Fenêtres intempestives

Résolu
ciletfil -  
Bonjour,

J'ai essayé de trouver directement la réponse à mon problème sur le forum, mais malheureusement, chaque configuration est spécifique... Alors à mon tour de vous soumettre mon problème :

J'ai reformater entièrement mon ordi en début de semaine car j'avais de nombreux problèmes divers dessus.

Malgré le formatage et la réinstallation de Windows, il subsiste le problème de fenêtres intempestives qui s'ouvrent à tout bout de champ, à savoir fenêtres de dialogues Windows (avertissement de sécurité qui me propose de télécharger tel ou tel logiciel) bigdispatch , sysprotect, 4injects, system doctor et plein d'autres.

J'ai installé ashampoo antispyware, mais le rootkit detector n'a rien trouvé.

J'ai lu sur le forum que vous demandiez régulièrement à faire un scan sous hijackthis et de copier le log. Du coup je me permet de le faire directement pour gagner du temps...

Si quelqu'un peut m'aider, merci d'avance...

Voici le log

Logfile of HijackThis v1.99.1
Scan saved at 10:28:52, on 21/10/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\AntiSpyWare.exe
C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\AntiSpyWareControl.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Documents and Settings\Administrateur\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

Dans l'attente de vos nouvelles,

Ciletfil

18 réponses

  1.  green day Modérateur
    c cool :)

    on est ravie ;-)

    @+
    0
    1. ciletfil Auteur
      Bon après quelques jours de tests, je vous confirme que ce problème est résolu, merci pour tout en tout cas...
      Vous êtes très efficaces !

      amicalement,
      Ciletfil
      0
      1. green day Modérateur
        Salut

        de rien !

        un peu de lecture au passage :

        https://sebsauvage.net/safehex.html

        securite proteger un ordinateur contre les malwares d internet

        @+

        ;-)

        **En vérité, le chemin importe peu, la volonté d'arriver suffit à tout ( A.Camus ) **
        0
        3. ciletfil
          Merci pour ces informations... C'est fait ...

          Les choses ont l'air de rentrer dans l'ordre.
          j'attends encore quelques heures pour voir si tout va toujours bien et je vous tiens au courant.

          Merci pour tout en tout cas ! Vous êtes très efficaces...

          Ciletfil
          0
          2. ciletfil Auteur
            Bonjour Green Day,

            J'ai bien fixé les 3 lignes en question, mais par contre qu'appelles-tu le CCleaner ?
            Dans l'attente de te lire afin de finir mon traitement de choc... En tout cas il y a l'air d'voir du progrès...

            A suivre

            Ciletfil
            0
            1. green day Modérateur
              re

              bien, fixe ces lignes stp :

              R3 - URLSearchHook: (no name) - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)

              O2 - BHO: (no name) - {AB945119-FBA3-45A3-9720-321D0A001B9B} - C:\WINDOWS\System32\mljgg.dll (file missing)

              O20 - Winlogon Notify: Controls Folder - C:\WINDOWS\system32\h4j40e1qeh.dll (file missing)

              ensuite, repasse un coup de ccleaner, et dis nous ce qu'il en est

              ++
              0
              1. ciletfil Auteur
                rebonsoir !

                ça y est j'ai effectué toutes manips en question et voici le résultat :

                Logfile of HijackThis v1.99.1
                Scan saved at 22:13:53, on 24/10/2006
                Platform: Windows XP SP1 (WinNT 5.01.2600)
                MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\Explorer.EXE
                C:\WINDOWS\system32\spoolsv.exe
                C:\WINDOWS\ATKKBService.exe
                C:\Documents and Settings\Administrateur\Bureau\ewido anti-spyware 4.0\guard.exe
                C:\WINDOWS\System32\nvsvc32.exe
                C:\Documents and Settings\Administrateur\Bureau\ewido anti-spyware 4.0\ewido.exe
                C:\WINDOWS\System32\ctfmon.exe
                C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                C:\Documents and Settings\Administrateur\Bureau\ccm.exe.exe

                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.fr/
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                R3 - URLSearchHook: (no name) - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
                O2 - BHO: (no name) - {AB945119-FBA3-45A3-9720-321D0A001B9B} - C:\WINDOWS\System32\mljgg.dll (file missing)
                O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
                O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
                O4 - HKLM\..\Run: [Ad-aware] "C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe" +c
                O4 - HKLM\..\Run: [!ewido] "C:\Documents and Settings\Administrateur\Bureau\ewido anti-spyware 4.0\ewido.exe" /minimized
                O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
                O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
                O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
                O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
                O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
                O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                O14 - IERESET.INF: START_PAGE_URL=http://www.google.fr/
                O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
                O20 - Winlogon Notify: Controls Folder - C:\WINDOWS\system32\h4j40e1qeh.dll (file missing)
                O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
                O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Documents and Settings\Administrateur\Bureau\ewido anti-spyware 4.0\guard.exe
                O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
                O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
                O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

                A bientôt pour la suite... je ne sais pas si tout a été éradiqué... A suivre..

                Ciletfil
                0
                1. green day Modérateur
                  Salut

                  merci Qc ;-))

                  Ciletfil :

                  Téléchargez VundoFix.exe (par Atribune) sur ton Bureau :

                  http://www.atribune.org/ccount/click.php?id=4

                  *Double-clique VundoFix.exe afin de le lancer.
                  * Cochez Run VundoFix as a task.
                  * l'outil va se fermer et s'ouvrir à nouveau : cliquez Ok
                  * Cliquez sur le bouton Scan for Vundo.
                  * Lorsque le scan est complété, cliquez sur le bouton Remove Vundo.
                  * Une invite vous demandera supprimer les fichiers, clique YES
                  * Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
                  * le PC va s'éteindre ("shutdown") : clique OK
                  * Démarrez votre PC à nouveau

                  ensuite reposte un nouveau hijackthis stp

                  ++
                  **En vérité, le chemin importe peu, la volonté d'arriver suffit à tout ( A.Camus ) **
                  0
                  1. ciletfil Auteur
                    malheureusement je crois que j'ai parlé trop vite, j'ai à nouveau eu qques fenêtres winantispyware, wynantiviruspro etc... depuis quelques minutes...
                    0
                    1. ciletfil Auteur
                      A priori tout va beaucoup mieux... je n'ai plus de fenêtres depuis des heures...

                      Voici néanmoins le nouveau rapport après avoir renommer en ccm.exe :

                      Logfile of HijackThis v1.99.1
                      Scan saved at 16:16:21, on 24/10/2006
                      Platform: Windows XP SP1 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\WINDOWS\ATKKBService.exe
                      C:\Documents and Settings\Administrateur\Bureau\ewido anti-spyware 4.0\guard.exe
                      C:\WINDOWS\System32\nvsvc32.exe
                      C:\Documents and Settings\Administrateur\Bureau\ewido anti-spyware 4.0\ewido.exe
                      C:\WINDOWS\System32\ctfmon.exe
                      C:\Program Files\Internet Explorer\iexplore.exe
                      C:\Documents and Settings\Administrateur\Bureau\ccm.exe.exe

                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                      R3 - URLSearchHook: (no name) - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
                      O2 - BHO: (no name) - {D82D5194-BC65-415B-9638-9F788655AC2B} - C:\WINDOWS\System32\mljgg.dll
                      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
                      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
                      O4 - HKLM\..\Run: [Ad-aware] "C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe" +c
                      O4 - HKLM\..\Run: [!ewido] "C:\Documents and Settings\Administrateur\Bureau\ewido anti-spyware 4.0\ewido.exe" /minimized
                      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
                      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                      O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
                      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                      O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
                      O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
                      O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
                      O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
                      O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                      O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                      O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
                      O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
                      O20 - Winlogon Notify: Controls Folder - C:\WINDOWS\system32\h4j40e1qeh.dll (file missing)
                      O20 - Winlogon Notify: mljgg - C:\WINDOWS\System32\mljgg.dll
                      O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
                      O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Documents and Settings\Administrateur\Bureau\ewido anti-spyware 4.0\guard.exe
                      O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
                      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
                      O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

                      Qu'en pensez vous ?
                      J'attends la suite,

                      Merci pour tout

                      Ciletfil
                      0
                      1. Qc001
                        Salut Green Day :-)

                        Beau travail avec Look2Me ;-)

                        C'est un beau Vundo caché... on voit bien les fichiers dans le rapport de l2mfix d'ailleurs. Étant donné que l'infection cache toutes les O2 et les O20-Winlogon, tu ne pouvais voir Look, ni Vundo. Astucieux ces pirates...
                        ====================

                        ciletfil : tu veux faire un truc pour moi ? Fais un clic droit sur l'icône de HijackThis! >> "Renommer" >> et renomme-le en ccm.exe

                        Fais un nouveau scan avec l'outil HijackThis! renommé, puis poste le rapport ici s'il te plaît.

                        @+
                        0
                        1. ciletfil Auteur
                          Bonjour Green Day et merci encore d'être présent pour mon problème.

                          Alors voici les rapports en question :

                          L2mfix 051206
                          Creating Account.
                          La commande s'est termin‚e correctement.

                          Adding Administrative privleges.
                          Checking for L2MFix account(0=no 1=yes):
                          1
                          Granting SeDebugPrivilege to L2MFIX ... successful

                          Running From:
                          C:\WINDOWS\system32

                          Killing Processes!
                          Killing 'smss.exe'
                          \SystemRoot\System32\smss.exe (556)
                          Killing 'winlogon.exe'
                          winlogon.exe (652)
                          Killing 'explorer.exe'
                          C:\WINDOWS\Explorer.EXE (1848)
                          Killing 'rundll32.exe'
                          rundll32.exe "C:\WINDOWS\system32\guard.tmp",DllGetVersion (532)
                          Restoring Sedebugprivilege:
                          Granting SeDebugPrivilege to Administrateurs ... successful

                          Scanning First Pass. Please Wait!

                          First Pass Completed

                          Second Pass Scanning

                          Second pass Completed!
                          1 fichier(s) copi‚(s).
                          1 fichier(s) copi‚(s).
                          1 fichier(s) copi‚(s).
                          1 fichier(s) copi‚(s).
                          Deleting: C:\WINDOWS\system32\h4j40e1qeh.dll
                          Successfully Deleted: C:\WINDOWS\system32\h4j40e1qeh.dll
                          Deleting: C:\WINDOWS\system32\i242lcho1f4c.dll
                          Successfully Deleted: C:\WINDOWS\system32\i242lcho1f4c.dll
                          Deleting: C:\WINDOWS\system32\mvjet40.dll
                          Successfully Deleted: C:\WINDOWS\system32\mvjet40.dll
                          Deleting: C:\WINDOWS\system32\r4r60e9seh.dll
                          Successfully Deleted: C:\WINDOWS\system32\r4r60e9seh.dll

                          msg11?.dll
                          0 fichier(s) copi‚(s).

                          Restoring Windows Update Certificates.:

                          The following Is the Current Export of the Winlogon notify key:
                          ****************************************************************************
                          Windows Registry Editor Version 5.00

                          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

                          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Controls Folder]
                          "Asynchronous"=dword:00000000
                          "DllName"="C:\\WINDOWS\\system32\\h4j40e1qeh.dll"
                          "Impersonate"=dword:00000000
                          "Logon"="WinLogon"
                          "Logoff"="WinLogoff"
                          "Shutdown"="WinShutdown"

                          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
                          "Asynchronous"=dword:00000000
                          "Impersonate"=dword:00000000
                          "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
                          6c,00,00,00
                          "Logoff"="ChainWlxLogoffEvent"

                          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
                          "Asynchronous"=dword:00000000
                          "Impersonate"=dword:00000000
                          "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
                          6c,00,6c,00,00,00
                          "Logoff"="CryptnetWlxLogoffEvent"

                          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
                          "DLLName"="cscdll.dll"
                          "Logon"="WinlogonLogonEvent"
                          "Logoff"="WinlogonLogoffEvent"
                          "ScreenSaver"="WinlogonScreenSaverEvent"
                          "Startup"="WinlogonStartupEvent"
                          "Shutdown"="WinlogonShutdownEvent"
                          "StartShell"="WinlogonStartShellEvent"
                          "Impersonate"=dword:00000000
                          "Asynchronous"=dword:00000001

                          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mljgg]
                          "Asynchronous"=dword:00000001
                          "DllName"="C:\\WINDOWS\\System32\\mljgg.dll"
                          "Impersonate"=dword:00000000
                          "Startup"="SysLogon"
                          "Logoff"="SysLogoff"

                          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
                          "DLLName"="wlnotify.dll"
                          "Logon"="SCardStartCertProp"
                          "Logoff"="SCardStopCertProp"
                          "Lock"="SCardSuspendCertProp"
                          "Unlock"="SCardResumeCertProp"
                          "Enabled"=dword:00000001
                          "Impersonate"=dword:00000001
                          "Asynchronous"=dword:00000001

                          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
                          "Asynchronous"=dword:00000000
                          "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
                          6c,00,6c,00,00,00
                          "Impersonate"=dword:00000000
                          "StartShell"="SchedStartShell"
                          "Logoff"="SchedEventLogOff"

                          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
                          "Logoff"="WLEventLogoff"
                          "Impersonate"=dword:00000000
                          "Asynchronous"=dword:00000001
                          "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
                          6c,00,6c,00,00,00

                          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
                          "DLLName"="WlNotify.dll"
                          "Lock"="SensLockEvent"
                          "Logon"="SensLogonEvent"
                          "Logoff"="SensLogoffEvent"
                          "Safe"=dword:00000001
                          "MaxWait"=dword:00000258
                          "StartScreenSaver"="SensStartScreenSaverEvent"
                          "StopScreenSaver"="SensStopScreenSaverEvent"
                          "Startup"="SensStartupEvent"
                          "Shutdown"="SensShutdownEvent"
                          "StartShell"="SensStartShellEvent"
                          "PostShell"="SensPostShellEvent"
                          "Disconnect"="SensDisconnectEvent"
                          "Reconnect"="SensReconnectEvent"
                          "Unlock"="SensUnlockEvent"
                          "Impersonate"=dword:00000001
                          "Asynchronous"=dword:00000001

                          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
                          "Asynchronous"=dword:00000000
                          "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
                          6c,00,6c,00,00,00
                          "Impersonate"=dword:00000000
                          "Logoff"="TSEventLogoff"
                          "Logon"="TSEventLogon"
                          "PostShell"="TSEventPostShell"
                          "Shutdown"="TSEventShutdown"
                          "StartShell"="TSEventStartShell"
                          "Startup"="TSEventStartup"
                          "MaxWait"=dword:00000258
                          "Reconnect"="TSEventReconnect"
                          "Disconnect"="TSEventDisconnect"

                          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
                          "DLLName"="wlnotify.dll"
                          "Logon"="RegisterTicketExpiredNotificationEvent"
                          "Logoff"="UnregisterTicketExpiredNotificationEvent"
                          "Impersonate"=dword:00000001
                          "Asynchronous"=dword:00000001

                          The following are the files found:
                          ****************************************************************************
                          C:\WINDOWS\system32\h4j40e1qeh.dll
                          C:\WINDOWS\system32\i242lcho1f4c.dll
                          C:\WINDOWS\system32\mvjet40.dll
                          C:\WINDOWS\system32\r4r60e9seh.dll

                          Registry Entries that were Deleted:
                          Please verify that the listing looks ok.
                          If there was something deleted wrongly there are backups in the backreg folder.
                          ****************************************************************************
                          Windows Registry Editor Version 5.00

                          [HKEY_CLASSES_ROOT\CLSID\{4A47E6A1-035E-4421-8B42-78C20CAA0461}]
                          @=""

                          [HKEY_CLASSES_ROOT\CLSID\{4A47E6A1-035E-4421-8B42-78C20CAA0461}\Implemented Categories]
                          @=""

                          [HKEY_CLASSES_ROOT\CLSID\{4A47E6A1-035E-4421-8B42-78C20CAA0461}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
                          @=""

                          [HKEY_CLASSES_ROOT\CLSID\{4A47E6A1-035E-4421-8B42-78C20CAA0461}\InprocServer32]
                          @="C:\\WINDOWS\\system32\\mvjet40.dll"
                          "ThreadingModel"="Apartment"

                          REGEDIT4

                          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
                          "{D3374542-AE06-44F8-8AE5-2AEE4F2C8180}"=-
                          "{4A47E6A1-035E-4421-8B42-78C20CAA0461}"=-
                          [-HKEY_CLASSES_ROOT\CLSID\{D3374542-AE06-44F8-8AE5-2AEE4F2C8180}]
                          [-HKEY_CLASSES_ROOT\CLSID\{4A47E6A1-035E-4421-8B42-78C20CAA0461}]
                          REGEDIT4

                          [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
                          ****************************************************************************
                          Desktop.ini Contents:
                          ****************************************************************************

                          ****************************************************************************
                          Checking for L2MFix account(0=no 1=yes):
                          0
                          Zipping up files for submission:
                          adding: dlls/h4j40e1qeh.dll (164 bytes security) (deflated 5%)
                          adding: dlls/i242lcho1f4c.dll (164 bytes security) (deflated 6%)
                          adding: dlls/mvjet40.dll (164 bytes security) (deflated 5%)
                          adding: dlls/r4r60e9seh.dll (164 bytes security) (deflated 5%)
                          adding: backregs/4A47E6A1-035E-4421-8B42-78C20CAA0461.reg (212 bytes security) (deflated 70%)
                          adding: backregs/notibac.reg (164 bytes security) (deflated 87%)
                          adding: backregs/shell.reg (164 bytes security) (deflated 74%)

                          et pour le Hijackthis :

                          Logfile of HijackThis v1.99.1
                          Scan saved at 10:23:15, on 24/10/2006
                          Platform: Windows XP SP1 (WinNT 5.01.2600)
                          MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

                          Running processes:
                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\Explorer.EXE
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\WINDOWS\ATKKBService.exe
                          C:\Documents and Settings\Administrateur\Bureau\ewido anti-spyware 4.0\guard.exe
                          C:\WINDOWS\system32\notepad.exe
                          C:\WINDOWS\System32\nvsvc32.exe
                          C:\Documents and Settings\Administrateur\Bureau\ewido anti-spyware 4.0\ewido.exe
                          C:\WINDOWS\System32\ctfmon.exe
                          C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                          C:\Documents and Settings\Administrateur\Bureau\HijackThis.exe

                          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                          R3 - URLSearchHook: (no name) - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
                          O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
                          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
                          O4 - HKLM\..\Run: [Ad-aware] "C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe" +c
                          O4 - HKLM\..\Run: [!ewido] "C:\Documents and Settings\Administrateur\Bureau\ewido anti-spyware 4.0\ewido.exe" /minimized
                          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
                          O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                          O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
                          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                          O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
                          O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
                          O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
                          O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
                          O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                          O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                          O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                          O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
                          O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
                          O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
                          O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Documents and Settings\Administrateur\Bureau\ewido anti-spyware 4.0\guard.exe
                          O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
                          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
                          O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

                          J'attends tes instructions pour la suite.... mais serait-ce bon signe depuis 2mn je n'ai pas de nouvelles fenêtres, ce qui est assez extraordinaire...

                          A +

                          Ciletfil
                          0
                          1. green day Modérateur
                            Salut

                            ok,

                            - Quitter le net, le navigateur, et toutes autres fenêtres d'applications ;
                            - Double-cliquer sur l2mfix.bat ;
                            - Choisir OPTION 2 (Run fix) et valider par la touche [Entrée] ;
                            - A l'invite, appuyer sur une touche du clavier pour redémarrer le PC ;
                            => Au redémarrage, le nettoyage de L2mFix se poursuit, puis génère le résultat du nettoyage en ouvrant le Bloc-notes ; se reconnecter pour le poster au forum.

                            ensuite reposte un nouveau hijackthis stp

                            @+

                            0
                            1. green day Modérateur
                              Salut

                              belle infection !

                              No action taken.

                              refais le scan avec ewido, et regle le sur "deleted" pour qui te supprime tout ce qu'il trouve !

                              ensuite :

                              Télécharger l2mfix.exe sur http://www.downloads.subratam.org/l2mfix.exe

                              - Quitter le net, le navigateur, et toutes autres fenêtres d'applications ;
                              - Dézipper l2mfix.exe sur le bureau ;
                              - Dans le dossier du programme, double-cliquer sur l2mfix.bat ;
                              - Choisir OPTION 1 (Run find log) et valider par la touche [Entrée] ;
                              => Un rapport sera généré dans le Bloc-notes, se reconnecter pour le poster au forum.

                              ++

                              **En vérité, le chemin importe peu, la volonté d'arriver suffit à tout ( A.Camus ) **
                              0
                              1. ciletfil Auteur
                                Bonsoir, me revoilà... avec ma belle infection !

                                Voici le rapport de I2mfix :

                                L2MFIX find log 051206
                                These are the registry keys present
                                **********************************************************************************
                                Winlogon/notify:
                                Windows Registry Editor Version 5.00

                                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

                                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
                                "Asynchronous"=dword:00000000
                                "Impersonate"=dword:00000000
                                "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
                                6c,00,00,00
                                "Logoff"="ChainWlxLogoffEvent"

                                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
                                "Asynchronous"=dword:00000000
                                "Impersonate"=dword:00000000
                                "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
                                6c,00,6c,00,00,00
                                "Logoff"="CryptnetWlxLogoffEvent"

                                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
                                "DLLName"="cscdll.dll"
                                "Logon"="WinlogonLogonEvent"
                                "Logoff"="WinlogonLogoffEvent"
                                "ScreenSaver"="WinlogonScreenSaverEvent"
                                "Startup"="WinlogonStartupEvent"
                                "Shutdown"="WinlogonShutdownEvent"
                                "StartShell"="WinlogonStartShellEvent"
                                "Impersonate"=dword:00000000
                                "Asynchronous"=dword:00000001

                                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MediaContentIndex]
                                "Asynchronous"=dword:00000000
                                "DllName"="C:\\WINDOWS\\system32\\h4j40e1qeh.dll"
                                "Impersonate"=dword:00000000
                                "Logon"="WinLogon"
                                "Logoff"="WinLogoff"
                                "Shutdown"="WinShutdown"

                                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mljgg]
                                "Asynchronous"=dword:00000001
                                "DllName"="C:\\WINDOWS\\System32\\mljgg.dll"
                                "Impersonate"=dword:00000000
                                "Startup"="SysLogon"
                                "Logoff"="SysLogoff"

                                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
                                "DLLName"="wlnotify.dll"
                                "Logon"="SCardStartCertProp"
                                "Logoff"="SCardStopCertProp"
                                "Lock"="SCardSuspendCertProp"
                                "Unlock"="SCardResumeCertProp"
                                "Enabled"=dword:00000001
                                "Impersonate"=dword:00000001
                                "Asynchronous"=dword:00000001

                                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
                                "Asynchronous"=dword:00000000
                                "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
                                6c,00,6c,00,00,00
                                "Impersonate"=dword:00000000
                                "StartShell"="SchedStartShell"
                                "Logoff"="SchedEventLogOff"

                                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
                                "Logoff"="WLEventLogoff"
                                "Impersonate"=dword:00000000
                                "Asynchronous"=dword:00000001
                                "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
                                6c,00,6c,00,00,00

                                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
                                "DLLName"="WlNotify.dll"
                                "Lock"="SensLockEvent"
                                "Logon"="SensLogonEvent"
                                "Logoff"="SensLogoffEvent"
                                "Safe"=dword:00000001
                                "MaxWait"=dword:00000258
                                "StartScreenSaver"="SensStartScreenSaverEvent"
                                "StopScreenSaver"="SensStopScreenSaverEvent"
                                "Startup"="SensStartupEvent"
                                "Shutdown"="SensShutdownEvent"
                                "StartShell"="SensStartShellEvent"
                                "PostShell"="SensPostShellEvent"
                                "Disconnect"="SensDisconnectEvent"
                                "Reconnect"="SensReconnectEvent"
                                "Unlock"="SensUnlockEvent"
                                "Impersonate"=dword:00000001
                                "Asynchronous"=dword:00000001

                                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
                                "Asynchronous"=dword:00000000
                                "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
                                6c,00,6c,00,00,00
                                "Impersonate"=dword:00000000
                                "Logoff"="TSEventLogoff"
                                "Logon"="TSEventLogon"
                                "PostShell"="TSEventPostShell"
                                "Shutdown"="TSEventShutdown"
                                "StartShell"="TSEventStartShell"
                                "Startup"="TSEventStartup"
                                "MaxWait"=dword:00000258
                                "Reconnect"="TSEventReconnect"
                                "Disconnect"="TSEventDisconnect"

                                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
                                "DLLName"="wlnotify.dll"
                                "Logon"="RegisterTicketExpiredNotificationEvent"
                                "Logoff"="UnregisterTicketExpiredNotificationEvent"
                                "Impersonate"=dword:00000001
                                "Asynchronous"=dword:00000001

                                **********************************************************************************
                                useragent:
                                Windows Registry Editor Version 5.00

                                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
                                "{E7A39F98-A275-50E0-7E68-EE767AADA27A}"=""

                                **********************************************************************************
                                Shell Extension key:
                                Windows Registry Editor Version 5.00

                                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
                                "{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"
                                "{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"
                                "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"
                                "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"
                                "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
                                "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
                                "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"
                                "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration"
                                "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"
                                "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"
                                "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚"
                                "{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement"
                                "{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"
                                "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows"
                                "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"
                                "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"
                                "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers"
                                "{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web"
                                "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
                                "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"
                                "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"
                                "{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal"
                                "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
                                "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
                                "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"
                                "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
                                "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
                                "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"
                                "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"
                                "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau"
                                "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau"
                                "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo"
                                "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo"
                                "{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo"
                                "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo"
                                "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo"
                                "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
                                "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Extension feuille de propri‚t‚ de mise … jour automatique"
                                "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows"
                                "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft"
                                "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
                                "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
                                "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"
                                "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer"
                                "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher"
                                "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
                                "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
                                "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..."
                                "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
                                "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique"
                                "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices"
                                "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration"
                                "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
                                "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
                                "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
                                "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
                                "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
                                "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
                                "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"
                                "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement"
                                "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"
                                "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"
                                "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
                                "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"
                                "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche"
                                "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
                                "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"
                                "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"
                                "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"
                                "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
                                "{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"
                                "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"
                                "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
                                "{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"
                                "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"
                                "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
                                "{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"
                                "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses"
                                "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"
                                "{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"
                                "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"
                                "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"
                                "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
                                "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"
                                "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
                                "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"
                                "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"
                                "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
                                "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
                                "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
                                "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
                                "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
                                "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
                                "{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique"
                                "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
                                "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
                                "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
                                "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"
                                "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
                                "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
                                "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
                                "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
                                "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
                                "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
                                "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
                                "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
                                "{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache"
                                "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
                                "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
                                "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription"
                                "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
                                "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
                                "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
                                "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
                                "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
                                "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
                                "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
                                "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement"
                                "{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es"
                                "{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin"
                                "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
                                "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
                                "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI"
                                "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)"
                                "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML"
                                "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
                                "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web"
                                "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web"
                                "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell"
                                "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport"
                                "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs"
                                "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
                                "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
                                "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne"
                                "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne"
                                "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
                                "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
                                "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
                                "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
                                "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
                                "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
                                "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
                                "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
                                "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
                                "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
                                "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
                                "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
                                "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
                                "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
                                "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
                                "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
                                "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
                                "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
                                "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
                                "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
                                "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
                                "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"
                                "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
                                "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
                                "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
                                "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
                                "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
                                "{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."
                                "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
                                "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
                                "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
                                "{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"
                                "{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper"
                                "{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer"
                                "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
                                "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu"
                                "{D3374542-AE06-44F8-8AE5-2AEE4F2C8180}"=""
                                "{4A47E6A1-035E-4421-8B42-78C20CAA0461}"=""
                                "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Dossiers Web"
                                "{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
                                "{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"
                                "{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
                                "{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}"="TuneUp Shredder Shell Context Menu Extension"
                                "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
                                "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"

                                **********************************************************************************
                                HKEY ROOT CLASSIDS:
                                Windows Registry Editor Version 5.00

                                [HKEY_CLASSES_ROOT\CLSID\{4A47E6A1-035E-4421-8B42-78C20CAA0461}]
                                @=""

                                [HKEY_CLASSES_ROOT\CLSID\{4A47E6A1-035E-4421-8B42-78C20CAA0461}\Implemented Categories]
                                @=""

                                [HKEY_CLASSES_ROOT\CLSID\{4A47E6A1-035E-4421-8B42-78C20CAA0461}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
                                @=""

                                [HKEY_CLASSES_ROOT\CLSID\{4A47E6A1-035E-4421-8B42-78C20CAA0461}\InprocServer32]
                                @="C:\\WINDOWS\\system32\\cimodem.dll"
                                "ThreadingModel"="Apartment"

                                **********************************************************************************
                                Files Found are not all bad files:

                                C:\WINDOWS\SYSTEM32\
                                cimodem.dll Mon 23 Oct 2006 19:27:10 ..... 235 859 230,33 K
                                h4j40e~1.dll Sun 22 Oct 2006 18:25:22 ..S.R 235 859 230,33 K
                                i242lc~1.dll Mon 23 Oct 2006 19:27:10 ..S.R 237 101 231,54 K
                                mljgg.dll Tue 17 Oct 2006 20:36:06 A.SH. 684 084 668,05 K

                                4 items found: 4 files (3 H/S), 0 directories.
                                Total of file sizes: 1 392 903 bytes 1,33 M
                                Locate .tmp files:

                                No matches found.
                                **********************************************************************************
                                Directory Listing of system files:
                                Le volume dans le lecteur C n'a pas de nom.
                                Le num‚ro de s‚rie du volume est B01A-34D4

                                R‚pertoire de C:\WINDOWS\System32

                                23/10/2006 20:17 390ÿ161 ggjlm.ini
                                23/10/2006 19:27 391ÿ552 ggjlm.bak2
                                23/10/2006 19:27 237ÿ101 i242lcho1f4c.dll
                                22/10/2006 18:25 235ÿ859 h4j40e1qeh.dll
                                18/10/2006 10:40 <REP> dllcache
                                17/10/2006 20:36 323ÿ178 ggjlm.bak1
                                17/10/2006 20:36 684ÿ084 mljgg.dll
                                17/10/2006 15:39 <REP> Microsoft
                                6 fichier(s) 2ÿ261ÿ935 octets
                                2 R‚p(s) 102ÿ553ÿ731ÿ072 octets libres

                                A tout bientôt pour la suite... elles me saoulent vraiment ces fenêtres qui s'ouvrent à tout bout de champ !!!

                                Merci d'avance,

                                Ciletfil
                                0
                            2. ciletfil Auteur
                              Merci de m'avoir répondu ,

                              Voici donc le résultat des courses après avoir fait les maipulations en question :

                              1er rapport avec Ewido :
                              ---------------------------------------------------------
                              ewido anti-spyware - Scan Report
                              ---------------------------------------------------------

                              + Created at: 18:50:06 22/10/2006

                              + Scan result:

                              HKLM\SOFTWARE\DeluxeCommunications -> Adware.DeluxeCommunications : No action taken.
                              HKLM\SOFTWARE\DeluxeCommunications\Internet Explorer -> Adware.DeluxeCommunications : No action taken.
                              C:\WINDOWS\system32\k4440ehqeh4e0.dll -> Adware.Look2Me : No action taken.
                              C:\WINDOWS\system32\lv0209doe.dll -> Adware.Look2Me : No action taken.
                              [1464] C:\WINDOWS\system32\mlxmlr.dll -> Adware.Look2Me : No action taken.
                              [2044] C:\WINDOWS\system32\mlxmlr.dll -> Adware.Look2Me : No action taken.
                              C:\Program Files\Deskbar -> Adware.Softomate : No action taken.
                              C:\Program Files\Deskbar\Cache -> Adware.Softomate : No action taken.
                              C:\Program Files\Deskbar\about.html -> Adware.Softomate : No action taken.
                              C:\Program Files\Deskbar\basis.xml -> Adware.Softomate : No action taken.
                              C:\Program Files\Deskbar\deskbar.crc -> Adware.Softomate : No action taken.
                              C:\Program Files\Deskbar\deskbar.inf -> Adware.Softomate : No action taken.
                              C:\Program Files\Deskbar\icons.bmp -> Adware.Softomate : No action taken.
                              C:\Program Files\Deskbar\inst.bat -> Adware.Softomate : No action taken.
                              C:\Program Files\Deskbar\mbback.bmp -> Adware.Softomate : No action taken.
                              C:\Program Files\Deskbar\mbbigopen.bmp -> Adware.Softomate : No action taken.
                              C:\Program Files\Deskbar\mbclose.bmp -> Adware.Softomate : No action taken.
                              C:\Program Files\Deskbar\mbfwd.bmp -> Adware.Softomate : No action taken.
                              C:\Program Files\Deskbar\mblogo.bmp -> Adware.Softomate : No action taken.
                              C:\Program Files\Deskbar\mbsep.bmp -> Adware.Softomate : No action taken.
                              C:\Program Files\Deskbar\options.html -> Adware.Softomate : No action taken.
                              C:\Program Files\Deskbar\softomate.gif -> Adware.Softomate : No action taken.
                              C:\Program Files\Deskbar\version.txt -> Adware.Softomate : No action taken.
                              C:\deskbar.exe -> Adware.Softomate : No action taken.
                              C:\deskbar_e31.exe/deskbar.exe -> Adware.Softomate : No action taken.
                              HKLM\SOFTWARE\Classes\CLSID\{A8B28872-3324-4CD2-8AA3-7D555C872D96} -> Adware.Softomate : No action taken.
                              HKLM\SOFTWARE\Classes\CLSID\{D7CC80D4-376C-4586-B023-4F35C2CEB28E} -> Adware.Softomate : No action taken.
                              C:\Documents and Settings\Administrateur\Local Settings\Temp\i6.tmp -> Adware.SurfSide : No action taken.
                              C:\WINDOWS\system32\fbjh.exe -> Backdoor.PoeBot.c : No action taken.
                              C:\WINDOWS\algs.exe -> Downloader.Small.duf : No action taken.
                              C:\WINDOWS\system32\zhwdfeux.exe -> Dropper.Paradrop.a : No action taken.
                              C:\Documents and Settings\Administrateur\Cookies\administrateur@247realmedia[1].txt -> TrackingCookie.247realmedia : No action taken.
                              C:\Documents and Settings\Administrateur\Cookies\administrateur@ldproducts.122.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
                              C:\Documents and Settings\Administrateur\Cookies\administrateur@rotator.adjuggler[2].txt -> TrackingCookie.Adjuggler : No action taken.
                              C:\Documents and Settings\Administrateur\Cookies\administrateur@bluestreak[2].txt -> TrackingCookie.Bluestreak : No action taken.
                              C:\Documents and Settings\Administrateur\Cookies\administrateur@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : No action taken.
                              C:\Documents and Settings\Administrateur\Cookies\administrateur@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken.
                              C:\Documents and Settings\Administrateur\Cookies\administrateur@mediaplex[1].txt -> TrackingCookie.Mediaplex : No action taken.
                              C:\RECYCLER\S-1-5-21-1935655697-776561741-839522115-500\Dc1.txt -> TrackingCookie.Mediaplex : No action taken.
                              C:\Documents and Settings\Administrateur\Cookies\administrateur@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : No action taken.
                              C:\Documents and Settings\Administrateur\Cookies\administrateur@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : No action taken.

                              J'ai tout "delete"

                              Voici ensuite le rapport de BitDefender :

                              BitDefender Online Scanner - Real Time Virus Report

                              Generated at: Sun, Oct 22, 2006 - 20:20:10

                              Statistics

                              Time
                              01:01:14

                              Files
                              375999

                              Folders
                              1286

                              Boot Sectors
                              4

                              Archives
                              1042

                              Packed Files
                              54406

                              Results

                              Identified Viruses
                              7

                              Infected Files
                              30

                              Suspect Files
                              4

                              Warnings
                              0

                              Disinfected
                              0

                              Deleted Files
                              40

                              Engines Info

                              Virus Definitions
                              478166

                              Engine build
                              AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38)

                              Scan plugins
                              13

                              Archive plugins
                              38

                              Unpack plugins
                              6

                              E-mail plugins
                              6

                              System plugins
                              1

                              Scan Settings

                              First Action
                              Disinfect

                              Second Action
                              Delete

                              Heuristics
                              Yes

                              Enable Warnings
                              Yes

                              Scanned Extensions
                              *;

                              Exclude Extensions

                              Scan Emails
                              Yes

                              Scan Archives
                              Yes

                              Scan Packed
                              Yes

                              Scan Files
                              Yes

                              Scan Boot
                              Yes

                              Scanned File
                              Status

                              C:\drsmartload.exe
                              Infected with: Trojan.Downloader.Adload.EV

                              C:\drsmartload.exe
                              Disinfection failed

                              C:\drsmartload.exe
                              Deleted

                              C:\nwnmff_e32.exe
                              Infected with: Trojan.Spy.DollarRevenue.J

                              C:\nwnmff_e32.exe
                              Disinfection failed

                              C:\nwnmff_e32.exe
                              Deleted

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\30f4104c4f0c8e9c1346aa3791e15c5c.a2q=>Documents and Settings/Administrateur/Local Settings/Temp/cmdinst.exe=>(Quarantine-PE)
                              Infected with: Trojan.Proxy.493

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\30f4104c4f0c8e9c1346aa3791e15c5c.a2q=>Documents and Settings/Administrateur/Local Settings/Temp/cmdinst.exe=>(Quarantine-PE)
                              Disinfection failed

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\30f4104c4f0c8e9c1346aa3791e15c5c.a2q=>Documents and Settings/Administrateur/Local Settings/Temp/cmdinst.exe=>(Quarantine-PE)
                              Deleted

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\30f4104c4f0c8e9c1346aa3791e15c5c.a2q
                              Updated

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\4e5c544a79261f4ee11abfea1ca72851.a2q=>Program Files/Network Monitor/netmon.exe=>(Quarantine-PE)
                              Infected with: Trojan.Dnschange.F

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\4e5c544a79261f4ee11abfea1ca72851.a2q=>Program Files/Network Monitor/netmon.exe=>(Quarantine-PE)
                              Disinfection failed

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\4e5c544a79261f4ee11abfea1ca72851.a2q=>Program Files/Network Monitor/netmon.exe=>(Quarantine-PE)
                              Deleted

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\4e5c544a79261f4ee11abfea1ca72851.a2q
                              Updated

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\4f709a7e2072cd393dac764876bd7880.a2q=>Installer4.exe=>(Quarantine-PE)
                              Infected with: Trojan.Canbede.L

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\4f709a7e2072cd393dac764876bd7880.a2q=>Installer4.exe=>(Quarantine-PE)
                              Disinfection failed

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\4f709a7e2072cd393dac764876bd7880.a2q=>Installer4.exe=>(Quarantine-PE)
                              Deleted

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\4f709a7e2072cd393dac764876bd7880.a2q
                              Updated

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\69daa19119f83448a1c76614213d0df9.a2q=>WINDOWS/system32/config/systemprofile/Local Settings/Temporary Internet Files/Content.IE5/KP8I87UY/AppWrap[1].exe=>(Quarantine-PE)
                              Infected with: Trojan.Qurl.3

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\69daa19119f83448a1c76614213d0df9.a2q=>WINDOWS/system32/config/systemprofile/Local Settings/Temporary Internet Files/Content.IE5/KP8I87UY/AppWrap[1].exe=>(Quarantine-PE)
                              Disinfection failed

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\69daa19119f83448a1c76614213d0df9.a2q=>WINDOWS/system32/config/systemprofile/Local Settings/Temporary Internet Files/Content.IE5/KP8I87UY/AppWrap[1].exe=>(Quarantine-PE)
                              Deleted

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\69daa19119f83448a1c76614213d0df9.a2q
                              Updated

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\bfc565a5333aee4517f11b13b0470519.a2q=>WINDOWS/system32/config/systemprofile/Local Settings/Temporary Internet Files/Content.IE5/0HYKOCY7/AppWrap[1].exe=>(Quarantine-PE)
                              Infected with: Trojan.Qurl.3

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\bfc565a5333aee4517f11b13b0470519.a2q=>WINDOWS/system32/config/systemprofile/Local Settings/Temporary Internet Files/Content.IE5/0HYKOCY7/AppWrap[1].exe=>(Quarantine-PE)
                              Disinfection failed

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\bfc565a5333aee4517f11b13b0470519.a2q=>WINDOWS/system32/config/systemprofile/Local Settings/Temporary Internet Files/Content.IE5/0HYKOCY7/AppWrap[1].exe=>(Quarantine-PE)
                              Deleted

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\bfc565a5333aee4517f11b13b0470519.a2q
                              Updated

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\d784cf8150f207484dc04af28351737e.a2q=>WINDOWS/icont.exe=>(Quarantine-PE)
                              Infected with: Trojan.Qurl.3

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\d784cf8150f207484dc04af28351737e.a2q=>WINDOWS/icont.exe=>(Quarantine-PE)
                              Disinfection failed

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\d784cf8150f207484dc04af28351737e.a2q=>WINDOWS/icont.exe=>(Quarantine-PE)
                              Deleted

                              C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\Quarantine\d784cf8150f207484dc04af28351737e.a2q
                              Updated

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0005714.exe
                              Infected with: Trojan.Canbede.L

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0005714.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0005714.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0006437.dll
                              Infected with: Trojan.Candebe.CZ

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0006437.dll
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0006437.dll
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0006441.dll
                              Infected with: Trojan.Candebe.CZ

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0006441.dll
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0006441.dll
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0006460.exe
                              Infected with: Trojan.Dnschange.F

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0006460.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0006460.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0007199.exe
                              Infected with: Trojan.Dnschange.F

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0007199.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0007199.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0007698.exe
                              Infected with: Trojan.Dnschange.F

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0007698.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0007698.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0008144.exe
                              Infected with: Trojan.Qurl.3

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0008144.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0008144.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0008649.exe
                              Infected with: Trojan.Dnschange.F

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0008649.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\Fifoed\A0008649.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP10\A0054745.exe
                              Suspected of: Trojan.Downloader.Tiny.AU

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP10\A0054745.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP10\A0054745.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP6\A0010131.exe
                              Infected with: Trojan.Dnschange.F

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP6\A0010131.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP6\A0010131.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP6\A0010558.exe
                              Infected with: Trojan.Dnschange.F

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP6\A0010558.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP6\A0010558.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP7\A0010902.exe
                              Infected with: Trojan.Dnschange.F

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP7\A0010902.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP7\A0010902.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP8\A0011455.exe
                              Infected with: Trojan.Dnschange.F

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP8\A0011455.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP8\A0011455.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0012342.exe
                              Infected with: Trojan.Dnschange.F

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0012342.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0012342.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0012394.exe
                              Infected with: Trojan.Canbede.L

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0012394.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0012394.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0014009.exe
                              Suspected of: Trojan.Downloader.Tiny.AU

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0014009.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0014009.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0014015.exe
                              Infected with: Trojan.Qurl.3

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0014015.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0014015.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0017167.exe
                              Infected with: Trojan.Dnschange.F

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0017167.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0017167.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0017361.exe
                              Infected with: Trojan.Canbede.L

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0017361.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0017361.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0021669.exe
                              Infected with: Trojan.Qurl.3

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0021669.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0021669.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0022897.exe
                              Infected with: Trojan.Dnschange.F

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0022897.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0022897.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0023637.exe
                              Infected with: Trojan.Dnschange.F

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0023637.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0023637.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0023803.exe
                              Infected with: Trojan.Canbede.L

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0023803.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0023803.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0025410.exe
                              Suspected of: Trojan.Downloader.Tiny.AU

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0025410.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0025410.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0025869.exe
                              Infected with: Trojan.Qurl.3

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0025869.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0025869.exe
                              Deleted

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0043139.exe
                              Suspected of: Trojan.Downloader.Tiny.AU

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0043139.exe
                              Disinfection failed

                              C:\System Volume Information\_restore{EF49AAAE-D175-4A91-B27E-14F8DA54BE9A}\RP9\A0043139.exe
                              Deleted

                              et voici le dernier rapport Hijackthis à la suite :

                              Logfile of HijackThis v1.99.1
                              Scan saved at 20:25:13, on 22/10/2006
                              Platform: Windows XP SP1 (WinNT 5.01.2600)
                              MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

                              Running processes:
                              C:\WINDOWS\System32\smss.exe
                              C:\WINDOWS\system32\winlogon.exe
                              C:\WINDOWS\system32\services.exe
                              C:\WINDOWS\system32\lsass.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\System32\svchost.exe
                              C:\WINDOWS\system32\rundll32.exe
                              C:\WINDOWS\system32\spoolsv.exe
                              C:\WINDOWS\ATKKBService.exe
                              C:\WINDOWS\System32\nvsvc32.exe
                              C:\WINDOWS\Explorer.EXE
                              C:\WINDOWS\System32\ctfmon.exe
                              C:\Program Files\Internet Explorer\iexplore.exe
                              C:\Documents and Settings\Administrateur\Bureau\ewido anti-spyware 4.0\guard.exe
                              C:\Documents and Settings\Administrateur\Bureau\ewido anti-spyware 4.0\ewido.exe
                              C:\WINDOWS\System32\taskmgr.exe
                              C:\Documents and Settings\Administrateur\Bureau\HijackThis.exe

                              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                              R3 - URLSearchHook: (no name) - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
                              O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
                              O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                              O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
                              O4 - HKLM\..\Run: [Ad-aware] "C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe" +c
                              O4 - HKLM\..\Run: [!ewido] "C:\Documents and Settings\Administrateur\Bureau\ewido anti-spyware 4.0\ewido.exe" /minimized
                              O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
                              O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                              O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
                              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                              O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
                              O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
                              O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
                              O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
                              O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                              O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                              O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                              O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
                              O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
                              O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
                              O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Documents and Settings\Administrateur\Bureau\ewido anti-spyware 4.0\guard.exe
                              O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
                              O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
                              O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

                              C'est du chinois pour moi...
                              J'espère que c'est plus clair pour toi... en tout cas merci pour tes lumières...

                              A très vite

                              ciletfil
                              0
                              1. green day Modérateur
                                Salut

                                fais le 1/ et 2/ de ce lien stp :

                                virus methode preliminaire de desinfection version fr

                                ++
                                0

                                Discussions similaires

                                Problème de clavier, des fenêtre s'ouvrent !!
                                Lyon691D

                                5 réponses
                                Clavier ouvre raccourcis
                                angellee

                                11 réponses
                                Mon pc ouvre des fenêtres et le clavier écrit
                                Louise19

                                3 réponses
                                Fenêtres qui s'ouvrent toutes seules
                                mamanou1943

                                6 réponses
                                fenêtres qui s'ouvrent de façon intempestive
                                wince

                                1 réponse