlogon.

                              Logfile of HijackThis v1.99.1
                              Scan saved at 16:00:19, on 08/01/2006
                              Platform: Windows XP SP2 (WinNT 5.01.2600)
                              MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                              Running processes:
                              C:\WINDOWS\System32\smss.exe
                              C:\WINDOWS\system32\winlogon.exe
                              C:\WINDOWS\system32\services.exe
                              C:\WINDOWS\system32\lsass.exe
                              C:\WINDOWS\system32\Ati2evxx.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\System32\svchost.exe
                              C:\WINDOWS\system32\spoolsv.exe
                              C:\WINDOWS\system32\rundll32.exe
                              C:\Program Files\Alwil Software (Avast)\Avast4\aswUpdSv.exe
                              C:\Program Files\Alwil Software (Avast)\Avast4\ashServ.exe
                              C:\WINDOWS\system32\ZoneLabs\isafe.exe
                              C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                              C:\WINDOWS\Explorer.EXE
                              C:\WINDOWS\system32\slserv.exe
                              C:\WINDOWS\System32\svchost.exe
                              C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
                              C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                              C:\WINDOWS\wanmpsvc.exe
                              C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
                              C:\Program Files\HP\HP Software Update\HPWuSchd.exe
                              C:\Program Files\QuickTime\qttask.exe
                              C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                              C:\Program Files\CounterSpy\sunserver.exe
                              C:\WINDOWS\system32\ctfmon.exe
                              C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                              C:\Documents and Settings\Chris\Mes documents\Mes images\Antipub\antipub.exe
                              C:\Program Files\OpenOffice.org1.1.3\program\soffice.exe
                              C:\Program Files\Alwil Software (Avast)\Avast4\ashMaiSv.exe
                              C:\Program Files\Alwil Software (Avast)\Avast4\ashWebSv.exe
                              C:\Program Files\Internet Explorer\iexplore.exe
                              C:\WINDOWS\system32\wuauclt.exe
                              C:\WINDOWS\system32\wuauclt.exe
                              C:\WINDOWS\system32\wuauclt.exe
                              C:\WINDOWS\system32\msiexec.exe
                              C:\WINDOWS\system32\MsiExec.exe
                              C:\Documents and Settings\Chris\Mes documents\Mes images\HijackThis.exe

                              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://free.fr/
                              R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=ZillaPopupKiller:8100
                              R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                              O3 - Toolbar: (no name) - {98C92840-EB1C-40bd-B6A5-395EC9CD6510} - (no file)
                              O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
                              O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
                              O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                              O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                              O4 - HKLM\..\Run: [SunServer] C:\Program Files\CounterSpy\sunserver.exe
                              O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
                              O4 - HKLM\..\RunServices: [Windows Update] msnmgr.exe
                              O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                              O4 - Startup: Anti-Pub.lnk = Mes images\Antipub\antipub.exe
                              O4 - Startup: OpenOffice.org 1.1.3.lnk = C:\Program Files\OpenOffice.org1.1.3\program\quickstart.exe
                              O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                              O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
                              O8 - Extra context menu item: Télécharger avec InstantGet - res://C:\Documents and Settings\Chris\Mes documents\Mes images\InstantGet(accelerateur)\IGCatcher.dll/IGLink.htm
                              O8 - Extra context menu item: Télécharger tout &avec InstantGet - res://C:\Documents and Settings\Chris\Mes documents\Mes images\InstantGet(accelerateur)\IGCatcher.dll/IGAll.htm
                              O9 - Extra button: Run InstantGet - {6DDFE91C-A45C-4812-8F57-098932C9D88D} - C:\Documents and Settings\Chris\Mes documents\Mes images\InstantGet(accelerateur)\InstantGet.exe
                              O9 - Extra 'Tools' menuitem: &InstantGet - {6DDFE91C-A45C-4812-8F57-098932C9D88D} - C:\Documents and Settings\Chris\Mes documents\Mes images\InstantGet(accelerateur)\InstantGet.exe
                              O14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/
                              O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                              O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
                              O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
                              O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                              O16 - DPF: {45E83043-1F6F-4D22-A5E7-0138EA171B49} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fr/filesharingctrl.cab
                              O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
                              O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136639565703
                              O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
                              O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                              O17 - HKLM\System\CCS\Services\Tcpip\..\{4F8858BF-5322-4127-8A7A-2212185399C1}: NameServer = 212.27.32.176,212.27.32.177
                              O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
                              O20 - Winlogon Notify: MSSYCLM - C:\WINDOWS\system32\en8ql1l51.dll
                              O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\aswUpdSv.exe
                              O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                              O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                              O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\ashServ.exe
                              O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\ashMaiSv.exe" /service (file missing)
                              O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software (Avast)\Avast4\ashWebSv.exe" /service (file missing)
                              O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
                              O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
                              O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
                              O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                              O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
                              • 1
                              • 2